Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More /dev/tcp rule tweaks for GitLab healthcheck script #372

Merged
merged 2 commits into from
Jul 19, 2024

Conversation

egibs
Copy link
Member

@egibs egibs commented Jul 19, 2024

This PR addresses a false positive seen here: https://github.com/chainguard-dev/enterprise-packages/pull/5949

We resolved this for the bash_dev_tcp_hardcoded_ip rule but not the bash_dev_tcp rule.

Results before this change:

$ yara -r rules/shell/bash_dev_tcp.yara /tmp/bincapz/gitlab-cng/x86_64/scripts/healthcheck -s
bash_dev_tcp /tmp/bincapz/gitlab-cng/x86_64/scripts/healthcheck
0x71:$ref: /dev/tcp

After:

$ yara -r rules/shell/bash_dev_tcp.yara /tmp/bincapz/gitlab-cng/x86_64/scripts/healthcheck -c
0

@egibs egibs requested a review from hectorj2f July 19, 2024 18:24
Signed-off-by: egibs <[email protected]>
@egibs egibs enabled auto-merge (squash) July 19, 2024 18:29
@egibs egibs merged commit a038cc6 into chainguard-dev:main Jul 19, 2024
6 checks passed
egibs added a commit to egibs/malcontent that referenced this pull request Aug 5, 2024
…ev#372)

* More /dev/tcp rule tweaks for GitLab healthcheck script

Signed-off-by: egibs <[email protected]>

* Refresh test data

Signed-off-by: egibs <[email protected]>

---------

Signed-off-by: egibs <[email protected]>
@egibs egibs deleted the tweak-dev-tcp-rule branch August 5, 2024 16:36
egibs added a commit to egibs/malcontent that referenced this pull request Sep 25, 2024
…ev#372)

* More /dev/tcp rule tweaks for GitLab healthcheck script

Signed-off-by: egibs <[email protected]>

* Refresh test data

Signed-off-by: egibs <[email protected]>

---------

Signed-off-by: egibs <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants