cleanup(falco_rules): we need only dup exit events

In `Redirect STDOUT/STDIN` rule we check for evt.rawres but this is a parameter that we only have in the exit event Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · May 31, 2024 · a815900 · a815900
1 parent ad27109
commit a815900
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -91,7 +91,7 @@
   condition: (evt.type in (init_module, finit_module) and evt.dir=<)
 
 - macro: dup
-  condition: (evt.type in (dup, dup2, dup3))
+  condition: (evt.type in (dup, dup2, dup3) and evt.dir=<)
 
 # File categories
 - macro: etc_dir