github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-01 14:37:49 +00:00
Code Issues Projects Releases Wiki Activity

Let celeryd spawn shells

Browse Source 
Parent process name is strange with leading [ and trailing :, so quote
it.
This commit is contained in:
Mark Stemm 2017-11-08 08:12:35 -08:00
parent fdebfb5b6c
commit 4a0ec07235
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/falco_rules.yaml
View File

@ -1119,7 +1119,8 @@
erl_child_setup, erlexec, ceph, PM2, pycompile, py3compile, hhvm, npm, serf,
runsv, supervisord, varnishd, crond, logrotate, timeout, tini,
xrdb, xfce4-session, weave, logdna-agent, bundle, configure, luajit, nginx,
beam.smp, paster, postfix-local, hawkular-metric, fluentd, x2gormforward)
beam.smp, paster, postfix-local, hawkular-metric, fluentd, x2gormforward,
'"[celeryd:"')
and not trusted_containers
and not shell_spawning_containers
and not parent_java_running_echo