From 4f153f53aee76351b3f51438c8c3a28bba1b1210 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Mon, 29 Apr 2024 13:04:55 +0200 Subject: [PATCH] fix: add `""` case for user.name Signed-off-by: Andrea Terzolo --- rules/falco-incubating_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index cef71723..8653d42a 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -769,7 +769,7 @@ # https://github.com/draios/sysdig/issues/954). So in that case, allow # a setuid. - macro: known_user_in_container - condition: (container and not user.name in ("","N/A")) + condition: (container and not user.name in ("","N/A","")) # Add conditions to this macro (probably in a separate file, # overwriting this macro) to allow for specific combinations of