github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-17 15:28:18 +00:00
Code Issues Projects Releases Wiki Activity

* Rename the macro to user_known_package_manager_in_container

Browse Source 
+ Add a comment to explain how we should use this macro

Signed-off-by: Jean-Philippe Lachance <jplachance@coveo.com>
This commit is contained in:
Jean-Philippe Lachance
2019-12-02 16:10:11 -05:00
committed by Lorenzo Fontana
parent 3713f7a614
commit 80d69917ea
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
rules/falco_rules.yaml
View File

@@ -2255,7 +2255,13 @@
- macro: network_tool_procs - macro: network_tool_procs
condition: (proc.name in (network_tool_binaries)) condition: (proc.name in (network_tool_binaries))
- macro: user_known_package_manager_in_container_conditions # In a local/user rules file, create a condition that matches legitimate uses
# of a package management process inside a container.
#
# For example:
# - macro: user_known_package_manager_in_container
# condition: proc.cmdline="dpkg -l"
- macro: user_known_package_manager_in_container
condition: (never_true) condition: (never_true)
# Container is supposed to be immutable. Package management should be done in building the image. # Container is supposed to be immutable. Package management should be done in building the image.
@@ -2267,7 +2273,7 @@
and user.name != "_apt" and user.name != "_apt"
and package_mgmt_procs and package_mgmt_procs
and not package_mgmt_ancestor_procs and not package_mgmt_ancestor_procs
and not user_known_package_manager_in_container_conditions and not user_known_package_manager_in_container
output: > output: >
Package management process launched in container (user=%user.name Package management process launched in container (user=%user.name
command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag) command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)