adding event on Redirect stdout/stdin to network connection in container
#185
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: h4l0gen The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
h4l0gen
changed the title
Redirect stdout/stdin to network connection in containerRedirect stdout/stdin to network connection in container
|
Hey @leogr and @FedeDP, just an attempt to redirect
Rule triggered successfully |
h4l0gen
changed the title
Redirect stdout/stdin to network connection in containerRedirect stdout/stdin to network connection in container
| func redirectStdout(conn net.Conn) error { | ||
| // Duplicate the file descriptor of the network connection | ||
| remoteFile, _ := conn.(*net.TCPConn).File() | ||
| defer remoteFile.Close() | ||
|
|
||
| // Duplicate the file descriptor of stdout | ||
| stdoutFile := os.Stdout.Fd() | ||
|
|
||
| // Redirect stdout to the network connection using dup2 | ||
| if err := syscall.Dup2(int(remoteFile.Fd()), int(stdoutFile)); err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } |
Signed-off-by: h4l0gen <[email protected]> redirectStdout function shifted to utils_linux.go Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]>
|
Issues go stale after 90d of inactivity. Mark the issue as fresh with Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with Provide feedback via https://github.com/falcosecurity/community. /lifecycle stale |
|
/remove-lifecycle stale |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area events
What this PR does / why we need it:
this PR triggers rule which prevent potential reverse shell or remote code execution.
Which issue(s) this PR fixes:
Fixes #184
Special notes for your reviewer: