Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

mv file /etc/falco/rule.d/ will not cause falco to restart, but cp -r file /etc/falco/rule.d/file can #2943

Closed
YanjiangChen opened this issue Dec 5, 2023 · 1 comment · Fixed by #2965
Closed

mv file /etc/falco/rule.d/ will not cause falco to restart, but cp -r file /etc/falco/rule.d/file can #2943

YanjiangChen opened this issue Dec 5, 2023 · 1 comment · Fixed by #2965
Labels
kind/bug
Milestone
0.37.0

Comments

@YanjiangChen
Copy link

Describe the bug

How to reproduce it

Expected behaviour

Screenshots

Environment

  • Falco version:
  • System info:
  • Cloud provider or hardware configuration:
  • OS:
  • Kernel:
  • Installation method:

Additional context
@NitroCao
Copy link
Contributor

Because Falco currently only monitors events with IN_CREATE and IN_DELETE type for rule directories, but mv command generates events with IN_MOVE type. I'll add a PR to fix it.

@NitroCao NitroCao mentioned this issue Dec 12, 2023
Merged
@Andreagit97 Andreagit97 added this to the 0.37.0 milestone Dec 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug
Projects
None yet
Milestone
0.37.0
Development

Successfully merging a pull request may close this issue.

feat(userspace/falco): monitor more types of events for rule directories and files NitroCao/falco
3 participants
@NitroCao @YanjiangChen @Andreagit97