From 955e1d78b18384e82e14f2f90b33753f56a64a5d Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Thu, 6 Apr 2017 15:24:21 -0700 Subject: [PATCH] Don't allow apache2 to spawn shells in containers This ensures that interpreted php,perl,etc code run by apache won't be able to spawn shells, either. This fixes https://github.com/draios/falco/issues/231. --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 6a453d5ecd8..4301eb5a313 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -433,7 +433,7 @@ and shell_procs and proc.pname exists and not proc.pname in (shell_binaries, docker_binaries, k8s_binaries, lxd_binaries, aide_wrapper_binaries, nids_binaries, - monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, apache2, falco, cron, erl_child_setup) + monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron, erl_child_setup) and not trusted_containers output: "Shell spawned in a container other than entrypoint (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)" priority: WARNING