From 8f0520fa09d5affb91f21c101a57292d1e8b98d7 Mon Sep 17 00:00:00 2001 From: Lorenzo Susini Date: Thu, 2 Nov 2023 14:23:27 +0000 Subject: [PATCH] update(rules): no need for double quoting required engine version value Signed-off-by: Lorenzo Susini --- rules/falco-incubating_rules.yaml | 2 +- rules/falco-sandbox_rules.yaml | 2 +- rules/falco_rules.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index 6dbd30d0..27174c6d 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 - macro: open_write condition: (evt.type in (open,openat,openat2) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0) diff --git a/rules/falco-sandbox_rules.yaml b/rules/falco-sandbox_rules.yaml index 932d4c09..945244b8 100644 --- a/rules/falco-sandbox_rules.yaml +++ b/rules/falco-sandbox_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 # Currently disabled as read/write are ignored syscalls. The nearly # similar open_write/open_read check for files being opened for diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index f1a3ec6a..c3738b0c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 # Currently disabled as read/write are ignored syscalls. The nearly # similar open_write/open_read check for files being opened for