fix: always_true macro needed for allowed_ssh_proxy_env

juju4 · Oct 26, 2024 · 35a7407 · 35a7407
1 parent 1e35f46
commit 35a7407
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/templates/falco_rules.yaml.j2 b/templates/falco_rules.yaml.j2
@@ -72,8 +72,8 @@
 # later you can customize, override the macros to something like
 # - macro: custom_procs
 #   condition: (proc.name in (custom1, custom2, custom3))
-# - macro: always_true
-#   condition: (evt.num>=0)
+- macro: always_true
+  condition: (evt.num>=0)
 
 # In some cases, such as dropped system call events, information about
 # the process name may be missing. For some rules that really depend

diff --git a/templates/falco_rules_w_exceptions.yaml.j2 b/templates/falco_rules_w_exceptions.yaml.j2
@@ -72,8 +72,8 @@
 # later you can customize, override the macros to something like
 # - macro: custom_procs
 #   condition: (proc.name in (custom1, custom2, custom3))
-# - macro: always_true
-#   condition: (evt.num>=0)
+- macro: always_true
+  condition: (evt.num>=0)
 
 # In some cases, such as dropped system call events, information about
 # the process name may be missing. For some rules that really depend