Add runc to the list of possible container entrypoint parents

Docker versions >= 18.09 removed the "docker-" prefix, so include runc in the list. Signed-off-by: Mattia Pagnozzi <mattia.pagnozzi@gmail.com>
falcosecurity · Jul 9, 2019 · a32870a · a32870a
1 parent fdbd520
commit a32870a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -1832,7 +1832,7 @@
 # when we lose events and lose track of state.
 
 - macro: container_entrypoint
-  condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe))
+  condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe))
 
 - rule: Launch Sensitive Mount Container
   desc: >