From 76892826215a750f7d38c90c667f6368df2c6bac Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lachance Date: Thu, 14 Mar 2019 12:40:29 -0400 Subject: [PATCH] Allow exe running Docker save to write below rpm database (#552) falco-CLA-1.0-contributing-entity: Coveo Solutions Inc. falco-CLA-1.0-signed-off-by: Jean-Philippe Lachance --- rules/falco_rules.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index c98dc1a9..fa5ddcc6 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1126,7 +1126,12 @@ # Only let rpm-related programs write to the rpm database - rule: Write below rpm database desc: an attempt to write to the rpm database by any non-rpm related program - condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef + condition: > + fd.name startswith /var/lib/rpm and open_write + and not rpm_procs + and not ansible_running_python + and not python_running_chef + and not exe_running_docker_save output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)" priority: ERROR tags: [filesystem, software_mgmt]