github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-16 23:08:16 +00:00
Code Issues Projects Releases Wiki Activity

Let hhvm spawn shells.

Browse Source 
http://hhvm.com/, "open-source virtual machine designed for executing
programs written in Hack and PHP."
This commit is contained in:
Mark Stemm
2017-06-26 13:12:56 -07:00
parent 414a4aaba7
commit daedcf172f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
rules/falco_rules.yaml
View File

@@ -476,7 +476,7 @@
pyclean, py3clean, pip, pip2, ansible-playboo, man-db,
init, pluto, mkinitramfs, unattended-upgr, watch, sysdig,
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph
npm, cloud-init, toybox, ceph, hhvm
]
- rule: Run shell untrusted
@@ -591,7 +591,7 @@
and not proc.pname in (shell_binaries, make_binaries, docker_binaries, k8s_binaries, package_mgmt_binaries,
lxd_binaries, mesos_slave_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
erl_child_setup, ceph, PM2, pycompile, py3compile)
erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm)
and not trusted_containers
and not shell_spawning_containers
and not proc.cmdline in (known_container_shell_spawn_cmdlines)