github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-13 21:41:23 +00:00
Code Issues Projects Releases Wiki Activity

update(rules): stricter detection of man-db postinst exception

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso
2021-04-15 14:52:39 +02:00
committed by poiana
parent 23a611b343
commit e95ab26f33
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
rules/falco_rules.yaml
View File

@@ -1392,6 +1392,15 @@
- macro: user_read_sensitive_file_containers - macro: user_read_sensitive_file_containers
condition: (container and container.image.repository in (read_sensitive_file_images)) condition: (container and container.image.repository in (read_sensitive_file_images))
# This macro detects man-db postinst, see https://salsa.debian.org/debian/man-db/-/blob/master/debian/postinst
# The rule "Read sensitive file untrusted" use this macro to avoid FPs.
- macro: mandb_postinst
condition: >
(proc.name=perl and proc.args startswith "-e" and
proc.args contains "@pwd = getpwnam(" and
proc.args contains "exec " and
proc.args contains "/usr/bin/mandb")
- rule: Read sensitive file untrusted - rule: Read sensitive file untrusted
desc: > desc: >
an attempt to read any sensitive file (e.g. files containing user/password/authentication an attempt to read any sensitive file (e.g. files containing user/password/authentication
@@ -1407,11 +1416,11 @@
) )
and not cmp_cp_by_passwd and not cmp_cp_by_passwd
and not ansible_running_python and not ansible_running_python
and not proc.cmdline contains /usr/bin/mandb
and not run_by_qualys and not run_by_qualys
and not run_by_chef and not run_by_chef
and not run_by_google_accounts_daemon and not run_by_google_accounts_daemon
and not user_read_sensitive_file_conditions and not user_read_sensitive_file_conditions
and not mandb_postinst
and not perl_running_plesk and not perl_running_plesk
and not perl_running_updmap and not perl_running_updmap
and not veritas_driver_script and not veritas_driver_script