Rootcheck docker OverlayFS directories problem

[oleg9301]

Hello!

i have next problem in my vm with docker

Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Files hidden inside directory '/var/lib/docker/overlay2/b95813d65af05851af3a114be77d2f4ba123c5d44ed1cbea978118c1f60f79c0/merged/dev'. Link count does not match number of files (4,1).

And i found next topic: wazuh/wazuh#561

[kurczakos]

Hello!
The problem still persists in Version 3.5.0 when docker makes use of Linux namespaces (userns-remap).

Files hidden inside directory '/var/lib/docker/231072.231072/overlay2/...'. Link count does not match number of files (3,1).

The commit 460a2d2dd5706789774f425e88335b0ca74ffb57 don't seem to have fully resolved the issue.

[drmaciej]

I can confirm this is still happening on 3.6.0.

[atomicturtle]

Closed by PR 1952