github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-09 01:58:13 +00:00
Code Issues Projects Releases Wiki Activity

Let java running maven spawn shells

Browse Source
This commit is contained in:
Mark Stemm 2017-10-26 09:35:52 -07:00
parent b8027b5e54
commit b993683b96
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -386,6 +386,10 @@
(proc.pname=java and proc.pcmdline contains jenkins.war (proc.pname=java and proc.pcmdline contains jenkins.war
or proc.pcmdline contains /tmp/slave.jar) or proc.pcmdline contains /tmp/slave.jar)
- macro: parent_java_running_maven
condition: >
(proc.pname=java and proc.pcmdline contains "-classpath /usr/share/maven/")
- macro: parent_cpanm_running_perl - macro: parent_cpanm_running_perl
condition: (proc.pname=perl and proc.aname[2]=cpanm) condition: (proc.pname=perl and proc.aname[2]=cpanm)
@ -1065,6 +1069,7 @@
and not run_by_h2o and not run_by_h2o
and not run_by_passenger_agent and not run_by_passenger_agent
and not parent_java_running_jenkins and not parent_java_running_jenkins
and not parent_java_running_maven
and not parent_beam_running_python and not parent_beam_running_python
and not jenkins_scripts and not jenkins_scripts
and not bundle_running_ruby and not bundle_running_ruby