mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-29 08:02:44 +00:00
Compare commits
11 Commits
0.6.0
...
agent/0.58
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
d42d0e2dd1 | ||
|
|
718113f7bd | ||
|
|
955e1d78b1 | ||
|
|
135b4d9975 | ||
|
|
a25166b7ac | ||
|
|
800a3f1ea1 | ||
|
|
31464de885 | ||
|
|
9b308d2793 | ||
|
|
a99f09da96 | ||
|
|
1e0ddba11a | ||
|
|
b6d1101cb6 |
@@ -433,7 +433,7 @@
|
||||
and shell_procs
|
||||
and proc.pname exists
|
||||
and not proc.pname in (shell_binaries, docker_binaries, k8s_binaries, lxd_binaries, aide_wrapper_binaries, nids_binaries,
|
||||
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, apache2, falco, cron, erl_child_setup)
|
||||
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, erl_child_setup)
|
||||
and not trusted_containers
|
||||
output: "Shell spawned in a container other than entrypoint (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)"
|
||||
priority: WARNING
|
||||
|
||||
Reference in New Issue
Block a user