diff --git a/events/syscall/read_ssh_information.go b/events/syscall/read_ssh_information.go index eecaec35..9afcf379 100644 --- a/events/syscall/read_ssh_information.go +++ b/events/syscall/read_ssh_information.go @@ -29,9 +29,20 @@ var _ = events.Register( ) func ReadSshInformation(h events.Helper) error { - const filename = "/root/.ssh/known_hosts" + // Creates temporary data for testing. + directoryname := "/home/created-by-falco-event-generator/.ssh" + if err := os.MkdirAll(directoryname, 0755); err != nil { + return err + } + + filename := directoryname + "/known_hosts" + if err := os.WriteFile(filename, nil, os.FileMode(0755)); err != nil { + return err + } + h.Log().Info("attempting to simulate SSH information read") file, err := os.Open(filename) defer file.Close() + defer os.RemoveAll("/home/created-by-falco-event-generator") return err }