Delete or rename shell history: .ash_history

[mike-stewart]

Describe the bug

The "Delete or rename shell history" rule detects changes to bash, zsh, and fish history files, but does not detect changes to .ash_history. The ash_history file is common for alpine containers, so it might be a good one to include.

https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml#L2612-L2623

How to reproduce it

Delete or truncate the .ash_history file in an alpine container.

Expected behaviour

Falco would alert for the "Delete or rename shell history" rule.

Environment

• Falco version: 0.27.0

• System info:

• Cloud provider or hardware configuration:
• OS: Alpine container running on Amazon Linux nodes

• Kernel:

• Installation method: Falco running as a daemonset in Kubernetes

Additional context

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[mike-stewart]

/remove-lifecycle rotten

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale