RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-17 09:57:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add /usr/local/lib/libmimalloc.so to allowed list of LD_PRELOAD

Browse Source
This commit is contained in:
Thomas Stromberg 2022-11-10 11:20:58 -05:00
parent aa1717fcf4
commit 47bb017183
Failed to extract signature
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/execution/unexpected-env-values-linux.sql
View File

@ -34,7 +34,7 @@ WHERE -- This time should match the interval
OR (
key = 'LD_PRELOAD'
AND NOT p.path LIKE '%/firefox'
AND NOT pe.value = 'libfakeroot.so'
AND NOT pe.value IN ('libfakeroot.so', '/usr/local/lib/libmimalloc.so')
AND NOT pe.value LIKE ':/home/%/.local/share/Steam'
AND NOT pe.value LIKE ':/home/%/.var/app/com.valvesoftware.Steam/%'
AND NOT pe.value LIKE ':/snap/%'