rule(macro modify_shell_history, truncate_shell_history): avoid false positives from .zsh_history.new and .LOCK files

[m4wh6k]

Signed-off-by: m4wh6k m4wh6k@users.noreply.github.com

/kind bug
/kind rule-update
/area rules

What this PR does / why we need it:
The default macros modify_shell_history and truncate_shell_history match on .zsh_history.new and .zsh_history.LOCK files, which are temporary files created while using zsh. This causes rules using these macros to produce false positives. This PR changes the macros to use endswith rather than contains, which makes it work in the expected way.

Example false-positive:

"output":"15:06:46.088446909: Warning Shell history had been deleted or renamed (user=m4wh6k user_loginuid=1000 type=unlink command=zsh fd.name=<NA> name=<NA> path=/home/m4wh6k/.zsh_history.LOCK oldpath=<NA> host (id=host))","priority":"Warning","rule":"Delete or rename shell history","source":"syscall","tags":["mitre_defense_evasion","process"],"time":"2021-12-31T23:06:46.088446909Z", "output_fields": {"container.id":"host","container.name":"host","evt.arg.name":null,"evt.arg.oldpath":null,"evt.arg.path":"/home/m4wh6k/.zsh_history.LOCK","evt.time":1640992006088446909,"evt.type":"unlink","fd.name":null,"proc.cmdline":"zsh","user.loginuid":1000,"user.name":"m4wh6k"}}

Which issue(s) this PR fixes:
n/a

Does this PR introduce a user-facing change?:

rule(macro: modify_shell_history): avoid false-positive alerts triggered by modifications to .zsh_history.new and .zsh_history.LOCK files
rule(macro: truncate_shell_history): avoid false-positive alerts triggered by modifications to .zsh_history.new and .zsh_history.LOCK files

[poiana]

Welcome @m4wh6k! It looks like this is your first PR to falcosecurity/falco 🎉

[leogr]

/milestone 0.32.0

[Kaizhe]

@m4wh6k thanks for the contribution!

[Kaizhe]

/lgtm

[poiana]

LGTM label has been added.

Git tree hash: 37b5756bb5703a5f11531a1851b1781c79db6293

[leogr]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kaizhe, leogr, m4wh6k

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [Kaizhe,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment