From 2bad529d3334fc0e11d69bfd9750a8ff28e9353b Mon Sep 17 00:00:00 2001 From: Jonathan Coetzee Date: Fri, 16 Dec 2016 11:09:45 +0200 Subject: [PATCH] Add fail2ban-server as trusted binary fail2ban spawns shells to modify iptables falco-CLA-1.0-signed-off-by: Jonathan Coetzee --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 2ae9b8b90fa..5a05002477c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -282,7 +282,7 @@ - rule: Run shell untrusted desc: an attempt to spawn a shell by a non-shell program. Exceptions are made for trusted binaries. - condition: spawned_process and not container and shell_procs and proc.pname exists and not proc.pname in (cron_binaries, shell_binaries, sshd, sudo, docker_binaries, k8s_binaries, su, tmux, screen, emacs, systemd, login, flock, fbash, nginx, monit, supervisord, dragent, aws, initdb, docker-compose, make, configure, awk, falco) + condition: spawned_process and not container and shell_procs and proc.pname exists and not proc.pname in (cron_binaries, shell_binaries, sshd, sudo, docker_binaries, k8s_binaries, su, tmux, screen, emacs, systemd, login, flock, fbash, nginx, monit, supervisord, dragent, aws, initdb, docker-compose, make, configure, awk, falco, fail2ban-server) output: "Shell spawned by untrusted binary (user=%user.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)" priority: WARNING