From d0650688d513877e874a33d9921c108a0d95b466 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Wed, 6 Sep 2017 15:42:21 -0700 Subject: [PATCH] Let mysql_ssl_rsa_s spawn shells Part of mysql ssl key generation. --- rules/falco_rules.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 93cc52ac..44f7e7d3 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -573,7 +573,7 @@ landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup, npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d, serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini, - timeout, updatedb.findut + timeout, updatedb.findut, mysql_ssl_rsa_s ] - rule: Run shell untrusted @@ -749,7 +749,7 @@ monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf, runsv, supervisord, varnishd, crond, logrotate, timeout, tini, - xrdb, xfce4-session, weave) + xrdb, xfce4-session, weave, mysql_ssl_rsa_s) and not trusted_containers and not shell_spawning_containers and not parent_java_running_echo