salt-call is parsed wrongly

[zadjadr]

When running something like sudo salt-call state.apply test=True falco parsed the command and program name wrong.

The output I get is the following:

Warning Sensitive file opened for reading by non-trusted program (user=root user_loginuid=1001 program=run command=run call state.apply test=True pid=2123116 file=/etc/sudoers.d/[REDACTED] parent=sudo gparent=bash ggparent=sshd gggparent=sshd container_id=host image=<NA>)

As you can see, the command field looks wrong; it interprets salt-call as run call while program is seen as run.

• Activate default rules for falco
• run sudo salt-call state.apply test=True

Unfortunately this needs salt installed but it might be enough to just use an alias like alias echo=salt-call.

I expect program=salt-call and command=salt-call state.apply test=True

Environment

• Falco version: 0.34.1

• System info:

Thu Apr 13 16:29:08 2023: Falco version: 0.34.1 (x86_64)
Thu Apr 13 16:29:08 2023: Falco initialized with configuration file: /etc/falco/falco.yaml
Thu Apr 13 16:29:08 2023: Loading rules from file /etc/falco/falco_rules.yaml
Thu Apr 13 16:29:08 2023: Loading rules from file /etc/falco/falco_rules.local.yaml
{
  "machine": "x86_64",
  "nodename": "[REDACTED]",
  "release": "5.15.0-60-generic",
  "sysname": "Linux",
  "version": "#66-Ubuntu SMP Fri Jan 20 14:29:49 UTC 2023"
}

• Cloud provider or hardware configuration: VM in Openstack
• OS: Ubuntu 22.04.2 LTS

• Kernel: 5.15.0-60-generic #66-Ubuntu SMP Fri Jan 20 14:29:49 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

• Installation method: DEB

[FedeDP]

Hi! Thanks for opening this issue!
This issue is well known and is being tracked:

• [BUG] libs do not update proc.name for renamed threads libs#1011
• Investigate setproctitle drivers behavior libs#988

And a couple of related PRs:

• [WIP] Collect correct arguments when setproctitle is called libs#976
• new(driver): support for prctl syscall libs#1015

This is actively being worked on :)

[zadjadr]

Thanks @FedeDP, then I'd close this one!

[FedeDP]

Feel free to comment on other issues if you feel :) every feedback is appreciated!