github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-16 07:47:00 +00:00
Code Issues Projects Releases Wiki Activity

Allow writes to /etc/motd

Browse Source 
These files are relatively innocuous.
This commit is contained in:
Mark Stemm 2017-09-21 08:25:08 -07:00
parent a0e88417fc
commit 09748fcbb3
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -440,7 +440,7 @@
qualys-cloud-ag, locales.postins, nomachine_binaries)
and not proc.pname in (sysdigcloud_binaries, sendmail_config_binaries, hddtemp.postins)
and not fd.name pmatch (safe_etc_dirs)
and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json)
and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)
and not ansible_running_python
and not python_running_denyhosts
and not fluentd_writing_conf_files