fix(driver): configure newfstatat with UF_ALWAYS_DROP

Signed-off-by: Wiktor Gołgowski <[email protected]>
falcosecurity · Feb 9, 2024 · 058f708 · 058f708
1 parent 08ae1c0
commit 058f708
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/driver/syscall_table.c b/driver/syscall_table.c
@@ -423,7 +423,7 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = {
 	[__NR_mknodat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKNODAT_E, PPME_SYSCALL_MKNODAT_X, PPM_SC_MKNODAT},
 #endif
 #ifdef __NR_newfstatat
-	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_NEWFSTATAT_E, PPME_SYSCALL_NEWFSTATAT_X, PPM_SC_NEWFSTATAT},
+	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_NEWFSTATAT_E, PPME_SYSCALL_NEWFSTATAT_X, PPM_SC_NEWFSTATAT},
 #endif
 #ifdef __NR_process_vm_readv
 	[__NR_process_vm_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PROCESS_VM_READV_E, PPME_SYSCALL_PROCESS_VM_READV_X, PPM_SC_PROCESS_VM_READV},