From ca9e1ebfefc1278392649f1b499b39b8b96a67f0 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Thu, 24 Aug 2017 08:57:26 -0700 Subject: [PATCH] Add x2go programs They can spawn shells in and out of containers. --- rules/falco_rules.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 80fd7c42..17876ee6 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -546,7 +546,8 @@ init, pluto, mkinitramfs, unattended-upgr, watch, sysdig, landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup, npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d, - serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini + serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini, + x2goagent ] - rule: Run shell untrusted @@ -701,7 +702,7 @@ nomachine_binaries, monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf, - runsv, supervisord, varnishd, crond, logrotate) + runsv, supervisord, varnishd, crond, logrotate, x2goagent) and not trusted_containers and not shell_spawning_containers and not parent_java_running_echo