github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-09 02:29:36 +00:00
Code Issues Projects Releases Wiki Activity

rule(Change thread namespace): fix regression test

Browse Source 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
This commit is contained in:
Hiroki Suezawa
2020-02-26 09:58:34 +09:00
committed by poiana
parent 742538ac86
commit 3067af566e
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@@ -1550,7 +1550,7 @@
and not proc.name in (user_known_change_thread_namespace_binaries)
and not proc.name startswith "runc"
and not proc.cmdline startswith "containerd"
and not proc.pname in (sysdigcloud_binaries)
and not proc.pname in (sysdigcloud_binaries, hyperkube, kubelet)
and not python_running_sdchecks
and not java_running_sdjagent
and not kubelet_running_loopback

2
test/falco_tests.yaml
View File

@@ -689,7 +689,7 @@ trace_files: !mux
- "Non sudo setuid": 1
- "Create files below dev": 1
- "Modify binary dirs": 2
- "Change thread namespace": 2
- "Change thread namespace": 1
disabled_tags_a:
detect: True

4
test/falco_traces.yaml.in
View File

@@ -26,7 +26,7 @@ traces: !mux
detect: True
detect_level: NOTICE
detect_counts:
- "Change thread namespace": 2
- "Change thread namespace": 1
container-privileged:
trace_file: traces-positive/container-privileged.scap
@@ -73,7 +73,7 @@ traces: !mux
- "Non sudo setuid": 1
- "Create files below dev": 1
- "Modify binary dirs": 2
- "Change thread namespace": 2
- "Change thread namespace": 1
mkdir-binary-dirs:
trace_file: traces-positive/mkdir-binary-dirs.scap