github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-12 19:36:42 +00:00
Code Issues Projects Releases Wiki Activity

Allow exe running Docker save to write below rpm database (#552)

Browse Source 
falco-CLA-1.0-contributing-entity: Coveo Solutions Inc.
falco-CLA-1.0-signed-off-by: Jean-Philippe Lachance <jplachance@coveo.com>
This commit is contained in:
Jean-Philippe Lachance 2019-03-14 12:40:29 -04:00 committed by Mark Stemm
parent 3d96ca5157
commit 7689282621
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/falco_rules.yaml
View File

@ -1126,7 +1126,12 @@
# Only let rpm-related programs write to the rpm database # Only let rpm-related programs write to the rpm database
- rule: Write below rpm database - rule: Write below rpm database
desc: an attempt to write to the rpm database by any non-rpm related program desc: an attempt to write to the rpm database by any non-rpm related program
condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef condition: >
fd.name startswith /var/lib/rpm and open_write
and not rpm_procs
and not ansible_running_python
and not python_running_chef
and not exe_running_docker_save
output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)" output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)"
priority: ERROR priority: ERROR
tags: [filesystem, software_mgmt] tags: [filesystem, software_mgmt]