Add parenthesis to containerd_activities macro

Signed-off-by: Brenno Oliveira <brenno.oliveira@deliveryhero.com>
falcosecurity · Oct 7, 2023 · a22d0d7 · a22d0d7
1 parent 82d7a93
commit a22d0d7
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -922,8 +922,8 @@
               container.image.repository endswith "containernetworking/azure-npm")
 
 - macro: containerd_activities
-  condition: proc.name=containerd and (fd.name startswith "/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/" or
-                                       fd.name startswith "/var/lib/containerd/tmpmounts/")
+  condition: (proc.name=containerd and (fd.name startswith "/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/" or
+                                        fd.name startswith "/var/lib/containerd/tmpmounts/"))
 
 - rule: Clear Log Activities
   desc: >