new(rules): add umount macro

Signed-off-by: incertum <[email protected]>
falcosecurity · Apr 4, 2023 · b5e2240 · b5e2240
1 parent 8780d9d
commit b5e2240
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -74,6 +74,11 @@
 - macro: modify
   condition: (rename or remove)
 
+# %evt.arg.flags available for evt.dir=>, but only for umount2
+# %evt.arg.name is path and available for evt.dir=<
+- macro: umount
+  condition: (evt.type in (umount, umount2))
+
 - macro: spawned_process
   condition: (evt.type in (execve, execveat) and evt.dir=<)