New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add user_known_change_thread_namespace_binaries #324

merged 1 commit into from Feb 20, 2018


None yet
2 participants

JPLachance commented Feb 20, 2018

Add the user_known_change_thread_namespace_binaries list to simplify the "Change thread namespace" rule tweaks.

This can be very useful to modify the "Change thread namespace" from the falco_rules.local.yaml file without copying the entire rule. I will use this new array to whitelist calico, our overlay network in our Kubernetes cluster, which was raising:

    "output": "15:18:23.416545428: Notice Namespace change (setns) by unexpected program (user=root command=calico  parent=calico k8s.pod=<NA> container=host)",
    "priority": "Notice",
    "rule": "Change thread namespace",
    "time": "2018-02-19T15:18:23.416545428Z",
    "output_fields": {
        "": "host",
        "evt.time": 1519053503416545428,
        "": null,
        "proc.cmdline": "calico ",
        "proc.pname": "calico",
        "": "root"
+ Add the user_known_change_thread_namespace_binaries list to simplif…
…y "Change thread namespace" rule tweaks

sysdig-CLA-1.0-signed-off-by: Jean-Philippe Lachance <>

This comment has been minimized.


mstemm commented Feb 20, 2018

Thanks! I'll merge it.

@mstemm mstemm merged commit 52e8c16 into falcosecurity:dev Feb 20, 2018

2 checks passed

continuous-integration/travis-ci/pr The Travis CI build passed
sign-off-checker Sysdig sign-off CLA has been successfully verified for this commit

@JPLachance JPLachance deleted the JPLachance:feature-user-known-change-thread-ns branch Feb 21, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment