update(events): disable PotentialLocalPrivilegeEscalationViaEnvironme…

…ntVariablesMisuse Since it is not in the stable ruleset: https://github.com/falcosecurity/rules/blob/b6ad37371923b28d4db399cf11bd4817f923c286/rules/falco-incubating_rules.yaml#L1263-L1276 Signed-off-by: Leonardo Grasso <[email protected]>
falcosecurity · Sep 20, 2024 · 3604216 · 3604216
1 parent 1958474
commit 3604216
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/events/syscall/potential_local_privilege_escalation_via_environment_variables_misuse.go b/events/syscall/potential_local_privilege_escalation_via_environment_variables_misuse.go
@@ -26,7 +26,10 @@ import (
 	"github.com/falcosecurity/event-generator/events"
 )
 
-var _ = events.Register(PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse)
+var _ = events.Register(
+	PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse,
+	events.WithDisabled(), // this rules is not included in falco_rules.yaml (stable rules), so disable the action
+)
 
 func PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse(h events.Helper) error {
 	// Set the GLIBC_TUNABLES environment variable