fix(driver): configure newfstatat with UF_ALWAYS_DROP

Signed-off-by: Wiktor Gołgowski <[email protected]>
falcosecurity · Feb 10, 2024 · 6d47405 · 6d47405
1 parent 9932142
commit 6d47405
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.17.0
+2.17.1
diff --git a/driver/syscall_table.c b/driver/syscall_table.c
@@ -423,7 +423,7 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = {
 	[__NR_mknodat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKNODAT_E, PPME_SYSCALL_MKNODAT_X, PPM_SC_MKNODAT},
 #endif
 #ifdef __NR_newfstatat
-	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_NEWFSTATAT_E, PPME_SYSCALL_NEWFSTATAT_X, PPM_SC_NEWFSTATAT},
+	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_NEWFSTATAT_E, PPME_SYSCALL_NEWFSTATAT_X, PPM_SC_NEWFSTATAT},
 #endif
 #ifdef __NR_process_vm_readv
 	[__NR_process_vm_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PROCESS_VM_READV_E, PPME_SYSCALL_PROCESS_VM_READV_X, PPM_SC_PROCESS_VM_READV},