RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #412 from r0cketlad/main 

fpr: bwrap
This commit is contained in:
Thomas Strömberg 2024-10-29 10:36:42 -04:00 committed by GitHub
parent a695f5d2f5 f4559b3f97
commit 29c2844af0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/execution/unexpected-setuid-binaries.sql
View File

@ -294,7 +294,9 @@ FROM
'/usr/sbin/umount.nfs',
'/usr/sbin/umount.nfs4',
'/usr/sbin/unix_chkpwd',
'/usr/sbin/usernetctl'
'/usr/sbin/usernetctl',
'/usr/bin/bwrap',
'/bin/bwrap'
)
)
AND NOT (

3
detection/privesc/unexpected-setxid-process.sql
View File

@ -55,7 +55,8 @@ WHERE
'/usr/lib/slack/chrome-sandbox',
'/usr/lib/xf86-video-intel-backlight-helper',
'/usr/lib/Xorg.wrap',
'/usr/sbin/traceroute'
'/usr/sbin/traceroute',
'/usr/bin/bwrap'
)
AND f.path NOT LIKE '/Users/%/homebrew/Cellar/socket_vmnet/%/bin/socket_vmnet'
AND f.path NOT LIKE '/opt/homebrew/Cellar/dnsmasq/%/sbin/dnsmasq'