github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-04 18:36:48 +00:00
Code Issues Projects Releases Wiki Activity

Let chef binaries run shells.

Browse Source
This commit is contained in:
Mark Stemm 2017-08-21 17:18:55 -07:00
parent 9791881444
commit cb7dab61e8
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/falco_rules.yaml
View File

@ -139,6 +139,9 @@
- list: phusion_passenger_binaries - list: phusion_passenger_binaries
items: [PassengerAgent] items: [PassengerAgent]
- list: chef_binaries
items: [chef-client]
- list: http_server_binaries - list: http_server_binaries
items: [nginx, httpd, httpd-foregroun, lighttpd] items: [nginx, httpd, httpd-foregroun, lighttpd]
@ -546,7 +549,7 @@
k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries, k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, mesos_slave_binaries, monitoring_binaries, gitlab_binaries, mesos_slave_binaries,
keepalived_binaries, keepalived_binaries,
needrestart_binaries, phusion_passenger_binaries) needrestart_binaries, phusion_passenger_binaries, chef_binaries)
and not parent_ansible_running_python and not parent_ansible_running_python
and not parent_bro_running_python and not parent_bro_running_python
and not parent_python_running_denyhosts and not parent_python_running_denyhosts
@ -684,6 +687,7 @@
user_known_container_shell_spawn_binaries, user_known_container_shell_spawn_binaries,
needrestart_binaries, needrestart_binaries,
phusion_passenger_binaries, phusion_passenger_binaries,
chef_binaries,
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf, erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
runsv, supervisord, varnishd, crond, logrotate) runsv, supervisord, varnishd, crond, logrotate)