From c6cdc1519e9d702c7f79fc899ff709b420fe343c Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Tue, 22 Aug 2023 14:52:00 -0700 Subject: [PATCH] cleanup(rules): update container_entrypoint (2/n) Signed-off-by: Melissa Kilby --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 92f048462..ae892e7f2 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2007,7 +2007,7 @@ # when we lose events and lose track of state. - macro: container_entrypoint - condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe, docker-runc-cur, containerd-shim, systemd)) + condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe, docker-runc-cur, containerd-shim, systemd, crio)) - rule: Launch Sensitive Mount Container desc: >