Mark Stemm b8cdb8e46c Modify existing rules to not use ignored syscalls. ...

The ignored syscalls in macros were:
 - write: renamed to open_write to make its weaker resolution more
 apparent. Checks for open with any flag that could change a file.
 - read: renamed to open_read. Checks for open with any read flag.
 - sendto: I couldn't think of any way to replace this, so I simply
 removed it with a comment.

I kept the original read/write macros commented out with a note that
they use ignored syscalls.

I have not tested these changes yet other than verifying that falco
starts properly.

2016-05-05 23:20:46 -07:00

..

CMakeLists.txt

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-1-simple.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-2-macros.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

falco_rules.yaml

Modify existing rules to not use ignored syscalls.

2016-05-05 23:20:46 -07:00