From 13931ab5d73de437d3371268838e6085f5f7459c Mon Sep 17 00:00:00 2001 From: Nicolas Marier Date: Thu, 5 Dec 2019 09:47:23 -0500 Subject: [PATCH] rule(Write below etc): whitelist automount writing under /etc This commit allows automount to write under /etc/mtab without flagging it as an error. Signed-off-by: Nicolas Marier --- rules/falco_rules.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index a7a92907..607b7309 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1153,6 +1153,9 @@ - macro: etcd_manager_updating_dns condition: (container and proc.name=etcd-manager and fd.name=/etc/hosts) +- macro: automount_using_mtab + condition: (proc.pname = automount and fd.name startswith /etc/mtab) + # Add conditions to this macro (probably in a separate file, # overwriting this macro) to allow for specific combinations of # programs writing below specific directories below @@ -1269,6 +1272,7 @@ and not jboss_in_container_writing_passwd and not etcd_manager_updating_dns and not user_known_write_below_etc_activities + and not automount_using_mtab - rule: Write below etc desc: an attempt to write to any file below /etc