From d29742a61781581c569694372a6a9a631e83bbc9 Mon Sep 17 00:00:00 2001 From: Daniel Kerwin Date: Mon, 6 Mar 2017 21:33:44 +0100 Subject: [PATCH] Add erl_child_setup to shell spawning binaries in a container. sysdig-CLA-1.0-signed-off-by: Daniel Kerwin --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 8e3e47f9..6a453d5e 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -433,7 +433,7 @@ and shell_procs and proc.pname exists and not proc.pname in (shell_binaries, docker_binaries, k8s_binaries, lxd_binaries, aide_wrapper_binaries, nids_binaries, - monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, apache2, falco, cron) + monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, apache2, falco, cron, erl_child_setup) and not trusted_containers output: "Shell spawned in a container other than entrypoint (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)" priority: WARNING