Host-based anomaly detection event (rootcheck)

[knzudgt]

I use dokku in a Ubuntu 18.04 LTS machine.
I received the following alerts concerning files hidden in a long list of directories:

Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Files hidden inside directory '/var/lib/docker/overlay2/c3ee7713915112e9bd1df6d423cc6e2dd35a6d1c9871daae8c53054c05408516/merged/usr/share/man'. Link count does not match number of files (26,1).

Then again:

Files hidden inside directory '/var/lib/docker/overlay2/c3ee7713915112e9bd1df6d423cc6e2dd35a6d1c9871daae8c53054c05408516/merged/usr/share/dpkg'. Link count does not match number of files (2,1).

And so on for a list of 104 directories, like /var/lib/docker/overlay2/c3ee7713915112e9bd1df6d423cc6e2dd35a6d1c9871daae8c53054c05408516/merged/usr/sbin or /var/lib/docker/overlay2/c3ee7713915112e9bd1df6d423cc6e2dd35a6d1c9871daae8c53054c05408516/merged/usr/bin etc etc

How am I expected to interpret these alerts? What am I expected to do?

[ddpbsd]

rootcheck doesn't understand about overlays yet.

[knzudgt]

@ddpbsd what does it mean that rootcheck doesn't understand about overlays? Sorry, but I do not know what an overlay is. Are you saying that probably these are false positives?

[ddpbsd]

@knzudgt I don't understand overlays very well myself. Anyone with more/better knowledge than me should feel free to comment, correct, and educate us all.
From the little I do understand I've gathered that they change the way applications on the host system see those parts of the filesystem. So something that exists inside of a container's filesystem might not be visible outside of that container in the same way. So OSSEC, using older techniques sees a discrepancy between how many files should be there and how many files are actually there (outside of the container) and this triggers the alert.

[mlissner]

Wazuh has a one-line fix for this, here: wazuh/wazuh@460a2d2

Also, this is a dup of: #1528.

Until we can get that fix in place, is there a way to snuff out these false positives?

[atomicturtle]

Thanks for the followup and the duplicate identification. Im going to merge this into 1528 before the PR

Duplicate of: #1528