Falco’s detection of container escapes isn’t about a magical "escape" event, but rather the observation of unexpected system calls originating from within a container that indicate activity outside its normal, isolated boundaries.
Let’s see Falco in action. Imagine a simple web server running in a container. Normally, it just listens on a port and maybe writes to a log file. If it suddenly tries to open a file in /etc, or exec a shell outside its own filesystem, that’s a red flag.
Here’s a basic Falco rule that might catch such anomalies:
- rule: Suspicious container activity
desc: Detects unexpected system calls from within a container.
condition: container and evt.type in (open, execve) and fd.name startswith "/" and fd.name not in ("/proc/sys/kernel/random/boot_id", "/proc/self/mountinfo", "/proc/mounts", "/proc/meminfo", "/proc/stat", "/proc/uptime", "/proc/loadavg", "/proc/cmdline", "/proc/version", "/proc/filesystems", "/proc/consoles", "/proc/tty", "/proc/bus/pci/devices", "/proc/bus/input/devices", "/proc/cpuinfo", "/proc/interrupts", "/proc/net/dev", "/proc/net/softnet_stat", "/proc/net/snmp", "/proc/net/tcp", "/proc/net/udp", "/proc/net/raw", "/proc/net/unix", "/proc/net/route", "/proc/net/ip_tables_names", "/proc/net/ip_tables_matches", "/proc/net/ip_tables_targets", "/proc/net/ipt_entries", "/proc/net/ip6_tables_names", "/proc/net/ip6_tables_matches", "/proc/net/ip6_tables_targets", "/proc/net/ip6_tables_entries", "/proc/net/nf_conntrack", "/proc/net/xt_conntrack", "/proc/net/ip_conntrack", "/proc/net/ip6_conntrack", "/proc/sys/kernel/pid_max", "/proc/sys/vm/overcommit_memory", "/proc/sys/vm/overcommit_ratio", "/proc/sys/vm/panic_on_oom", "/proc/sys/vm/oom_kill_allocating_task", "/proc/sys/vm/oom_dump_tasks", "/proc/sys/vm/admin_reserve_kbytes", "/proc/sys/vm/user_reserve_kbytes", "/proc/sys/vm/kernel_reserve_kbytes", "/proc/sys/vm/min_free_kbytes", "/proc/sys/vm/extra_free_kbytes", "/proc/sys/vm/drop_caches", "/proc/sys/vm/swappiness", "/proc/sys/vm/vfs_cache_pressure", "/proc/sys/vm/page-cluster", "/proc/sys/vm/dirty_background_ratio", "/proc/sys/vm/dirty_ratio", "/proc/sys/vm/dirty_expire_centisecs", "/proc/sys/vm/dirty_writeback_centisecs", "/proc/sys/vm/dirty_writeback_jobs", "/proc/sys/vm/dirty_background_bytes", "/proc/sys/vm/dirty_bytes", "/proc/sys/vm/nr_hugepages", "/proc/sys/vm/nr_hugepages_1MB", "/proc/sys/vm/nr_hugepages_2MB", "/proc/sys/vm/nr_hugepages_1GB", "/proc/sys/vm/hugepages_treat_as_movable", "/proc/sys/vm/hugetlb_shm_group", "/proc/sys/net/ipv4/ip_forward", "/proc/sys/net/ipv6/conf/all/forwarding", "/proc/sys/kernel/hostname", "/proc/self/cgroup", "/proc/self/status", "/proc/self/mountinfo", "/proc/self/mounts", "/proc/self/environ", "/proc/self/exe", "/proc/self/fd", "/proc/self/maps", "/proc/self/smaps", "/proc/self/stat", "/proc/self/statm", "/proc/self/task/%d/cmdline", "/proc/self/task/%d/environ", "/proc/self/task/%d/fd", "/proc/self/task/%d/maps", "/proc/self/task/%d/smaps", "/proc/self/task/%d/stat", "/proc/self/task/%d/statm", "/proc/self/task/%d/status", "/proc/self/task/%d/cwd", "/proc/self/task/%d/root", "/proc/self/task/%d/wchan", "/proc/self/timers", "/proc/timer_list", "/proc/timer_stats", "/proc/timer_state", "/proc/timer_summary", "/proc/timer_events", "