Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: make sure that when deleting shell history the system call is taken into account #762

Merged
merged 1 commit into from
Aug 7, 2019

Conversation

fntlnz
Copy link
Contributor

@fntlnz fntlnz commented Aug 5, 2019

Signed-off-by: Lorenzo Fontana lo@linux.com

What type of PR is this?

/kind bug
/kind rule-update

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

When deleting a shell history file we can't rely on the name of the command deleting it.
This PR uses the rmdir, unlink and unlinkat syscalls instead to reliably detect if an history file had been deleted.

Which issue(s) this PR fixes:
NONE

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rules: Delete Bash History is renamed to Delete or rename shell history
rules: Delete or rename shell history: When deleting a shell history file now the syscalls are taken into account rather than just the commands deleting the files
rules: Delete or rename shell history: history deletion now supports fish and zsh in addition to bash

rules/falco_rules.yaml Outdated Show resolved Hide resolved
@fntlnz fntlnz changed the title fix: make sure that when deleting shell history the system call is taken into account wip: fix: make sure that when deleting shell history the system call is taken into account Aug 6, 2019
…ken into account

Signed-off-by: Lorenzo Fontana <lo@linux.com>
@fntlnz fntlnz changed the title wip: fix: make sure that when deleting shell history the system call is taken into account fix: make sure that when deleting shell history the system call is taken into account Aug 6, 2019
@fntlnz fntlnz requested a review from Kaizhe August 6, 2019 16:35
@Kaizhe
Copy link
Contributor

Kaizhe commented Aug 6, 2019

/lgtm

@poiana
Copy link

poiana commented Aug 6, 2019

LGTM label has been added.

Git tree hash: 37a61f40f869e3cd8c95dbe236e4677c9bda1083

@poiana poiana added the approved label Aug 6, 2019
@leodido leodido self-requested a review August 7, 2019 12:18
@poiana
Copy link

poiana commented Aug 7, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kaizhe, leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@fntlnz fntlnz merged commit 03fbf43 into dev Aug 7, 2019
@poiana poiana deleted the fix/shell-history-syscall branch August 7, 2019 13:38
@leodido leodido added this to the 0.18.0 milestone Aug 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants