From 30b1f23b17e90621663b141445b827dffaa89bb6 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Wed, 10 Aug 2016 14:15:26 -0700 Subject: [PATCH] Handle dbus-daemon-launch-helper. It starts dbus-daemon. Process names are truncated, though, so use dbus-daemon-lau. --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 178d1be7..e576fb94 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -304,7 +304,7 @@ # sshd, mail programs attempt to setuid to root even when running as non-root. Excluding here to avoid meaningless FPs - rule: non_sudo_setuid desc: an attempt to change users by calling setuid. sudo/su are excluded. user "root" is also excluded, as setuid calls typically involve dropping privileges. - condition: evt.type=setuid and evt.dir=> and not user.name=root and not proc.name in (userexec_binaries, mail_binaries, sshd) + condition: evt.type=setuid and evt.dir=> and not user.name=root and not proc.name in (userexec_binaries, mail_binaries, sshd, dbus-daemon-lau) output: "Unexpected setuid call by non-sudo, non-root program (user=%user.name command=%proc.cmdline uid=%evt.arg.uid)" priority: WARNING