Diego Fernandez Diaz
Diego Fernandez Diaz
Whats the ETA for this fix to be merged?
I believe this can be a problem with the rule and not falco itself: https://falco.org/docs/reference/rules/default-rules/#Read_sensitive_file_untrusted https://github.com/falcosecurity/rules/blob/ce46d23f61231e0fee97c47bb222f0613cfed058/rules/falco_rules.yaml#L398 Can you check those and maybe reopen the issue in the [falco rules repo](https://github.com/falcosecurity/rules/)
Its strange, proc.aname[1] should be the same as proc.pname, to be honest i suggested to go on the rules repo just in case you had more luck in there as...
Im having the same issue