mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-31 06:10:45 +00:00
Also allow sysdig agent to setuid.
It was already allowed to change namespaces.
This commit is contained in:
@@ -636,6 +636,7 @@
|
||||
not user.name=root and not somebody_becoming_themself
|
||||
and not proc.name in (userexec_binaries, mail_binaries, docker_binaries,
|
||||
sshd, dbus-daemon-lau, ping, ping6, critical-stack-)
|
||||
and not java_running_sdjagent
|
||||
output: >
|
||||
Unexpected setuid call by non-sudo, non-root program (user=%user.name parent=%proc.pname
|
||||
command=%proc.cmdline uid=%evt.arg.uid)
|
||||
|
Reference in New Issue
Block a user