search

falcosecurity / rules

Falco rule repository
https://falcosecurity.github.io/rules/
Apache License 2.0
93 stars 68 forks source link

Wrong usage of `evt.arg.*` / `evt.rawarg.*` when more than one event is involved #214

Open Andreagit97 opened 8 months ago

Andreagit97 commented 8 months ago

In some rules like Set Setuid or Setgid bit we use some filter checks like fd=%evt.arg.fd. These filter checks are event-specific so using them with a condition like evt.type in (chmod, fchmod, fchmodat) means that chmod and fchmodat don't have it and will always return an <NA> while fchmod has it.

I'm not sure this is what we want, returning <NA> by default doesn't seem the right choice. IMO we should limit the usage of evt.arg.* / evt.rawarg.* when only one event is involved in the condition and a precise direction is set (e.g. evt.type=open and evt.dir=<). The direction is necessary because enter and exit events have different parameters!

incertum commented 8 months ago

Cross-linked the issue to the feedback tracking https://github.com/falcosecurity/rules/issues/176

poiana commented 5 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 5 months ago

/remove-lifecycle stale

poiana commented 2 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 2 months ago

/remove-lifecycle stale