From 4331dd768277f80d6f24a9fbf3897a1099394492 Mon Sep 17 00:00:00 2001 From: Paul Cacheux Date: Fri, 15 Nov 2024 16:11:14 +0100 Subject: [PATCH] remove pid check --- pkg/security/probe/selftests/create_file_windows.go | 2 +- pkg/security/probe/selftests/open_registry_key_windows.go | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/pkg/security/probe/selftests/create_file_windows.go b/pkg/security/probe/selftests/create_file_windows.go index 319b524836137a..806ef251044e5e 100644 --- a/pkg/security/probe/selftests/create_file_windows.go +++ b/pkg/security/probe/selftests/create_file_windows.go @@ -38,7 +38,7 @@ func (o *WindowsCreateFileSelfTest) GetRuleDefinition() *rules.RuleDefinition { return &rules.RuleDefinition{ ID: o.ruleID, - Expression: fmt.Sprintf(`create.file.name == "%s" && create.file.device_path =~ "%s" && process.pid == %d`, basename, filepath.ToSlash(devicePath), os.Getpid()), + Expression: fmt.Sprintf(`create.file.name == "%s" && create.file.device_path =~ "%s"`, basename, filepath.ToSlash(devicePath)), Silent: true, } } diff --git a/pkg/security/probe/selftests/open_registry_key_windows.go b/pkg/security/probe/selftests/open_registry_key_windows.go index 99aaa76e34e78d..1690e15bd3d02b 100644 --- a/pkg/security/probe/selftests/open_registry_key_windows.go +++ b/pkg/security/probe/selftests/open_registry_key_windows.go @@ -10,7 +10,6 @@ package selftests import ( "fmt" - "os" "os/exec" "path/filepath" @@ -32,7 +31,7 @@ func (o *WindowsOpenRegistryKeyTest) GetRuleDefinition() *rules.RuleDefinition { return &rules.RuleDefinition{ ID: o.ruleID, - Expression: fmt.Sprintf(`open.registry.key_name == "%s" && process.pid == %d`, filepath.Base(o.keyPath), os.Getpid()), + Expression: fmt.Sprintf(`open.registry.key_name == "%s"`, filepath.Base(o.keyPath)), Silent: true, } }