poprhythm
9bf72f8e19
Written after the 2026-08-10/11 gitea internal-API log-poisoning attack that planted a malicious uploadpack.packObjectsHook backdoor. Catches both the planting (unexpected exec from a hooks/ path) and the firing (git-upload-pack/git-receive-pack spawning anything but its own pack-objects binary), independent of how the hook config got written.
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
networks:
|
|
default:
|
|
# Falco's own default bridge network, plus netdata's network so netdata
|
|
# can scrape http://falco:8765/metrics by container name.
|
|
netdata_default:
|
|
external: true
|
|
|
|
services:
|
|
falco:
|
|
image: falcosecurity/falco:0.44.1
|
|
container_name: falco
|
|
restart: always
|
|
cap_drop:
|
|
- all
|
|
cap_add:
|
|
- sys_admin
|
|
- sys_resource
|
|
- sys_ptrace
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
networks:
|
|
- default
|
|
- netdata_default
|
|
ports:
|
|
- "127.0.0.1:8765:8765"
|
|
volumes:
|
|
- /sys/kernel/tracing:/sys/kernel/tracing:ro
|
|
- /var/run/docker.sock:/host/var/run/docker.sock:ro
|
|
- /proc:/host/proc:ro
|
|
- /etc:/host/etc:ro
|
|
- ./config/falco.yaml:/etc/falco/config.d/telemetry.yaml:ro
|
|
- ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
|
|
- ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
|
|
- ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
|
|
- ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
|
|
- ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro
|