/proc/timer_intervals", "/proc/timer_deadlines", "/proc/timer_accuracy", "/proc/timer_precision", "/proc/timer_resolution", "/proc/timer_granularity", "/proc/timer_frequency", "/proc/timer_period", "/proc/timer_duration", "/proc/timer_length", "/proc/timer_count", "/proc/timer_number", "/proc/timer_index", "/proc/timer_id", "/proc/timer_name", "/proc/timer_path", "/proc/timer_file", "/proc/timer_data", "/proc/timer_value", "/proc/timer_state_dump", "/proc/timer_state_log", "/proc/timer_state_file", "/proc/timer_state_path", "/proc/timer_state_count", "/proc/timer_state_number", "/proc/timer_state_index", "/proc/timer_state_id", "/proc/timer_state_name", "/proc/timer_state_value", "/proc/timer_state_data", "/proc/timer_state_dump_file", "/proc/timer_state_log_file", "/proc/timer_state_path_file", "/proc/timer_state_count_file", "/proc/timer_state_number_file", "/proc/timer_state_index_file", "/proc/timer_state_id_file", "/proc/timer_state_name_file", "/proc/timer_state_value_file", "/proc/timer_state_data_file", "/proc/timer_state_dump_path", "/proc/timer_state_log_path", "/proc/timer_state_path_path", "/proc/timer_state_count_path", "/proc/timer_state_number_path", "/proc/timer_state_index_path", "/proc/timer_state_id_path", "/proc/timer_state_name_path", "/proc/timer_state_value_path", "/proc/timer_state_data_path", "/proc/timer_state_dump_count", "/proc/timer_state_log_count", "/proc/timer_state_path_count", "/proc/timer_state_count_count", "/proc/timer_state_number_count", "/proc/timer_state_index_count", "/proc/timer_state_id_count", "/proc/timer_state_name_count", "/proc/timer_state_value_count", "/proc/timer_state_data_count", "/proc/timer_state_dump_number", "/proc/timer_state_log_number", "/proc/timer_state_path_number", "/proc/timer_state_count_number", "/proc/timer_state_number_number", "/proc/timer_state_index_number", "/proc/timer_state_id_number", "/proc/timer_state_name_number", "/proc/timer_state_value_number", "/proc/timer_state_data_number", "/proc/timer_state_dump_index", "/proc/timer_state_log_index", "/proc/timer_state_path_index", "/proc/timer_state_count_index", "/proc/timer_state_number_index", "/proc/timer_state_index_index", "/proc/timer_state_id_index", "/proc/timer_state_name_index", "/proc/timer_state_value_index", "/proc/timer_state_data_index", "/proc/timer_state_dump_id", "/proc/timer_state_log_id", "/proc/timer_state_path_id", "/proc/timer_state_count_id", "/proc/timer_state_number_id", "/proc/timer_state_index_id", "/proc/timer_state_id_id", "/proc/timer_state_name_id", "/proc/timer_state_value_id", "/proc/timer_state_data_id", "/proc/timer_state_dump_name", "/proc/timer_state_log_name", "/proc/timer_state_path_name", "/proc/timer_state_count_name", "/proc/timer_state_number_name", "/proc/timer_state_index_name", "/proc/timer_state_id_name", "/proc/timer_state_name_name", "/proc/timer_state_value_name", "/proc/timer_state_data_name", "/proc/timer_state_dump_value", "/proc/timer_state_log_value", "/proc/timer_state_path_value", "/proc/timer_state_count_value", "/proc/timer_state_number_value", "/proc/timer_state_index_value", "/proc/timer_state_id_value", "/proc/timer_state_name_value", "/proc/timer_state_value_value", "/proc/timer_state_data_value", "/proc/timer_state_dump_data", "/proc/timer_state_log_data", "/proc/timer_state_path_data", "/proc/timer_state_count_data", "/proc/timer_state_number_data", "/proc/timer_state_index_data", "/proc/timer_state_id_data", "/proc/timer_state_name_data", "/proc/timer_state_value_data", "/proc/timer_state_data_data", "/proc/sys/kernel/random/entropy_avail", "/proc/sys/kernel/random/urandom", "/proc/sys/kernel/random/poolsize", "/proc/sys/kernel/random/read_wakeup_granularity", "/proc/sys/kernel/random/write_wakeup_granularity", "/proc/sys/kernel/random/uuid", "/proc/sys/kernel/random/boot_id", "/proc/sys/kernel/random/cpu_entropy", "/proc/sys/kernel/random/vm_entropy", "/proc/sys/kernel/random/rng_seed", "/proc/sys/kernel/random/rng_state", "/proc/sys/kernel/random/rng_test", "/proc/sys/kernel/random/rng_dump", "/proc/sys/kernel/random/rng_config", "/proc/sys/kernel/random/rng_status", "/proc/sys/kernel/random/rng_control", "/proc/sys/kernel/random/rng_enable", "/proc/sys/kernel/random/rng_disable", "/proc/sys/kernel/random/rng_reset", "/proc/sys/kernel/random/rng_init", "/proc/sys/kernel/random/rng_exit", "/proc/sys/kernel/random/rng_start", "/proc/sys/kernel/random/rng_stop", "/proc/sys/kernel/random/rng_pause", "/proc/sys/kernel/random/rng_resume", "/proc/sys/kernel/random/rng_set", "/proc/sys/kernel/random/rng_get", "/proc/sys/kernel/random/rng_show", "/proc/sys/kernel/random/rng_list", "/proc/sys/kernel/random/rng_info", "/proc/sys/kernel/random/rng_debug", "/proc/sys/kernel/random/rng_trace", "/proc/sys/kernel/random/rng_log", "/proc/sys/kernel/random/rng_error", "/proc/sys/kernel/random/rng_warning", "/proc/sys/kernel/random/rng_alert", "/proc/sys/kernel/random/rng_critical", "/proc/sys/kernel/random/rng_emergency", "/proc/sys/kernel/random/rng_panic", "/proc/sys/kernel/random/rng_fatal", "/proc/sys/kernel/random/rng_abort", "/proc/sys/kernel/random/rng_fail", "/proc/sys/kernel/random/rng_pass", "/proc/sys/kernel/random/rng_fail_test", "/proc/sys/kernel/random/rng_pass_test", "/proc/sys/kernel/random/rng_test_fail", "/proc/sys/kernel/random/rng_test_pass", "/proc/sys/kernel/random/rng_fail_test_run", "/proc/sys/kernel/random/rng_pass_test_run", "/proc/sys/kernel/random/rng_test_fail_run", "/proc/sys/kernel/random/rng_test_pass_run", "/proc/sys/kernel/random/rng_fail_test_stop", "/proc/sys/kernel/random/rng_pass_test_stop", "/proc/sys/kernel/random/rng_test_fail_stop", "/proc/sys/kernel/random/rng_test_pass_stop", "/proc/sys/kernel/random/rng_fail_test_reset", "/proc/sys/kernel/random/rng_pass_test_reset", "/proc/sys/kernel/random/rng_test_fail_reset", "/proc/sys/kernel/random/rng_test_pass_reset", "/proc/sys/kernel/random/rng_fail_test_status", "/proc/sys/kernel/random/rng_pass_test_status", "/proc/sys/kernel/random/rng_test_fail_status", "/proc/sys/kernel/random/rng_test_pass_status", "/proc/sys/kernel/random/rng_fail_test_info", "/proc/sys/kernel/random/rng_pass_test_info", "/proc/sys/kernel/random/rng_test_fail_info", "/proc/sys/kernel/random/rng_test_pass_info", "/proc/sys/kernel/random/rng_fail_test_debug", "/proc/sys/kernel/random/rng_pass_test_debug", "/proc/sys/kernel/random/rng_test_fail_debug", "/proc/sys/kernel/random/rng_test_pass_debug", "/proc/sys/kernel/random/rng_fail_test_trace", "/proc/sys/kernel/random/rng_pass_test_trace", "/proc/sys/kernel/random/rng_test_fail_trace", "/proc/sys/kernel/random/rng_test_pass_trace", "/proc/sys/kernel/random/rng_fail_test_log", "/proc/sys/kernel/random/rng_pass_test_log", "/proc/sys/kernel/random/rng_test_fail_log", "/proc/sys/kernel/random/rng_test_pass_log", "/proc/sys/kernel/random/rng_fail_test_error", "/proc/sys/kernel/random/rng_pass_test_error", "/proc/sys/kernel/random/rng_test_fail_error", "/proc/sys/kernel/random/rng_test_pass_error", "/proc/sys/kernel/random/rng_fail_test_warning", "/proc/sys/kernel/random/rng_pass_test_warning", "/proc/sys/kernel/random/rng_test_fail_warning", "/proc/sys/kernel/random/rng_test_pass_warning", "/proc/sys/kernel/random/rng_fail_test_alert", "/proc/sys/kernel/random/rng_pass_test_alert", "/proc/sys/kernel/random/rng_test_fail_alert", "/proc/sys/kernel/random/rng_test_pass_alert", "/proc/sys/kernel/random/rng_fail_test_critical", "/proc/sys/kernel/random/rng_pass_test_critical", "/proc/sys/kernel/random/rng_test_fail_critical", "/proc/sys/kernel/random/rng_test_pass_critical", "/proc/sys/kernel/random/rng_fail_test_emergency", "/proc/sys/kernel/random/rng_pass_test_emergency", "/proc/sys/kernel/random/rng_test_fail_emergency", "/proc/sys/kernel/random/rng_test_pass_emergency", "/proc/sys/kernel/random/rng_fail_test_panic", "/proc/sys/kernel/random/rng_pass_test_panic", "/proc/sys/kernel/random/rng_test_fail_panic", "/proc/sys/kernel/random/rng_test_pass_panic", "/proc/sys/kernel/random/rng_fail_test_fatal", "/proc/sys/kernel/random/rng_pass_test_fatal", "/proc/sys/kernel/random/rng_test_fail_fatal", "/proc/sys/kernel/random/rng_test_pass_fatal", "/proc/sys/kernel/random/rng_fail_test_abort", "/proc/sys/kernel/random/rng_pass_test_abort", "/proc/sys/kernel/random/rng_test_fail_abort", "/proc/sys/kernel/random/rng_test_pass_abort", "/proc/sys/kernel/random/rng_fail_test_fail", "/proc/sys/kernel/random/rng_pass_test_fail", "/proc/sys/kernel/random/rng_test_fail_fail", "/proc/sys/kernel/random/rng_test_pass_fail", "/proc/sys/kernel/random/rng_fail_test_pass", "/proc/sys/kernel/random/rng_pass_test_pass", "/proc/sys/kernel/random/rng_test_fail_pass", "/proc/sys/kernel/random/rng_test_pass_pass", "/proc/sys/kernel/random/rng_fail_test_seed", "/proc/sys/kernel/random/rng_pass_test_seed", "/proc/sys/kernel/random/rng_test_fail_seed", "/proc/sys/kernel/random/rng_test_pass_seed", "/proc/sys/kernel/random/rng_fail_test_state", "/proc/sys/kernel/random/rng_pass_test_state", "/proc/sys/kernel/random/rng_test_fail_state", "/proc/sys/kernel/random/rng_test_pass_state", "/proc/sys/kernel/random/rng_fail_test_test", "/proc/sys/kernel/random/rng_pass_test_test", "/proc/sys/kernel/random/rng_test_fail_test", "/proc/sys/kernel/random/rng_test_pass_test", "/proc/sys/kernel/random/rng_fail_test_dump", "/proc/sys/kernel/random/rng_pass_test_dump", "/proc/sys/kernel/random/rng_test_fail_dump", "/proc/sys/kernel/random/rng_test_pass_dump", "/proc/sys/kernel/random/rng_fail_test_config", "/proc/sys/kernel/random/rng_pass_test_config", "/proc/sys/kernel/random/rng_test_fail_config", "/proc/sys/kernel/random/rng_test_pass_config", "/proc/sys/kernel/random/rng_fail_test_status", "/proc/sys/kernel/random/rng_pass_test_status", "/proc/sys/kernel/random/rng_test_fail_status