github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity

More server progs

Browse Source 
- add ssmtp.postinst as a mail config program
 - allow runsv to write below etc
 - allow a2enmod to spawn shells
 - add additional shell cmdline
This commit is contained in:
Mark Stemm 2017-08-01 18:02:23 -07:00
parent 9883656882
commit 33974c6912
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/falco_rules.yaml
View File

@ -211,7 +211,7 @@
- list: sendmail_config_binaries - list: sendmail_config_binaries
items: [ items: [
update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4, update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4,
update_db, update_mc update_db, update_mc, ssmtp.postinst
] ]
- list: make_binaries - list: make_binaries
@ -370,7 +370,7 @@
apparmor_parser, update-mime, tzdata.config, tzdata.postinst, apparmor_parser, update-mime, tzdata.config, tzdata.postinst,
systemd, systemd-machine, systemd-sysuser, systemd, systemd-machine, systemd-sysuser,
debconf-show, rollerd, bind9.postinst, sv, debconf-show, rollerd, bind9.postinst, sv,
gen_resolvconf., update-ca-certi, certbot) gen_resolvconf., update-ca-certi, certbot, runsv)
and not proc.pname in (sysdigcloud_binaries) and not proc.pname in (sysdigcloud_binaries)
and not fd.directory in (/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d) and not fd.directory in (/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d)
and not ansible_running_python and not ansible_running_python
@ -515,7 +515,7 @@
init, pluto, mkinitramfs, unattended-upgr, watch, sysdig, init, pluto, mkinitramfs, unattended-upgr, watch, sysdig,
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup, landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d, npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
serf serf, a2enmod
] ]
- rule: Run shell untrusted - rule: Run shell untrusted
@ -627,6 +627,7 @@
'"sh -c node index.js"', '"sh -c node index.js"',
'"sh -c node index"', '"sh -c node index"',
'"sh -c node ./src/start.js"', '"sh -c node ./src/start.js"',
'"sh -c node app.js"',
'"sh -c node -e \"require(''nan'')\")"', '"sh -c node -e \"require(''nan'')\")"',
'"sh -c node $NODE_DEBUG_OPTION index.js "', '"sh -c node $NODE_DEBUG_OPTION index.js "',
'"sh -c crontab -l 2"', '"sh -c crontab -l 2"',