The correct example for RNC shell rule SH.FLOW.CheckUser allows the usage of read command:
if [ "${current_user}" == "root" ]; then
echo "! Execution avec les droits de $current_user !"
echo -n "! Voulez-vous continuer (Oui,Non) ?"
read reponse
if [ "${reponse}" == "N" ] || [ "${reponse}" == "Non" ] || [
"${reponse}" == "n" ] || [ "${reponse}" == "non" ]; then
echo "Sortie du script ..."
exit
fi
fi
So if we copy this example in our shell script, we expect no error.
Actual behaviorIn i-code LEX of COMDESIGNActiveWait rule "read" is considered as active wait command:
ACTWAIT = "read" | "sleep" | "wait"
So if we copy the RNC correct example of rule SH.FLOW.CheckUser (above) we have an COMDESIGNActiveWait error
Steps to reproduce behaviorUse the example of RNC shell rule SH.FLOW.CheckUser (above) in a script
Detection versionV3.0.1
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4