github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity

Add more jenkins spawners.

Browse Source 
Jenkins spawns shells via script.sh, so allow it.
This commit is contained in:
Mark Stemm 2017-09-29 15:11:20 -07:00
parent 4f5ab79c69
commit 9504d420f0
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/falco_rules.yaml
View File

@ -344,6 +344,9 @@
(proc.pname=java and proc.pcmdline contains jenkins.war (proc.pname=java and proc.pcmdline contains jenkins.war
or proc.pcmdline contains /tmp/slave.jar) or proc.pcmdline contains /tmp/slave.jar)
- macro: jenkins_script_sh
condition: (proc.pcmdline startswith "script.sh -xe /var/jenkins_home")
- macro: parent_java_running_echo - macro: parent_java_running_echo
condition: (proc.pname=java and proc.cmdline startswith "sh -c echo") condition: (proc.pname=java and proc.cmdline startswith "sh -c echo")
@ -643,6 +646,7 @@
and not parent_python_running_sdchecks and not parent_python_running_sdchecks
and not parent_linux_image_upgrade_script and not parent_linux_image_upgrade_script
and not parent_java_running_jenkins and not parent_java_running_jenkins
and not jenkins_script_sh
and not parent_java_running_echo and not parent_java_running_echo
and not parent_scripting_running_builds and not parent_scripting_running_builds
and not parent_Xvfb_running_xkbcomp and not parent_Xvfb_running_xkbcomp
@ -823,6 +827,8 @@
and not node_running_edi_dynamodb and not node_running_edi_dynamodb
and not run_by_h2o and not run_by_h2o
and not run_by_passenger_agent and not run_by_passenger_agent
and not parent_java_running_jenkins
and not jenkins_script_sh
output: > output: >
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3]) shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])