github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity

rule(list package_mgmt_binaries): add snapd to list

Browse Source 
Snap is a package manager by Canonical which was not in the
`package_mgmt_binaries` list.

Signed-off-by: Nicolas Marier <nmarier@coveo.com>
This commit is contained in:
Nicolas Marier 2020-06-29 15:10:00 -04:00 committed by poiana
parent de147447ed
commit 32bae35de2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -232,7 +232,7 @@
# The truncated dpkg-preconfigu is intentional, process names are # The truncated dpkg-preconfigu is intentional, process names are
# truncated at the sysdig level. # truncated at the sysdig level.
- list: package_mgmt_binaries - list: package_mgmt_binaries
items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk] items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]
- macro: package_mgmt_procs - macro: package_mgmt_procs
condition: proc.name in (package_mgmt_binaries) condition: proc.name in (package_mgmt_binaries)