RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add exceptions for firefox and gjs-console

This commit is contained in:
Thomas Stromberg 2022-09-26 18:11:36 -04:00
parent 796c2af84c
commit 909f907096
Failed to extract signature
1 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
process/name_path_mismatch.sql
View File

@ -33,44 +33,46 @@ WHERE
AND NOT cmd LIKE "/nix/store/%/bin/bash%" -- Serial masqueraders AND NOT cmd LIKE "/nix/store/%/bin/bash%" -- Serial masqueraders
AND NOT short_filename IN ("bash", "ruby", "python", "python3") AND NOT short_filename IN ("bash", "ruby", "python", "python3")
AND exception_key NOT IN ( AND exception_key NOT IN (
"name=chrome-gnome-s,file=python3,500", "name=blueman-applet,file=python3,500",
"name=code-oss,file=electron,500",
"name=firefox-wrappe,file=firefox,500",
"name=blueman-tray,file=python3,500", "name=blueman-tray,file=python3,500",
"name=chrome-gnome-s,file=python3,500",
"name=Chroot,file=firefox,500",
"name=code-oss,file=electron,500",
"name=exe,file=rootlessport,500",
"name=file,file=firefox,500",
"name=firefox-wrappe,file=firefox,500",
"name=firewalld,file=python3,0", "name=firewalld,file=python3,0",
"name=gjs,file=gjs-console,500", "name=gjs,file=gjs-console,500",
"name=gnome-character,file=gjs-console,500",
"name=gnome-tweak-to,file=python3,500", "name=gnome-tweak-to,file=python3,500",
"name=gsettings-hel,file=gsettings-help,500", "name=gsettings-hel,file=gsettings-help,500",
"name=Isolated,file=firefox,500", "name=Isolated,file=firefox,500",
"name=sd_espeak-ng-m,file=sd_espeak-ng,500", "name=MainThread,file=plugin-contain,500",
"name=mysqld,file=mariadbd,500", "name=mysqld,file=mariadbd,500",
"name=networkd-dispa,file=python3,0", "name=networkd-dispa,file=python3,0",
"name=MainThread,file=plugin-contain,500",
"name=nix-daemon,file=nix,0", "name=nix-daemon,file=nix,0",
"name=npm,file=node,500", "name=npm,file=node,500",
"name=Chroot,file=firefox,500", "name=osqueryi,file=osqueryd,0",
"name=exe,file=rootlessport,500", "name=osqueryi,file=osqueryd,500",
"name=slic3r_main,file=prusa-slicer,500",
"name=osqueryi,file=osqueryd,500", "name=osqueryi,file=osqueryd,500",
"name=blueman-applet,file=python3,500",
"name=phpstorm,file=dash,500", "name=phpstorm,file=dash,500",
"name=Privileged,file=firefox,500", "name=Privileged,file=firefox,500",
"name=RDD,file=firefox,500", "name=RDD,file=firefox,500",
"name=sd_espeak-ng-m,file=sd_espeak-ng,500",
"name=sh,file=dash,0", "name=sh,file=dash,0",
"name=zoom,file=ZoomLauncher,500",
"name=sh,file=dash,500", "name=sh,file=dash,500",
"name=slic3r_main,file=prusa-slicer,500",
"name=Socket,file=firefox,500", "name=Socket,file=firefox,500",
"name=streamdeck,file=python3,500", "name=streamdeck,file=python3,500",
"name=systemd-udevd,file=udevadm,0", "name=systemd-udevd,file=udevadm,0",
"name=osqueryi,file=osqueryd,0",
"name=osqueryi,file=osqueryd,500",
"name=terminator,file=python3,500", "name=terminator,file=python3,500",
"name=unattended-upg,file=python3,0", "name=unattended-upg,file=python3,0",
"name=Utility,file=firefox,500", "name=Utility,file=firefox,500",
"name=zfs-auto-snaps,file=ruby,0",
"name=Web,file=firefox,500", "name=Web,file=firefox,500",
"name=WebExtensions,file=firefox,500", "name=WebExtensions,file=firefox,500",
"name=X,file=Xorg,0" "name=X,file=Xorg,0",
"name=zfs-auto-snaps,file=ruby,0",
"name=zoom,file=ZoomLauncher,500"
) )
AND NOT ( AND NOT (
short_filename = "systemd" short_filename = "systemd"