mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 11:29:26 +00:00
d63542d8ff
* Add dpkg-divert as a debian package mgmt program. * Add pip3 as a package mgmt program. * Let ucpagent write config Since the name is fairly generic (apiserver), require that it runs in a container with image docker/ucp-agent. * Let iscsi admin programs write config * Add parent to some output strings Will aid in addressing false positives. * Let update-ca-trust write to pki files * Add additional root writing programs - zap: web application security tool - airflow: apache app for managing data pipelines - rpm can sometimes write below /root/.rpmdb - maven can write groovy files * Expand redis etc files Additional program redis-launcher.(sh) and path /etc/redis. * Add additional root directories /root/workspace could be used by jenkins, /root/oradiag_root could be used by Oracle 11 SQL*Net. * Add pam-config as an auth program * Add additional trusted containers openshift image inspector, alternate name for datadog agent, docker ucp agent, gliderlabs logspout. * Add microdnf as a rpm binary. https://github.com/rpm-software-management/microdnf * Let coreos update-ssh-keys write /home/core/.ssh * Allow additional writes below /etc/iscsi Allow any path starting with /etc/iscsi. * Add additional /root write paths Additional files, with /root/workspace changing from a directory to a path prefix. * Add additional openshift trusted container. * Also allow grandparents for ms_oms_writing_conf In some cases the program spawns intermediate shells, for example: 07:15:30.756713513: Error File below /etc opened for writing (user= command=StatusReport.sh /opt/microsoft/omsconfig/Scripts/StatusReport.sh D34448EA-363A-42C2-ACE0-ACD6C1514CF1 EndTime parent=sh pcmdline=sh -c /opt/microsoft/omsconfig/Scripts/StatusReport.sh D34448EA-363A-42C2-ACE0-ACD6C1514CF1 EndTime file=/etc/opt/omi/conf/omsconfig/last_statusreport program=StatusReport.sh gparent=omiagent ggparent=omiagent gggparent=omiagent) k8s.pod= container=host k8s.pod= container=host This should fix #387.