github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-17 08:11:32 +00:00
Code Issues Projects Releases Wiki Activity

Misc gem/ruby/bundler changes

Browse Source 
- Let gem install software.
- Let ruby spawn shells when run by bundle.
This commit is contained in:
Mark Stemm 2017-10-09 10:34:41 -07:00
parent 0d88c3020d
commit 43b773e9b2
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
rules/falco_rules.yaml
View File

@ -171,7 +171,7 @@
# The truncated dpkg-preconfigu is intentional, process names are # The truncated dpkg-preconfigu is intentional, process names are
# truncated at the sysdig level. # truncated at the sysdig level.
- list: package_mgmt_binaries - list: package_mgmt_binaries
items: [rpm_binaries, deb_binaries, update-alternat] items: [rpm_binaries, deb_binaries, update-alternat, gem]
- macro: package_mgmt_procs - macro: package_mgmt_procs
condition: proc.name in (package_mgmt_binaries) condition: proc.name in (package_mgmt_binaries)
@ -380,6 +380,13 @@
- macro: mysql_image_running_healthcheck - macro: mysql_image_running_healthcheck
condition: container.image=mysql and proc.cmdline="sh -c /healthcheck.sh" condition: container.image=mysql and proc.cmdline="sh -c /healthcheck.sh"
- macro: bundle_running_ruby
condition: >
(proc.pname=ruby and (
proc.aname[2]=bundle or
proc.aname[3]=bundle or
proc.aname[4]=bundle))
# Qualys seems to run a variety of shell subprocesses, at various # Qualys seems to run a variety of shell subprocesses, at various
# levels. This checks at a few levels without the cost of a full # levels. This checks at a few levels without the cost of a full
# proc.aname, which traverses the full parent heirarchy. # proc.aname, which traverses the full parent heirarchy.
@ -838,6 +845,7 @@
and not run_by_passenger_agent and not run_by_passenger_agent
and not parent_java_running_jenkins and not parent_java_running_jenkins
and not jenkins_script_sh and not jenkins_script_sh
and not bundle_running_ruby
output: > output: >
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3]) shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])