Skip to content

Commit

Permalink
new(rules): comment out new umount macro
Browse files Browse the repository at this point in the history
keep in rules as hint for end users

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: incertum <melissa.kilby.oss@gmail.com>
  • Loading branch information
3 people authored and poiana committed Apr 4, 2023
1 parent b5e2240 commit 5857874
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions rules/falco_rules.yaml
Expand Up @@ -76,8 +76,8 @@

# %evt.arg.flags available for evt.dir=>, but only for umount2
# %evt.arg.name is path and available for evt.dir=<
- macro: umount
condition: (evt.type in (umount, umount2))
# - macro: umount
# condition: (evt.type in (umount, umount2))

- macro: spawned_process
condition: (evt.type in (execve, execveat) and evt.dir=<)
Expand Down

0 comments on commit 5857874

Please sign in to comment.