github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-25 12:19:56 +00:00
Code Issues Projects Releases Wiki Activity

revert to container

Browse Source 
Signed-off-by: Hi120ki <12624257+hi120ki@users.noreply.github.com>
This commit is contained in:
Hi120ki
2022-09-08 15:35:27 +09:00
committed by poiana
parent 8473706526
commit 86c3a9cd69
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
rules/falco_rules.yaml
View File

@@ -3222,8 +3222,7 @@
- rule: Read environment variable from /proc files
desc: An attempt to read process environment variables from /proc files
condition: >
open_read and (fd.name glob /proc/*/environ)
and not proc.name in (systemctl, systemd-detect-, cloud-id, systemd-sysctl)
container and open_read and (fd.name glob /proc/*/environ)
enabled: true
output: >
Environment variables were retrieved from /proc files (user=%user.name user_loginuid=%user.loginuid program=%proc.name