Rule updates next #293
Merged
Rule updates next #293
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add support for db management programs that tend to spawn shells. Starting with two lists mysql_mgmt_binaries/postgres_mgmt_binaries which are combined into db_mgmt_binaries. db_mgmt_binaries is added to both shell spawning rules and the individual programs are removed.
The program is "python pipeline.py" but it appears to be related to https://github.com/apache/beam/blob/master/sdks/python/apache_beam/pipeline.py.
Allow dovecot to setuid by adding to mail_binaries. Allow the program auth, when run by dovecot, to spawn shells.
Create a list plesk_binaries and allow them to run shells. Also let them write to files below /etc/sw/keys.
Specifically the program starter. Using the full command line to be more specific.
The program is "my_init", which is fairly generic, so capture it by the full command line.
specifically nm-dispatcher
It might perform dns lookups as a part of resolving ip addresses.
truncated version of docker-runc-current.
New rule Launch Disallowed Container triggers when a container is started that does not match the macro allowed_containers. In the main falco rules file, this macro never matches, so it never triggers. However, in a second rules file the macro allowed_containers could be filled in with the specific images that match.
Used by Red Hat Sattelite.
Appears as java program, so look for the classpath.
In some cases, the container image might not be known/is NULL, so the comparison aganst "dummy-not-allowed-container-image" doesn't work. Replace this with proc.vpid=1, which is in the main rule Launch Disallowed Continer. Ensures it will only trigger when the allowed_containers macro is overridden.
It's java so you need to look at the classpath.
Should be testing proc.name, not proc.cmdline.
S99qualys-cloud is the init script, cfn-signal is cloudformation.
It can run scripts like sed to modify files before writing the final file.
Helps in diagnosis.
SpamAssassin updater.
A legitimate case is k8s mounting /etc/kubernetes/ssl, which was matching /etc*. The glob matcher we have isn't a full regex so you can't exclude strings, only characters.
Part of nginx
Generalize jenkins_script_sh to jenkins_scripts and add additional cases.
Better than globally letting php spawn shells.
rhsmcertd-worke(r), red hat subscription manager
device mapper event daemon.
New macro user_sensitive_mount_containers allows a second rules file to specify containers/images that can perform sensitive mounts.
It has -g/-u args to change gid/uid. Also move some other single setuid programs to the list known_setuid_binaries.
It only checks passwords.
Reorganize the unknown_user_in_container macro to get it working again in containers. Previously, it was being skipped entirely due to a problem with handling of unknown users, which get returned as NULL. The new macro is known_user_in_container, which tests the user.name against "N/A". It happens that if user.name is NULL, the comparison fails, so it has the same effect as if the string "N/A" were being returned. Any valid user name won't match the string "N/A", so known users will cause the macro to return true. The setuid rule needs an additional check for not container, so add that.
Add lists of files/directories that are acceptable to write.
mstemm
force-pushed
the
rule-updates-next
branch
from
b449244
to
71a386f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Syncing the next batch of rule updates to dev.