Code

Rule updates vnov#300

Code

Merged

mstemm merged 58 commits intodevfalcosecurity/falco:devfrom rule-updates-vnovfalcosecurity/falco:rule-updates-vnovCopy head branch name to clipboardNov 16, 2017

+340-189

Commits

Commits on Nov 13, 2017

• Let supervisor write more generally below /etc

  mstemm

  committed
  c822b38

  Copy full SHA for c822b38

• Let perl+plesk scripts run shells/write below etc

  mstemm

  committed
  cbe03a4

  Copy full SHA for cbe03a4

• Allow spaces after some cmdlines

  mstemm

  committed
  34f0bdf

  Copy full SHA for 34f0bdf

• Add additional shell spawner.

  mstemm

  committed
  f71d4ff

  Copy full SHA for f71d4ff

• Add addl package mgmt binaries.

  mstemm

  committed
  336f6d7

  Copy full SHA for 336f6d7

Commits on Nov 14, 2017

• Add addl cases for java + jenkins

  Show description for ca0d59f
  mstemm

  committed
  ca0d59f

  Copy full SHA for ca0d59f

• Add addl jenkins-related cmdlines

  Show description for 125eabc
  mstemm

  committed
  125eabc

  Copy full SHA for 125eabc

• Let python running some mesos tasks spawn shells

  Show description for 475c566
  mstemm

  committed
  475c566

  Copy full SHA for 475c566

• Let ucf write below etc

  Show description for 03e4132
  mstemm

  committed
  03e4132

  Copy full SHA for 03e4132

• Let dpkg-reconfigur indirectly write below /etc

  Show description for ad852d1
  mstemm

  committed
  ad852d1

  Copy full SHA for ad852d1

• Add files/dirs/prefixes for writes below root

  Show description for 80bd5e6
  mstemm

  committed
  80bd5e6

  Copy full SHA for 80bd5e6

• Add addl shell spawn binaries.

  mstemm

  committed
  25d7381

  Copy full SHA for 25d7381

• Also let java + sbt spawn shells in containers

  Show description for 832e684
  mstemm

  committed
  832e684

  Copy full SHA for 832e684

• Make sure the file below etc is /etc/

  Show description for 355bf2b
  mstemm

  committed
  355bf2b

  Copy full SHA for 355bf2b

• Let rancher healthcheck spawn shells

  Show description for b83d22f
  mstemm

  committed
  b83d22f

  Copy full SHA for b83d22f

• Add addl shell container shell spawn binaries

  mstemm

  committed
  e2ac44f

  Copy full SHA for e2ac44f

• Add addl x2go binaries

  mstemm

  committed
  e6c418a

  Copy full SHA for e6c418a

• Let rabbitq write its config files

  mstemm

  committed
  8181403

  Copy full SHA for 8181403

• Let rook write below /etc

  Show description for e00a030
  mstemm

  committed
  e00a030

  Copy full SHA for e00a030

• Let consul-template spawn shells

  mstemm

  committed
  53ef31f

  Copy full SHA for 53ef31f

• Add rook/toolbox as a trusted container

  Show description for d405ede
  mstemm

  committed
  d405ede

  Copy full SHA for d405ede

• Add addl mail binary that can setuid

  mstemm

  committed
  b75f934

  Copy full SHA for b75f934

• Let plesk autoinstaller spawn shells

  Show description for ff7520c
  mstemm

  committed
  ff7520c

  Copy full SHA for ff7520c

• Let php handlers write its config

  mstemm

  committed
  5ecf033

  Copy full SHA for 5ecf033

• Let addl pkg-* binary write to /etc indirectly

  mstemm

  committed
  5a7b6ad

  Copy full SHA for 5a7b6ad

• Add additional shell spawning binaries.

  mstemm

  committed
  cbd1b0d

  Copy full SHA for cbd1b0d

• Add ability to specify user trusted containers

  Show description for c4e3346
  mstemm

  committed
  c4e3346

  Copy full SHA for c4e3346

• If npm runs node, let node spawn shells

  mstemm

  committed
  c9743dd

  Copy full SHA for c9743dd

• Let python run airflow via a shell.

