Files
falco/rules
Mark Stemm dc44655ec2 Change how we detect entrypoints.
Move entrypoint detection to its own macro. Also consider something the
entrypoint if its parent is runc:[0:PARENT]. There's a race where
runc:[0:PARENT] exits in parallel with the root program being execd, so
the parent might not exist or might have this name.
2017-10-09 09:16:25 -07:00
..
2017-10-05 18:35:39 -07:00