fpr: bwrap

2024-10-29 09:34:42 -04:00 · 2024-10-29 09:34:42 -04:00 · f4559b3f97
parent a695f5d2f5
commit f4559b3f97
2 changed files with 5 additions and 2 deletions
--- a/detection/execution/unexpected-setuid-binaries.sql
+++ b/detection/execution/unexpected-setuid-binaries.sql
@ -294,7 +294,9 @@ FROM
          '/usr/sbin/umount.nfs',
          '/usr/sbin/umount.nfs4',
          '/usr/sbin/unix_chkpwd',
-          '/usr/sbin/usernetctl'
+          '/usr/sbin/usernetctl',
+          '/usr/bin/bwrap',
+          '/bin/bwrap'
        )
      )
      AND NOT (
--- a/detection/privesc/unexpected-setxid-process.sql
+++ b/detection/privesc/unexpected-setxid-process.sql
@ -55,7 +55,8 @@ WHERE
    '/usr/lib/slack/chrome-sandbox',
    '/usr/lib/xf86-video-intel-backlight-helper',
    '/usr/lib/Xorg.wrap',
-    '/usr/sbin/traceroute'
+    '/usr/sbin/traceroute',
+    '/usr/bin/bwrap'
  )
  AND f.path NOT LIKE '/Users/%/homebrew/Cellar/socket_vmnet/%/bin/socket_vmnet'
  AND f.path NOT LIKE '/opt/homebrew/Cellar/dnsmasq/%/sbin/dnsmasq'