From 4ed581853af162c2b8480490c19d0d4485c9d69b Mon Sep 17 00:00:00 2001 From: kaizhe Date: Sun, 3 Nov 2019 22:58:45 -0800 Subject: [PATCH] rules update: add docker-runc-cur to container_entrypoint macro Signed-off-by: kaizhe --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 0b85b39e..bcbb3c16 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1850,7 +1850,7 @@ # when we lose events and lose track of state. - macro: container_entrypoint - condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe)) + condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe, docker-runc-cur)) - rule: Launch Sensitive Mount Container desc: >