github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 09:06:48 +00:00
Code Issues Projects Releases Wiki Activity

Let mysql_ssl_rsa_s spawn shells

Browse Source 
Part of mysql ssl key generation.
This commit is contained in:
Mark Stemm 2017-09-06 15:42:21 -07:00
parent 425196f974
commit d0650688d5
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/falco_rules.yaml
View File

@ -573,7 +573,7 @@
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
timeout, updatedb.findut
timeout, updatedb.findut, mysql_ssl_rsa_s
]
- rule: Run shell untrusted
@ -749,7 +749,7 @@
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
runsv, supervisord, varnishd, crond, logrotate, timeout, tini,
xrdb, xfce4-session, weave)
xrdb, xfce4-session, weave, mysql_ssl_rsa_s)
and not trusted_containers
and not shell_spawning_containers
and not parent_java_running_echo