search

SUSE / linux-security-sensor

Linux security sensor
Other
18 stars 9 forks source link

cronsnoop uses log.Fatal #47

Closed jeffmahoney closed 10 months ago

jeffmahoney commented 2 years ago

If any of the cron files that cronsnoop is expected to monitor is missing, it calls log.Fatal which causes the client to exit. We should log an error and continue.

mmaslano commented 10 months ago

I verified that this is fixed in velociraptor-client-0.7.0~git78.602f673-30.2.x86_64.rpm. Tested on removal of /etc/crontab and personal crontab (crontab -e). journactl notices disappearance of files but just log instead of exit.

djoreilly commented 10 months ago

Yes, the changes from https://github.com/SUSE/linux-security-sensor/commit/96e74f85bd189d1df42e0c46912014a81d00a960 were included in sensor-base-0.7.0. Closing.