Update: bpf cmd format

[Rohith-Raju]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area rules

Proposed rule maturity level

/area maturity-sandbox

What this PR does / why we need it:

This PR updates new bpf cmd format based on changes implemented in falcosecurity/libs#1545

Which issue(s) this PR fixes:

Fixes #203

Special notes for your reviewer:

[github-actions]

Rules files suggestions

falco-sandbox_rules.yaml

Comparing 88e580cedcb33d81f692882fb07c2fb6f8b16c61 with latest tag falco-sandbox-rules-2.0.0

No changes detected

[incertum]

Thanks @Rohith-Raju ❤️

/hold for a while since we won't have that until libs 0.15.0 and the next Falco release will use libs 0.14.x

Anticipate to hold it until at least February / March.

[Rohith-Raju]

Sounds good!! @incertum

[leogr]

Anticipate to hold it until at least February / March.

Reminder: we will also need to update required_engine_version accordingly.

[incertum]

@Rohith-Raju we finally have the libs changes in Falco master, please bump the required_engine_version to 0.35.0 in the rules file you touched, see https://github.com/falcosecurity/falco/blob/master/userspace/engine/falco_engine_version.h#L23 plus a rebase is needed. Thanks!

[github-actions]

Rules files suggestions

falco-sandbox_rules.yaml

Comparing 0530058deb7ef66c5912060d6c1dab1312de6cba with latest tag falco-sandbox-rules-3.0.1

No changes detected

[incertum]

/approve

@leogr I let you decide when to merge via unholding this. Thanks.
From my perspective we are good to go since we recently made it more clear that the main branch has the latest development.

[poiana]

LGTM label has been added.

Git tree hash: b21dd8d81418e7506c9949596d664c90ac8177e2

[leogr]

👍

/hold cancel

Note: This change makes this ruleset compatible with Falco 0.38 and up only.

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: incertum, leogr, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [incertum,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment