Fix events-modifying-system-mac-collected-fallback

mindedsecurity · Dec 1, 2023 · 41fbe00 · 41fbe00
1 parent e16a2af
commit 41fbe00
Showing 1 changed file with 8 additions and 8 deletions.
diff --git a/configs/defs/fallback.textproto b/configs/defs/fallback.textproto
@@ -11886,12 +11886,12 @@ benchmark_configs: {
       "                content_entry:{"
       "                    match_type: ALL_MATCH_ANY_ORDER"
       "                    match_criteria:{"
-      "                        filter_regex: \".*/etc/selinux.*\""
-      "                        expected_regex: \"\\\\s*-w\\\\s*/etc/selinux\\\\s*-p\\\\s*wa\\\\s*(-F\\\\s*key=|-k)\\\\s*[!-~]*\\\\s*\""
+      "                        filter_regex: \".*/etc/selinux.*-k\\\\s+MAC-policy\\\\s*\""
+      "                        expected_regex: \"\\\\s*-w\\\\s*/etc/selinux(/?)\\\\s*-p\\\\s*wa\\\\s+.*-k\\\\s+MAC-policy\\\\s*\""
       "                    }"
       "                    match_criteria:{"
-      "                        filter_regex: \".*/usr/share/selinux.*\""
-      "                        expected_regex: \"\\\\s*-w\\\\s*/usr/share/selinux\\\\s*-p\\\\s*wa\\\\s*(-F\\\\s*key=|-k)\\\\s*[!-~]*\\\\s*\""
+      "                        filter_regex: \".*/usr/share/selinux.*-k\\\\s+MAC-policy\\\\s*\""
+      "                        expected_regex: \"\\\\s*-w\\\\s*/usr/share/selinux(/?)\\\\s*-p\\\\s*wa\\\\s+.*-k\\\\s+MAC-policy\\\\s*\""
       "                    }"
       "                }"
       "            }"
@@ -11909,12 +11909,12 @@ benchmark_configs: {
       "                content_entry:{"
       "                    match_type: ALL_MATCH_ANY_ORDER"
       "                    match_criteria:{"
-      "                        filter_regex: \".*/etc/selinux.*\""
-      "                        expected_regex: \"\\\\s*-w\\\\s*/etc/selinux\\\\s*-p\\\\s*wa\\\\s*(-F\\\\s*key=|-k)\\\\s*[!-~]*\\\\s*\""
+      "                        filter_regex: \".*/etc/selinux.*-k\\\\s+MAC-policy\\\\s*\""
+      "                        expected_regex: \"\\\\s*-w\\\\s*/etc/selinux(/?)\\\\s*-p\\\\s*wa\\\\s+.*-k\\\\s+MAC-policy\\\\s*\""
       "                    }"
       "                    match_criteria:{"
-      "                        filter_regex: \".*/usr/share/selinux.*\""
-      "                        expected_regex: \"\\\\s*-w\\\\s*/usr/share/selinux\\\\s*-p\\\\s*wa\\\\s*(-F\\\\s*key=|-k)\\\\s*[!-~]*\\\\s*\""
+      "                        filter_regex: \".*/usr/share/selinux.*-k\\\\s+MAC-policy\\\\s*\""
+      "                        expected_regex: \"\\\\s*-w\\\\s*/usr/share/selinux(/?)\\\\s*-p\\\\s*wa\\\\s+.*-k\\\\s+MAC-policy\\\\s*\""
       "                    }"
       "                }"
       "            }"