Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rule updates 2019 05.v1 #590

Merged
merged 3 commits into from
May 1, 2019
Merged

Rule updates 2019 05.v1 #590

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
761db7f
Fix parentheses for rpm_procs macro
mstemm May 1, 2019
19dbe6b
Let anything write to /etc/fluent/configs.d
mstemm May 1, 2019
d8bb0e7
Let java setup write to /etc/passwd in containers
mstemm May 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions rules/falco_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@
items: [probe_rpminfo, probe_rpmverify, probe_rpmverifyfile, probe_rpmverifypackage]

- macro: rpm_procs
condition: proc.name in (rpm_binaries, openscap_rpm_binaries) or proc.name in (salt-minion)
condition: (proc.name in (rpm_binaries, openscap_rpm_binaries) or proc.name in (salt-minion))

- list: deb_binaries
items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,
Expand Down Expand Up @@ -983,7 +983,7 @@
tags: [filesystem, mitre_discovery]

- list: safe_etc_dirs
items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig]
items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig, /etc/fluent/configs.d]

- macro: fluentd_writing_conf_files
condition: (proc.name=start-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf))
Expand Down Expand Up @@ -1029,6 +1029,13 @@
fd.name startswith "/etc/rancher-dns")
)

- macro: jboss_in_container_writing_passwd
condition: >
((proc.cmdline="run-java.sh /opt/jboss/container/java/run/run-java.sh"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the proc.cmdline looks strange, the args[1] is the abs path of the exe?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does look strange, but the policy event did have that as the full cmdline. Here's an example:

File below /etc opened for writing (user=<NA> command=run-java.sh /opt/jboss/container/java/run/run-java.sh parent=java pcmdline=java -javaagent:/opt/jboss/container/jolokia/jolokia.jar=config=/opt/jboss/container/jolokia/etc/jolokia.properties....

And for reference, the output field of that rule is:

output: "File below /etc opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name program=%proc.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])"

or proc.cmdline="run-java.sh /opt/run-java/run-java.sh")
and container
and fd.name=/etc/passwd)

- macro: curl_writing_pki_db
condition: (proc.name=curl and fd.directory=/etc/pki/nssdb)

Expand Down Expand Up @@ -1198,6 +1205,7 @@
and not prometheus_conf_writing_conf
and not openshift_writing_conf
and not rancher_writing_conf
and not jboss_in_container_writing_passwd

- rule: Write below etc
desc: an attempt to write to any file below /etc
Expand Down