falco: tune out host-reboot false positives from 2026-09-16 boot burst

Host rebooted 2026-09-16 17:47 UTC, recreating every container at once and
producing 70 alerts in a single burst - all traced to benign init-time
patterns that will recur on every future reboot: systemd-executor's PAM
reads during boot, firefly-iii/fidi's s6 healthcheck shell, and romm's own
loopback redis/app connection at container start.

falco/rules/tune-noise.yaml

@@ -15,10 +15,17 @@
 #   touch. Same pattern confirmed on calibre 2026-08-19; scoped per-image
 #   rather than by proc.name alone since any other linuxserver.io image will
 #   hit this the first time it's added here too.
+# - systemd-executor (container_name=host): fired 63x reading /etc/shadow and
+#   every /etc/pam.d/* file during the 2026-09-16 17:47 host reboot, as every
+#   service's login/session setup ran at once. Normal PAM stack behavior at
+#   boot, not credential harvesting - will recur on every future reboot.
+#   Scoped by proc.exepath since proc.name is a meaningless re-exec artifact
+#   ("9") for systemd's own executor process during --deserialize.
 - macro: user_known_read_sensitive_files_activities
   condition: >
     (proc.name = pg_isready)
     or (container.image.repository in ("lscr.io/linuxserver/obsidian", "lscr.io/linuxserver/calibre") and proc.name = sed)
+    or (proc.exepath = "/usr/lib/systemd/systemd-executor")
 
 # "Fileless execution via memfd_create" fires from nvidia-ctk's
 # ldconfig-refresh hook, which runs via memfd_create by design every time
@@ -65,10 +72,16 @@
 #   connection to the postgres container to poll for DB readiness, which
 #   redirects stdio the same way a reverse shell would mechanically. Scoped
 #   to the script's own cmdline, not the whole image.
+# - rommapp/romm: its own init (bash /init) connects to its bundled loopback
+#   redis (127.0.0.1:6379) and app port (127.0.0.1:5000) at container start,
+#   same dup2-based mechanic. Confirmed at the 2026-09-16 host reboot; will
+#   recur on every container start. Scoped to the image, not proc.name,
+#   since this is the container's own /init script.
 - macro: user_known_stand_streams_redirect_activities
   condition: >
     (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session))
     or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh")
+    or (container.image.repository = "rommapp/romm" and proc.cmdline = "bash /init")
 
 # "Clear Log Activities" false-positive: lsyncd (host systemd service, not a
 # container - running since 2026-07-29) truncates its own status file,
@@ -78,3 +91,11 @@
 # other log-truncation in that directory still gets flagged.
 - macro: allowed_clear_log_files
   condition: (fd.name = "/var/log/lsyncd-status.log" and proc.name = lsyncd)
+
+# "Run shell untrusted" false-positive: fireflyiii/core and
+# fireflyiii/data-importer's own s6 healthcheck (`sh ./data/check`, spawned
+# by s6-notifyoncheck) fires twice per container start. Confirmed at the
+# 2026-09-16 host reboot; will recur on every start. This list is the
+# rule's own designated customization point (default: empty).
+- list: user_known_shell_spawn_binaries
+  items: [s6-notifyoncheck]