  mstemm

  committed
  d72158f

  Copy full SHA for d72158f

• Add addl passenger commandlines (for shells)

  mstemm

  committed
  01db548

  Copy full SHA for 01db548

• Add addl ways datadog can be run

  mstemm

  committed
  e99e406

  Copy full SHA for e99e406

• Let find run shells in containers.

  mstemm

  committed
  0c8afb4

  Copy full SHA for 0c8afb4

• Add rpmq as a rpm binary

  mstemm

  committed
  bd83018

  Copy full SHA for bd83018

• Let httpd write below /etc/httpd/

  mstemm

  committed
  08559c3

  Copy full SHA for 08559c3

• Let awstats/sa-update spawn shells

  mstemm

  committed
  2c58996

  Copy full SHA for 2c58996

• Add container entrypoint as a shell

  Show description for 267200a
  mstemm

  committed
  267200a

  Copy full SHA for 267200a

• Add an additional jenkins commandline

  mstemm

  committed
  ad8fdb5

  Copy full SHA for ad8fdb5

• Let mysql write its config

  mstemm

  committed
  fe27557

  Copy full SHA for fe27557

• Let openvpn write its config

  mstemm

  committed
  1f3f14b

  Copy full SHA for 1f3f14b

• Add addl root dirs/files

  Show description for a0bf16e
  mstemm

  committed
  a0bf16e

  Copy full SHA for a0bf16e

• Let mysql_upgrade/opkg-cl spawn shells

  mstemm

  committed
  b653938

  Copy full SHA for b653938

• Allow login to perform dns lookups

  Show description for caafbda
  mstemm

  committed
  caafbda

  Copy full SHA for caafbda

• Let consul-template write haproxy config.

  mstemm

  committed
  7bfe8d4

  Copy full SHA for 7bfe8d4

• Also let mysql indirectly edit its config

  Show description for 1043585
  mstemm

  committed
  1043585

  Copy full SHA for 1043585

• Allow certain sed temp files below /etc/

  mstemm

  committed
  be4b9e5

  Copy full SHA for be4b9e5

• Allow debian binaries to indirectly write to /etc

  Show description for c0df676
  mstemm

  committed
  c0df676

  Copy full SHA for c0df676

• Add additional root file

  mstemm

  committed
  ede9b57

  Copy full SHA for ede9b57

• Let rancher healthcheck be run more indirectly

  Show description for 73f4ae2
  mstemm

  committed
  73f4ae2

  Copy full SHA for 73f4ae2

• Add more cases for haproxy writing config

  Show description for 72c8d0b
  mstemm

  committed
  72c8d0b

  Copy full SHA for 72c8d0b

• Let vmtoolsd spawn shells on the host

  mstemm

  committed
  7485c56

  Copy full SHA for 7485c56

• Add an additional innocuous entrypoint shell

  mstemm

  committed
  ddeb239

  Copy full SHA for ddeb239

• Let peer-finder (mongodb) spawn shells

  mstemm

  committed
  91b6f21

  Copy full SHA for 91b6f21

• Split application rules to separate file.

  Show description for 5410f7f
  mstemm

  committed
  5410f7f

  Copy full SHA for 5410f7f

Commits on Nov 15, 2017

• Add more build-related command lines

  mstemm

  committed
  2fb85a1

  Copy full SHA for 2fb85a1

• Let perl running openresty spawn shells

  mstemm

  committed
  5de0b65

  Copy full SHA for 5de0b65

• Let countly write nginx config

  mstemm

  committed
  bb8b640

  Copy full SHA for bb8b640

• Let confd spawn shells

  mstemm

  committed
  ee89824

  Copy full SHA for ee89824

• Also let aws spawn shells in containers.

  mstemm

  committed
  2e16445

  Copy full SHA for 2e16445