github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-16 14:58:31 +00:00
Code Issues Projects Releases Wiki Activity

Add x2go programs

Browse Source 
They can spawn shells in and out of containers.
This commit is contained in:
Mark Stemm
2017-08-24 08:57:26 -07:00
parent 6be38a3237
commit ca9e1ebfef
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@@ -546,7 +546,8 @@
init, pluto, mkinitramfs, unattended-upgr, watch, sysdig, init, pluto, mkinitramfs, unattended-upgr, watch, sysdig,
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup, landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d, npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
x2goagent
] ]
- rule: Run shell untrusted - rule: Run shell untrusted
@@ -701,7 +702,7 @@
nomachine_binaries, nomachine_binaries,
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf, erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
runsv, supervisord, varnishd, crond, logrotate) runsv, supervisord, varnishd, crond, logrotate, x2goagent)
and not trusted_containers and not trusted_containers
and not shell_spawning_containers and not shell_spawning_containers
and not parent_java_running_echo and not parent_java_running_echo