Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend whitelist to include parent process path alongside current process path #48

Open
noproto opened this issue Dec 28, 2021 · 2 comments
Assignees
Labels
enhancement New feature or request

Comments

@noproto
Copy link
Collaborator

noproto commented Dec 28, 2021

There are scenarios where the child runs programs and/or writes files which wouldn't be desirable under most conditions. For example, the development version of WhiteBeam allows 36 programs to be run through bash/dash. We want to be able to allow certain programs to execute when the parent process is getty/sshd, but not allow them when the parent process is (e.g.) php/java. We also want support for ANY in this field.

This issue will require a change to the SQL schema as well as regenerating the Base whitelist as needed.

@noproto noproto added the enhancement New feature or request label Dec 28, 2021
@noproto
Copy link
Collaborator Author

noproto commented Feb 3, 2022

Added parent column to Whitelist table WhiteBeamSec/SQL@83fbbeb

@noproto
Copy link
Collaborator Author

noproto commented Feb 7, 2022

Added in WhiteBeam in 880f993. Testing and generating whitelists before closing out this issue.

@noproto noproto self-assigned this Feb 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant