Update and rename contact_ec2_instance_metadata_from_container.go to …

…contact_ec2_instance_metadata_service_from_container.go

Signed-off-by: Kapil Sharma <[email protected]>

events/syscall/contact_ec2_instance_metadata_from_container.go → events/syscall/contact_ec2_instance_metadata_service_from_container.go

@@ -14,26 +14,28 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-
 package syscall
 
 import (
-    "net"
-
+    "os/exec"
     "github.com/falcosecurity/event-generator/events"
 )
 
-var _ = events.Register(ContactEC2InstanceMetadataFromContainer)
+var _ = events.Register(
+    ContactEC2InstanceMetadataServiceFromContainer,
+    events.WithDisabled(), // this rule is not included in falco_rules.yaml (stable rules), so disable the action
+)
 
-func ContactEC2InstanceMetadataFromContainer(h events.Helper) error {
+func ContactEC2InstanceMetadataServiceFromContainer(h events.Helper) error {
     if h.InContainer() {
-        conn, err := net.Dial("tcp", "169.254.169.254:80")
-        if err != nil {
+
+        cmd := exec.Command("timeout", "1s", "nc", "169.254.169.254", "80")
+
+        if err := cmd.Run(); err != nil {
             return err
-		}
+        }
 
         h.Log().Infof("Outbound connection to EC2 instance metadata service")
-        defer conn.Close()    
 	}
     return nil
-}
+}