From 40ecf547ddc532be62e146495bd53ad69e905e46 Mon Sep 17 00:00:00 2001
From: Hi120ki <12624257+hi120ki@users.noreply.github.com>
Date: Thu, 15 Sep 2022 09:56:20 +0900
Subject: [PATCH] put open_read in the beginning of the rule

Signed-off-by: Hi120ki <12624257+hi120ki@users.noreply.github.com>
---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 93b70426971..dd663058f5e 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -3209,7 +3209,7 @@
 - rule: Read environment variable from /proc files
   desc: An attempt to read process environment variables from /proc files
   condition: >
-    container and open_read and (fd.name glob /proc/*/environ)
+    open_read and container and (fd.name glob /proc/*/environ)
     and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files)
   output: >
     Environment variables were retrieved from /proc files (user=%user.name user_loginuid=%user.loginuid program=%proc.name