github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-02 06:52:10 +00:00
Code Issues Projects Releases Wiki Activity

Add addl safe root directories

Browse Source
This commit is contained in:
Mark Stemm 2017-11-08 13:40:56 -08:00
parent e02135f9f0
commit 2cbff6ff70
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -695,7 +695,7 @@
items: [/root/.monit.state]
- list: known_root_directories
items: [/root/.oracle_jre_usage, /root/.java/.userPrefs]
items: [/root/.oracle_jre_usage, /root/.java/.userPrefs, /root/.ssh, /root/.cache]
- macro: known_root_conditions
condition: (fd.name startswith /root/orcexec.)