search

falcosecurity / testing

All-purpose test suite for Falco and its ecosystem
Apache License 2.0
12 stars 11 forks source link

fix: update test with latest libs fix #60

Closed Andreagit97 closed 2 months ago

Andreagit97 commented 2 months ago

Test TestFalco_Legacy_NonSudoSetuid was affected by the bug reported here https://github.com/falcosecurity/libs/pull/1923. A thread with vtid=-1 was considered as a container thread and for this reason, we didn't match the rule because of this condition container and not user.name in ("<NA>","N/A",""). The user is NA and before the fix, we were considered in a container.

Now with the fix, we are no longer in a container so the rule correctly triggers. Full rule output with addition of thread.vtid and thread.tid

22:23:30.177328055: Notice Unexpected setuid call by non-sudo, non-root program (user=<NA> tid=10397, vtid=<NA> user_loginuid=-1 cur_uid=4294967295 parent=<NA> command=<NA> pid=-1 uid=root container_id= image=<NA>)
poiana commented 2 months ago

LGTM label has been added.

Git tree hash: c567ea581a061e5a3cbbe1bd15be3b5a88b5e209

poiana commented 2 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/testing/blob/main/OWNERS)~~ [Andreagit97,LucaGuerra] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment