Fix false-positive of sssd updating /etc/krb5.keytab

[mac-chaffee]

Signed-off-by: Mac Chaffee me@macchaffee.com

What type of PR is this?
/kind bug
/kind rule-update

Any specific area of the project related to this PR?
/area rules

What this PR does / why we need it:

SSSD is a popular tool for getting Linux machines to interoperate with ActiveDirectory. Part of that process involves invoking adcli to update /etc/krb5.keytab periodically: https://github.com/SSSD/sssd/blob/a664e9ce08ca6c0f9eb2e260b25463eea9c7829b/src/providers/ad/ad_machine_pw_renewal.c#L30

Looks like we already have exceptions for some tools that update this file (centrify_writing_krb), but that exception doesn't include adcli

Which issue(s) this PR fixes:
n/a

Special notes for your reviewer:

Here is an example false positive alert:

"16:34:45.928110723: Error File below /etc opened for writing (user=root user_loginuid=-1 command=adcli update --domain=ad.renci.org --host-fqdn=k8s-node08.k8s.renci.org --computer-password-lifetime=30 --domain-controller=dc1.ad.renci.org parent=sssd_be pcmdline=sssd_be --domain ad.renci.org --uid 0 --gid 0 --logger=files file=/etc/krb5.keytab program=adcli gparent=sssd ggparent=systemd gggparent=<NA> container_id=host image=<NA>) k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host"

Does this PR introduce a user-facing change?:
No.

rules(macro sssd_writing_krb): fixed a false-positive alert that was being generated when SSSD updates /etc/krb5.keytab
rules(macro write_etc_common): fixed a false-positive alert that was being generated when SSSD updates /etc/krb5.keytab

[poiana]

Welcome @mac-chaffee! It looks like this is your first PR to falcosecurity/falco 🎉

[leogr]

/milestone 0.31.0

[leogr]

LGTM.

@Kaizhe PTAL 🙏

[poiana]

LGTM label has been added.

Git tree hash: 52909705b1ce082e6bb0bbd512d171d5e89e896f

[leogr]

/milestone 0.32.0

[leogr]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, mac-chaffee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment