Update change_namespace_privillege_using_unshare.go

Signed-off-by: Kapil Sharma <ks3913688@gmail.com>
falcosecurity · Mar 28, 2024 · 5e0be23 · 5e0be23
1 parent 825468b
commit 5e0be23
Showing 1 changed file with 3 additions and 6 deletions.
diff --git a/events/syscall/change_namespace_privillege_using_unshare.go b/events/syscall/change_namespace_privillege_using_unshare.go
@@ -24,16 +24,13 @@ import (
     "github.com/falcosecurity/event-generator/events"
 )
 
-var _ = events.Register(MaliciousProcessWithUnshare)
+var _ = events.Register(ChangeNamespacePrivilegesViaUnshare)
 
 func MaliciousProcessWithUnshare(h events.Helper) error {
     if h.InContainer() {
-        cmd := exec.Command("/bin/sh", "-c", "unshare --fork --pid --mount-proc /bin/bash")
-        cmd.SysProcAttr = &syscall.SysProcAttr{
-			Cloneflags: syscall.CLONE_NEWNS | syscall.CLONE_NEWUSER,
-        }
+        cmd := exec.Command(unshare)
 
-        h.Log().Infof("Change namespace privilleges via unshare")
+        h.Log().Infof("Change namespace privileges via unshare")
 
         if err := cmd.Run(); err != nil {
             return err