github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 16:50:34 +00:00
Code Issues Projects Releases Wiki Activity

added brakets to three macros to make them less ambiguous

Browse Source 
Signed-off-by: Loris Degioanni <loris@sysdig.com>
This commit is contained in:
Loris Degioanni
2020-08-28 16:21:38 -07:00
committed by poiana
parent 0b8ecfaed3
commit 5d71d70a14
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
rules/falco_rules.yaml
View File

@@ -344,8 +344,8 @@
# for efficiency. # for efficiency.
- macro: inbound_outbound - macro: inbound_outbound
condition: > condition: >
(((evt.type in (accept,listen,connect) and evt.dir=<)) or ((((evt.type in (accept,listen,connect) and evt.dir=<)) or
(fd.typechar = 4 or fd.typechar = 6) and (fd.typechar = 4 or fd.typechar = 6)) and
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
(evt.rawres >= 0 or evt.res = EINPROGRESS)) (evt.rawres >= 0 or evt.res = EINPROGRESS))
@@ -696,8 +696,8 @@
- macro: run_by_foreman - macro: run_by_foreman
condition: > condition: >
(user.name=foreman and (user.name=foreman and
(proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or ((proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or
(proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby))) (proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby))))
- macro: java_running_sdjagent - macro: java_running_sdjagent
condition: proc.name=java and proc.cmdline contains sdjagent.jar condition: proc.name=java and proc.cmdline contains sdjagent.jar
@@ -1145,7 +1145,7 @@
- macro: redis_writing_conf - macro: redis_writing_conf
condition: > condition: >
(proc.name in (run-redis, redis-launcher.) and fd.name=/etc/redis.conf or fd.name startswith /etc/redis) (proc.name in (run-redis, redis-launcher.) and (fd.name=/etc/redis.conf or fd.name startswith /etc/redis))
- macro: openvpn_writing_conf - macro: openvpn_writing_conf
condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn) condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn)