github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity

Allow update-ca-certi(ficates) to write below /etc

Browse Source 
Truncation intentonal.
This commit is contained in:
Mark Stemm 2017-07-05 14:11:11 -07:00
parent ee2c668746
commit e2be47e3c2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -338,8 +338,8 @@
dev_creation_binaries, shell_mgmt_binaries,
ldconfig.real, ldconfig, confd, gpg, insserv,
apparmor_parser, update-mime, tzdata.config, tzdata.postinst,
gen_resolvconf.)
systemd, systemd-machine, debconf-show, rollerd, bind9.postinst, sv,
gen_resolvconf., update-ca-certi)
and not proc.pname in (sysdigcloud_binaries)
and not fd.directory in (/etc/cassandra, /etc/ssl/certs/java)
and not ansible_running_python