github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity

Add keepalived to list oh shell spawning binaries.

Browse Source 
sysdig-CLA-1.0-signed-off-by: Daniel Kerwin <daniel@gini.net>
This commit is contained in:
Daniel Kerwin 2017-09-04 22:02:30 +02:00
parent 240a8ffffa
commit 598cbbe5e7
No known key found for this signature in database
GPG Key ID: C1C2C5CBCDFC30A5
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -205,6 +205,9 @@
- list: make_binaries
items: [make, gmake, cmake]
- list: keepalived_binaries
items: [keepalived]
- macro: sensitive_files
condition: >
fd.name startswith /etc and
@ -484,7 +487,7 @@
and proc.pname exists
and not proc.pname in (cron_binaries, shell_binaries, make_binaries, known_shell_spawn_binaries, docker_binaries,
k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, mesos_slave_binaries)
monitoring_binaries, gitlab_binaries, mesos_slave_binaries, keepalived_binaries)
and not parent_ansible_running_python
and not parent_bro_running_python
and not parent_python_running_denyhosts