github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 07:07:23 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #269 from dkerwin/add_keepalived_to_run_shell_cmd

Browse Source 
Add keepalived to list of shell spawning binaries
This commit is contained in:
Mark Stemm 2017-09-22 17:19:54 -07:00 committed by GitHub
commit 95bb96e6ec
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -205,6 +205,9 @@
- list: make_binaries
items: [make, gmake, cmake]
- list: keepalived_binaries
items: [keepalived]
- macro: sensitive_files
condition: >
fd.name startswith /etc and
@ -484,7 +487,7 @@
and proc.pname exists
and not proc.pname in (cron_binaries, shell_binaries, make_binaries, known_shell_spawn_binaries, docker_binaries,
k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, mesos_slave_binaries)
monitoring_binaries, gitlab_binaries, mesos_slave_binaries, keepalived_binaries)
and not parent_ansible_running_python
and not parent_bro_running_python
and not parent_python_running_denyhosts