Mark Stemm e49c3e68e7 Improve ruleset based on falco event-generator. ...

Improve ruleset after using with falco event_generator:

 - Instead of assuming all shells are bash, add a list shell_binaries
   and macro shell_procs, and replace references to bash with
   shell_procs. This revealed some other programs that can spawn shells.

 - Add "login" as an interactive command. systemd-login isn't in alpine
   linux, which is the linux distro used for the container.

 - Move read_sensitive_file_untrusted before
   read_sensitive_file_trusted_after_startup, so it can hit first.

2016-10-24 15:56:45 -07:00

..

CMakeLists.txt

Move falco engine to its own library.

2016-10-24 15:56:45 -07:00

falco_rules.yaml

Improve ruleset based on falco event-generator.

2016-10-24 15:56:45 -07:00