Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update: bpf cmd format #208

Merged
merged 2 commits into from
Feb 29, 2024
Merged

Update: bpf cmd format #208

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e4e7229
update(rules/sandbox_rules): update bpf cmd format
Rohith-Raju Dec 19, 2023
8fdf9b4
update(sandbox): update required_engine_version
Rohith-Raju Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rules/falco-sandbox_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@

# Starting with version 8, the Falco engine supports exceptions.
# However the Falco rules file does not use them by default.
- required_engine_version: 0.31.0
- required_engine_version: 0.35.0

# Currently disabled as read/write are ignored syscalls. The nearly
# similar open_write/open_read check for files being opened for
Expand Down Expand Up @@ -1713,7 +1713,7 @@
whether the syscall failed or succeeded, remove the direction filter and add the evt.arg.res_or_fd output field.
condition: >
evt.type=bpf and evt.dir=>
and evt.arg.cmd=5
and evt.arg.cmd=BPF_PROG_LOAD
and not bpf_profiled_procs
output: BPF Program Not Profiled (bpf_cmd=%evt.arg.cmd evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)
priority: NOTICE
Expand Down
Loading