Skip to content

Commit

Permalink
cleanup: remove startswith /etc
Browse files Browse the repository at this point in the history
In macro `sensitive_files` the `startswith /etc` is redundant because it
used in combination with the `in` condition

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
  • Loading branch information
Andreagit97 committed May 27, 2024
1 parent 6f2d60e commit 8e8dd11
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@

- macro: sensitive_files
condition: >
((fd.name startswith /etc and fd.name in (sensitive_file_names)) or
(fd.name in (sensitive_file_names) or
fd.directory in (/etc/sudoers.d, /etc/pam.d))
# Indicates that the process is new. Currently detected using time
Expand Down

0 comments on commit 8e8dd11

Please sign in to comment.