github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity

Let perl Makefile.PL spawn shells

Browse Source
This commit is contained in:
Mark Stemm 2017-11-07 11:00:19 -08:00
parent fbb5451fd9
commit fdb2312bcf
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -440,6 +440,9 @@
proc.pcmdline startswith "node /root/.config/yarn" or proc.pcmdline startswith "node /root/.config/yarn" or
proc.pcmdline startswith "node /opt/yarn/bin/yarn.js")) proc.pcmdline startswith "node /opt/yarn/bin/yarn.js"))
- macro: makefile_perl
condition: (proc.pcmdline="perl Makefile.PL")
- macro: parent_node_running_npm - macro: parent_node_running_npm
condition: proc.pcmdline startswith "node /usr/local/bin/npm" condition: proc.pcmdline startswith "node /usr/local/bin/npm"
@ -862,6 +865,7 @@
and not jenkins_scripts and not jenkins_scripts
and not parent_java_running_echo and not parent_java_running_echo
and not parent_scripting_running_builds and not parent_scripting_running_builds
and not makefile_perl
and not parent_Xvfb_running_xkbcomp and not parent_Xvfb_running_xkbcomp
and not parent_nginx_running_serf and not parent_nginx_running_serf
and not parent_node_running_npm and not parent_node_running_npm
@ -1105,6 +1109,7 @@
and not shell_spawning_containers and not shell_spawning_containers
and not parent_java_running_echo and not parent_java_running_echo
and not parent_scripting_running_builds and not parent_scripting_running_builds
and not makefile_perl
and not parent_Xvfb_running_xkbcomp and not parent_Xvfb_running_xkbcomp
and not mysql_image_running_healthcheck and not mysql_image_running_healthcheck
and not parent_nginx_running_serf and not parent_nginx_running_serf