github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-30 21:25:06 +00:00
Code Issues Projects Releases Wiki Activity

Add more nomachine binaries.

Browse Source 
Also let nomachine binaries write below /etc.
This commit is contained in:
Mark Stemm 2017-08-24 08:57:00 -07:00
parent bf1f2cb2fd
commit 6be38a3237
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/falco_rules.yaml
View File

@ -206,7 +206,7 @@
items: [openvpn]
- list: nomachine_binaries
items: [nxexec, nxnode.bin]
items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]
- list: nids_binaries
items: [bro, broctl]
@ -399,7 +399,7 @@
systemd, systemd-machine, systemd-sysuser,
debconf-show, rollerd, bind9.postinst, sv,
gen_resolvconf., update-ca-certi, certbot, runsv,
qualys-cloud-ag, locales.postins)
qualys-cloud-ag, locales.postins, nomachine_binaries)
and not proc.pname in (sysdigcloud_binaries, sendmail_config_binaries)
and not fd.name pmatch (safe_etc_dirs)
and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json)