camflow-dev
camflow-dev copied to clipboard
Add default node filter policy
Adding the following line: prov_policy.prov_node_filter = ENT_INODE_UNKNOWN & ENT_INODE_DIRECTORY & ENT_INODE_DIRECTORY & ENT_ENV;
here https://github.com/CamFlow/camflow-dev/blob/0fab1b96c7d7ee0511dbcfef8ae2b9f3b86fe43d/security/provenance/hooks.c#L2905 should work.
It should be added when whole provenance capture is selected in the kernel config option.
Needs to be implemented and tested.