github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 17:12:21 +00:00
Code Issues Projects Releases Wiki Activity

Add addl ruby proc for builds.

Browse Source 
Adding ruby2.1
This commit is contained in:
Mark Stemm 2017-11-07 09:42:15 -08:00
parent e9e0177901
commit 6aae17600f
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -421,7 +421,7 @@
# close enough to add here rather than create a separate macro. # close enough to add here rather than create a separate macro.
- macro: parent_scripting_running_builds - macro: parent_scripting_running_builds
condition: > condition: >
(proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,node) and ( (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node) and (
proc.cmdline startswith "sh -c git" or proc.cmdline startswith "sh -c git" or
proc.cmdline startswith "sh -c date" or proc.cmdline startswith "sh -c date" or
proc.cmdline startswith "sh -c /usr/bin/g++" or proc.cmdline startswith "sh -c /usr/bin/g++" or