From a32870ae1d26f48660a1e44f447cd1b916b8e957 Mon Sep 17 00:00:00 2001 From: Mattia Pagnozzi Date: Tue, 9 Jul 2019 10:59:59 +0200 Subject: [PATCH] Add runc to the list of possible container entrypoint parents Docker versions >= 18.09 removed the "docker-" prefix, so include runc in the list. Signed-off-by: Mattia Pagnozzi --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index b4a86528..79ba406c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1832,7 +1832,7 @@ # when we lose events and lose track of state. - macro: container_entrypoint - condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe)) + condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe)) - rule: Launch Sensitive Mount Container desc: >