Mark Stemm 010083538f Rule updates 2019 05.v1 (#590) ...

* Fix parentheses for rpm_procs macro

Ensures a preceding not will apply to the whole macro

* Let anything write to /etc/fluent/configs.d

It looks like a lot of scripted programs (shell scripts running cp, sed,
arbitrary ruby programs) are run by fluentd to set up config. They're
too generic to identify, so jut add /etc/fluent/configs.d to
safe_etc_dirs, sadly.

* Let java setup write to /etc/passwd in containers

/opt/jboss/container/java/run/run-java.sh and /opt/run-java/run-java.sh
write to /etc/passwd in a contaner, probably to add a user. Add an
exception for them.

2019-05-01 10:40:12 -07:00

..

application_rules.yaml

Rules versioning (#492)

2019-01-29 12:43:15 -08:00

CMakeLists.txt

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

falco_rules.local.yaml

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

falco_rules.yaml

Rule updates 2019 05.v1 (#590)

2019-05-01 10:40:12 -07:00

k8s_audit_rules.yaml

Rule updates 2019.02.v1 (#551)

2019-03-08 19:23:18 -08:00