github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 08:32:12 +00:00
Code Issues Projects Releases Wiki Activity

Let seed_es_acl spawn shells.

Browse Source
This commit is contained in:
Mark Stemm 2017-10-26 09:36:07 -07:00
parent b993683b96
commit d8fdaa0d88
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/falco_rules.yaml
View File

@ -497,6 +497,9 @@
(proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or (proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or
(proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby))) (proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby)))
- macro: run_by_openshift
condition: proc.aname[2]=es_seed_acl
# As a part of kernel upgrades, dpkg will spawn a perl script with the # As a part of kernel upgrades, dpkg will spawn a perl script with the
# name linux-image-N.N. This macro matches that. # name linux-image-N.N. This macro matches that.
- macro: parent_linux_image_upgrade_script - macro: parent_linux_image_upgrade_script
@ -834,6 +837,7 @@
and not run_by_centrify and not run_by_centrify
and not parent_dovecot_running_auth and not parent_dovecot_running_auth
and not run_by_foreman and not run_by_foreman
and not run_by_openshift
and not parent_java_running_tomcat and not parent_java_running_tomcat
and not parent_java_running_install4j and not parent_java_running_install4j
and not parent_cpanm_running_perl and not parent_cpanm_running_perl