From fc4355dd15b7c674cb8d65cafbc412fcf17316f2 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Wed, 30 Sep 2020 12:54:18 -0700 Subject: [PATCH] rule(Delete....shell history): Skip docker progs Also ignore docker programs which would prevent cases where the path is expressed within the container filesystem (/.bash_history) vs host filesystem (/var/lib/docker/overlay/.../.bash_history). Signed-off-by: Mark Stemm --- rules/falco_rules.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index ac173f62..a4b997a2 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2645,7 +2645,9 @@ - rule: Delete or rename shell history desc: Detect shell history deletion condition: > - (modify_shell_history or truncate_shell_history) and not var_lib_docker_filepath + (modify_shell_history or truncate_shell_history) and + not var_lib_docker_filepath and + not proc.name in (docker_binaries) output: > Shell history had been deleted or renamed (user=%user.name user_loginuid=%user.loginuid type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath %container.info) priority: