RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fpr: bwrap

This commit is contained in:
Dave Smith 2024-10-29 09:34:42 -04:00
parent a695f5d2f5
commit f4559b3f97
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/execution/unexpected-setuid-binaries.sql
View File

@ -294,7 +294,9 @@ FROM
'/usr/sbin/umount.nfs', '/usr/sbin/umount.nfs',
'/usr/sbin/umount.nfs4', '/usr/sbin/umount.nfs4',
'/usr/sbin/unix_chkpwd', '/usr/sbin/unix_chkpwd',
'/usr/sbin/usernetctl' '/usr/sbin/usernetctl',
'/usr/bin/bwrap',
'/bin/bwrap'
) )
) )
AND NOT ( AND NOT (

3
detection/privesc/unexpected-setxid-process.sql
View File

@ -55,7 +55,8 @@ WHERE
'/usr/lib/slack/chrome-sandbox', '/usr/lib/slack/chrome-sandbox',
'/usr/lib/xf86-video-intel-backlight-helper', '/usr/lib/xf86-video-intel-backlight-helper',
'/usr/lib/Xorg.wrap', '/usr/lib/Xorg.wrap',
'/usr/sbin/traceroute' '/usr/sbin/traceroute',
'/usr/bin/bwrap'
) )
AND f.path NOT LIKE '/Users/%/homebrew/Cellar/socket_vmnet/%/bin/socket_vmnet' AND f.path NOT LIKE '/Users/%/homebrew/Cellar/socket_vmnet/%/bin/socket_vmnet'
AND f.path NOT LIKE '/opt/homebrew/Cellar/dnsmasq/%/sbin/dnsmasq' AND f.path NOT LIKE '/opt/homebrew/Cellar/dnsmasq/%/sbin/dnsmasq'