rule(macro multipath_writing_conf): create and use the macro #1475
Conversation
`multipath`, which is run by `systemd-udevd`, writes to `/etc/multipath/wwids`, `/etc/multipath/bindings` and a few other paths under `/etc/multipath` as part of its normal operation. Signed-off-by: Nicolas Marier <nmarier@coveo.com>
|
Welcome @nmarier-coveo! It looks like this is your first PR to falcosecurity/falco 🎉 |
For the record, it isn't! I'm just using my work account now instead of @marier-nico 😄 |
|
/cc @Kaizhe |
|
LGTM label has been added. Git tree hash: fc103d187e91b99715d723c30e8f89a380ab68f2
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fntlnz, Kaizhe, leodido The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fntlnz, Kaizhe, leodido The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/milestone 0.27.0 |
What type of PR is this?
/kind rule-update
Any specific area of the project related to this PR?
/area rules
What this PR does / why we need it:
multipath, which is run bysystemd-udevd(in our environment), writes to/etc/multipath/wwids,/etc/multipath/bindingsand a few other paths under/etc/multipathas part of its normal operation. Falco is sending alerts for this, but given that it's expected behaviour formultipath, it probably shouldn't!For more information about multipath defaults, see https://manpages.debian.org/testing/multipath-tools/multipath.conf.5.en.html
Which issue(s) this PR fixes:
None
Special notes for your reviewer:
None
Does this PR introduce a user-facing change?: