github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-08 09:37:58 +00:00
Code Issues Projects Releases Wiki Activity

Another uid to same uid case.

Browse Source 
pki-acme.
This commit is contained in:
Mark Stemm 2017-08-24 14:13:37 -07:00
parent 548790c663
commit b0cf038e1d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/falco_rules.yaml
View File

@ -783,7 +783,8 @@
(user.name=www-data and evt.arg.uid=www-data) or (user.name=www-data and evt.arg.uid=www-data) or
(user.name=_apt and evt.arg.uid=_apt) or (user.name=_apt and evt.arg.uid=_apt) or
(user.name=postfix and evt.arg.uid=postfix) or (user.name=postfix and evt.arg.uid=postfix) or
(user.name=pki-agent and evt.arg.uid=pki-agent)) (user.name=pki-agent and evt.arg.uid=pki-agent) or
(user.name=pki-acme and evt.arg.uid=pki-acme))
# sshd, mail programs attempt to setuid to root even when running as non-root. Excluding here to avoid meaningless FPs # sshd, mail programs attempt to setuid to root even when running as non-root. Excluding here to avoid meaningless FPs
- rule: Non sudo setuid - rule: Non sudo setuid