github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-17 23:37:51 +00:00
Code Issues Projects Releases Wiki Activity

Add another way to run npm

Browse Source 
This one seen on redhat installs
This commit is contained in:
Mark Stemm
2017-11-07 11:00:43 -08:00
parent fdb2312bcf
commit 82377348ce
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
rules/falco_rules.yaml
View File

@@ -444,7 +444,8 @@
condition: (proc.pcmdline="perl Makefile.PL")
- macro: parent_node_running_npm
condition: proc.pcmdline startswith "node /usr/local/bin/npm"
condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or
proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm")
- macro: parent_nginx_running_serf
condition: (proc.pname=nginx and proc.cmdline startswith "sh -c serf")