Mark Stemm 3b390793b9 Fix bug in macro that was masked by old evttype checking ...

It turns out that the macro inbound_outbound had a logical bug where
joining the beginning and end of the macro with "or" led to the macro
matching all event types by accident.

Most of the time this isn't harmful but it turns out some trace files
will do operations on inet connection fds like "dup", and those get
mistakenly picked up by this macro, as the fd for the event does
happen to be a network connection fd.

This fixes the macro to only match those event types *and* when the fd
is a inet connection fd.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2021-10-12 17:59:38 +02:00

..

application_rules.yaml

update: license headers

2019-10-08 16:02:26 +02:00

CMakeLists.txt

build(rules): fix rules etc dir

2020-09-10 15:01:07 +02:00

falco_rules.local.yaml

update: license headers

2019-10-08 16:02:26 +02:00

falco_rules.yaml

Fix bug in macro that was masked by old evttype checking

2021-10-12 17:59:38 +02:00

k8s_audit_rules.yaml

add known k8s service accounts

2021-06-04 10:46:09 +02:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00