github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-10 21:23:41 +00:00
Code Issues Projects Releases Wiki Activity

Add x2go binaries as a list

Browse Source 
Moving the first program x2goagent into the list.
This commit is contained in:
Mark Stemm 2017-08-25 07:47:53 -07:00
parent 6aa2373acd
commit ee02571889
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
rules/falco_rules.yaml
View File

@ -208,6 +208,9 @@
- list: nomachine_binaries - list: nomachine_binaries
items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin] items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]
- list: x2go_binaries
items: [x2gosuspend-age, x2goagent]
- list: nids_binaries - list: nids_binaries
items: [bro, broctl] items: [bro, broctl]
@ -570,7 +573,7 @@
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup, landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d, npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini, serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
x2goagent, timeout timeout
] ]
- rule: Run shell untrusted - rule: Run shell untrusted
@ -583,7 +586,8 @@
k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries, k8s_binaries, package_mgmt_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, mesos_slave_binaries, monitoring_binaries, gitlab_binaries, mesos_slave_binaries,
keepalived_binaries, keepalived_binaries,
needrestart_binaries, phusion_passenger_binaries, chef_binaries, nomachine_binaries) needrestart_binaries, phusion_passenger_binaries, chef_binaries, nomachine_binaries,
x2go_binaries)
and not parent_ansible_running_python and not parent_ansible_running_python
and not parent_bro_running_python and not parent_bro_running_python
and not parent_python_running_denyhosts and not parent_python_running_denyhosts
@ -736,9 +740,10 @@
phusion_passenger_binaries, phusion_passenger_binaries,
chef_binaries, chef_binaries,
nomachine_binaries, nomachine_binaries,
x2go_binaries,
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf, erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
runsv, supervisord, varnishd, crond, logrotate, x2goagent, timeout, tini, runsv, supervisord, varnishd, crond, logrotate, timeout, tini,
xrdb, xfce4-session) xrdb, xfce4-session)
and not trusted_containers and not trusted_containers
and not shell_spawning_containers and not shell_spawning_containers