Find-and-replace does substitution in list names

[ross-bragg]

It looks like Falco will substitute in the contents of a list into the title of another list if one list contains the name of another.

I discovered this trying to augment the list of known shell spawn binaries. If the lists and rule below are run, less and chef-solo both trigger the "Run shell untrusted" rule. I ended up with some incorrect syntax trying to fix the problem and discovered the substitution in the error below. If the first list is renamed to ps_shell_spawn_binaries, the issue is resolved and the rule doesn't trigger on less or chef-solo.

- list: ps_known_shell_spawn_binaries
  items: [
    less, chef-solo
    ]

- list: known_shell_spawn_binaries
  items: [
    sshd, sudo, su, tmux, screen, emacs, systemd, login, flock, fbash,
    nginx, monit, supervisord, dragent, aws, initdb, docker-compose,
    make, configure, awk, falco, fail2ban-server, apt-get, apt,
    fleetctl, logrotate, ansible
    ]

- rule: Run shell untrusted
  desc: an attempt to spawn a shell by a non-shell program. Exceptions are made for trusted binaries.
  condition: >
    spawned_process
    and shell_procs
    and proc.pname exists
    and not proc.pname in (cron_binaries, shell_binaries, known_shell_spawn_binaries, docker_binaries, k8s_binaries)
    and not proc.pname in (ps_known_shell_spawn_binaries)
  output: "Shell spawned by untrusted binary (user=%user.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)"
  priority: WARNING

Wed Jan 25 14:48:25 2017: Falco initialized with configuration file /etc/falco.yaml
Wed Jan 25 14:48:25 2017: Runtime error: Error loading rules:/usr/share/falco/lua/compiler.lua:319: Compilation error when compiling "spawned_process and shell_procs and proc.pname exists and not proc.pname in (cron, crond, bash, csh, ksh, sh, tcsh, zsh, dash, sshd, sudo, su, tmux, screen, emacs, systemd, login, flock, fbash, nginx, monit, supervisord, dragent, aws, initdb, docker-compose, make, configure, awk, falco, fail2ban-server, apt-get, apt, fleetctl, logrotate, ansible, docker_binaries, k8s_binaries) and not proc.pname in ps_sshd, sudo, su, tmux, screen, emacs, systemd, login, flock, fbash, nginx, monit, supervisord, dragent, aws, initdb, docker-compose, make, configure, awk, falco, fail2ban-server, apt-get, apt, fleetctl, logrotate, ansible and not ps_restarting_tomcat and not user.name = vagrant": 403: syntax error, unexpected 'ps_sshd', expecting '('. Exiting.

[mstemm]

I see, you're right. The substitution I do for list names is pretty naive. I'll modify it to be list item/whitespace aware.