Delete or rename shell history: .ash_history #1956
Conversation
Signed-off-by: Brad Clark <bdashrad@gmail.com>
Signed-off-by: Brad Clark <bdashrad@gmail.com>
|
Welcome @bdashrad! It looks like this is your first PR to falcosecurity/falco 🎉 |
|
/milestone 0.32.0 |
|
/milestone 0.32.0 /cc @Kaizhe |
|
Closing and reopening to trigger the CI |
|
@leogr: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/reopen |
|
@leogr: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
rules/falco_rules.yaml
Outdated
| evt.arg.oldpath contains "bash_history" or | ||
| evt.arg.oldpath endswith "zsh_history" or | ||
| evt.arg.oldpath contains "fish_read_history" or | ||
| evt.arg.oldpath endswith "fish_history" or | ||
| evt.arg.oldpath contains "ash_history" or |
There was a problem hiding this comment.
Would be possible to use endswith operator instead of contains?
Thanks
There was a problem hiding this comment.
If we introduce ash_history (doesn't matter whether using operator contains or endswith), we can ignore the bash_history then. A proper comment will be useful here saying both bash_history and ash_history will be covered.
There was a problem hiding this comment.
Seems like a reasonable approach to me. Do we still want to use contains or do we want to change it to endswith. I don't have a preference.
Signed-off-by: Brad Clark <bdashrad@gmail.com>
|
LGTM label has been added. Git tree hash: d8bf707d3fcaff499c0da286aca464a434332179
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bdashrad, leogr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@Kaizhe ping 🤗 |
What type of PR is this?
/kind rule-update
Any specific area of the project related to this PR?
/area rules
What this PR does / why we need it:
Includes .ash_history in
rule: Delete or rename shell historyWhich issue(s) this PR fixes:
Fixes #1605
Special notes for your reviewer:
Does this PR introduce a user-facing change?: