Attributed metadata history
Up to 100 retained publisher events per page for b9a71c889cb66b83174a27573fafd42c3e1dd9b40d366db3261d425a6a625b84. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_04a2c4d5d7c7c0ff94
observed · 2026-10-12 05:30:52 UTC
update(falco_rules): exclude systemd helpers from Read sensitive file… … untrusted systemd spawns short-lived helper processes that legitimately read sensitive account and PAM files during normal operation. Because these helpers report a bare-number or comm-truncated proc.name, they cannot be matched by name, so the existing systemd exclusions in the rule do not cover them and the rule fires a false positive on every affected host. This adds a systemd_sensitive_file_readers macro that matches on proc.exepath (kernel-resolved and unspoofable) anchored to the expected systemd parent, covering two observed helpers: - systemd-executor (unit re-exec deserialize handoff) - systemd-userwork (userdb User/Group Record Lookup worker) The systemd-userwork case was reproduced locally on systemd 259 / Falco 0.44.1 and verified by deterministic capture replay. The systemd-executor case is reported in #291 and falcosecurity/falco#3480. Signed-off-by: MayankSekhar <mayankshekharsingh@gmail.com>
Fingerprint: 623bb3baf57665905fdf02c42809244599351e36687fbc1dc75a523e151a99d8
intelligence_src_04a2c4d5d7c7c0ff94
observed · 2026-10-12 05:30:52 UTC
available
Fingerprint: b71da396d65a6a5074009a5aeed3fae24a2b7a41b83fbe7c29b6db94029c50dc