Skip to content

Commit

Permalink
Don't allow apache2 to spawn shells in containers
Browse files Browse the repository at this point in the history
This ensures that interpreted php,perl,etc code run by apache won't be
able to spawn shells, either.

This fixes #231.
  • Loading branch information
mstemm committed Apr 6, 2017
1 parent 0cabedd commit 955e1d7
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@
and shell_procs
and proc.pname exists
and not proc.pname in (shell_binaries, docker_binaries, k8s_binaries, lxd_binaries, aide_wrapper_binaries, nids_binaries,
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, apache2, falco, cron, erl_child_setup)
monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, erl_child_setup)
and not trusted_containers
output: "Shell spawned in a container other than entrypoint (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)"
priority: WARNING
Expand Down

0 comments on commit 955e1d7

Please sign in to comment.