Attributed metadata history
Up to 100 retained publisher events per page for 837bc93659b5e84020e4bea0287859e3d4dd29284d4fa8e92d01830b83b6e219. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_04a2c4d5d7c7c0ff94
observed · 2026-10-12 05:30:52 UTC
update(falco_rules): exclude systemd helpers from Read sensitive file… … untrusted systemd spawns short-lived helper processes that legitimately read sensitive account and PAM files during normal operation. Because these helpers report a bare-number or comm-truncated proc.name, they cannot be matched by name, so the existing systemd exclusions in the rule do not cover them and the rule fires a false positive on every affected host. This adds a systemd_sensitive_file_readers macro that matches on proc.exepath (kernel-resolved and unspoofable) anchored to the expected systemd parent, covering two observed helpers: - systemd-executor (unit re-exec deserialize handoff) - systemd-userwork (userdb User/Group Record Lookup worker) The systemd-userwork case was reproduced locally on systemd 259 / Falco 0.44.1 and verified by deterministic capture replay. The systemd-executor case is reported in #291 and falcosecurity/falco#3480. Signed-off-by: MayankSekhar <mayankshekharsingh@gmail.com>
Fingerprint: f625ffd7df87a50d6b17cfa6ee6d624d09f54569003de54cb202eacf6582c6fc
intelligence_src_04a2c4d5d7c7c0ff94
observed · 2026-10-12 05:30:52 UTC
available
Fingerprint: b71da396d65a6a5074009a5aeed3fae24a2b7a41b83fbe7c29b6db94029c50dc