From f365056b890c405839e2002730ceec27760a1045 Mon Sep 17 00:00:00 2001 From: Mehran Kholdi Date: Sun, 12 May 2019 20:10:25 +0430 Subject: [PATCH] Add `ash` to the list of shell binaries It is specifically used a lot in alpine-based images. falco-CLA-1.0-signed-off-by: Mehran Kholdi --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index a12a01dd..f7544287 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -95,7 +95,7 @@ condition: ((fd.directory=/ or fd.name startswith /root) and fd.name contains "/") - list: shell_binaries - items: [bash, csh, ksh, sh, tcsh, zsh, dash] + items: [ash, bash, csh, ksh, sh, tcsh, zsh, dash] - list: ssh_binaries items: [