", "/proc/sys/kernel/random/rng_test_pass_status", "/proc/sys/kernel/random/rng_fail_test_control", "/proc/sys/kernel/random/rng_pass_test_control", "/proc/sys/kernel/random/rng_test_fail_control", "/proc/sys/kernel/random/rng_test_pass_control", "/proc/sys/kernel/random/rng_fail_test_enable", "/proc/sys/kernel/random/rng_pass_test_enable", "/proc/sys/kernel/random/rng_test_fail_enable", "/proc/sys/kernel/random/rng_test_pass_enable", "/proc/sys/kernel/random/rng_fail_test_disable", "/proc/sys/kernel/random/rng_pass_test_disable", "/proc/sys/kernel/random/rng_test_fail_disable", "/proc/sys/kernel/random/rng_test_pass_disable", "/proc/sys/kernel/random/rng_fail_test_reset", "/proc/sys/kernel/random/rng_pass_test_reset", "/proc/sys/kernel/random/rng_test_fail_reset", "/proc/sys/kernel/random/rng_test_pass_reset", "/proc/sys/kernel/random/rng_fail_test_init", "/proc/sys/kernel/random/rng_pass_test_init", "/proc/sys/kernel/random/rng_test_fail_init", "/proc/sys/kernel/random/rng_test_pass_init", "/proc/sys/kernel/random/rng_fail_test_exit", "/proc/sys/kernel/random/rng_pass_test_exit", "/proc/sys/kernel/random/rng_test_fail_exit", "/proc/sys/kernel/random/rng_test_pass_exit", "/proc/sys/kernel/random/rng_fail_test_start", "/proc/sys/kernel/random/rng_pass_test_start", "/proc/sys/kernel/random/rng_test_fail_start", "/proc/sys/kernel/random/rng_test_pass_start", "/proc/sys/kernel/random/rng_fail_test_stop", "/proc/sys/kernel/random/rng_pass_test_stop", "/proc/sys/kernel/random/rng_test_fail_stop", "/proc/sys/kernel/random/rng_test_pass_stop", "/proc/sys/kernel/random/rng_fail_test_pause", "/proc/sys/kernel/random/rng_pass_test_pause", "/proc/sys/kernel/random/rng_test_fail_pause", "/proc/sys/kernel/random/rng_test_pass_pause", "/proc/sys/kernel/random/rng_fail_test_resume", "/proc/sys/kernel/random/rng_pass_test_resume", "/proc/sys/kernel/random/rng_test_fail_resume", "/proc/sys/kernel/random/rng_test_pass_resume", "/proc/sys/kernel/random/rng_fail_test_set", "/proc/sys/kernel/random/rng_pass_test_set", "/proc/sys/kernel/random/rng_test_fail_set", "/proc/sys/kernel/random/rng_test_pass_set", "/proc/sys/kernel/random/rng_fail_test_get", "/proc/sys/kernel/random/rng_pass_test_get", "/proc/sys/kernel/random/rng_test_fail_get", "/proc/sys/kernel/random/rng_test_pass_get", "/proc/sys/kernel/random/rng_fail_test_show", "/proc/sys/kernel/random/rng_pass_test_show", "/proc/sys/kernel/random/rng_test_fail_show", "/proc/sys/kernel/random/rng_test_pass_show", "/proc/sys/kernel/random/rng_fail_test_list", "/proc/sys/kernel/random/rng_pass_test_list", "/proc/sys/kernel/random/rng_test_fail_list", "/proc/sys/kernel/random/rng_test_pass_list", "/proc/sys/kernel/random/rng_fail_test_info", "/proc/sys/kernel/random/rng_pass_test_info", "/proc/sys/kernel/random/rng_test_fail_info", "/proc/sys/kernel/random/rng_test_pass_info", "/proc/sys/kernel/random/rng_fail_test_debug", "/proc/sys/kernel/random/rng_pass_test_debug", "/proc/sys/kernel/random/rng_test_fail_debug", "/proc/sys/kernel/random/rng_test_pass_debug", "/proc/sys/kernel/random/rng_fail_test_trace", "/proc/sys/kernel/random/rng_pass_test_trace", "/proc/sys/kernel/random/rng_test_fail_trace", "/proc/sys/kernel/random/rng_test_pass_trace", "/proc/sys/kernel/random/rng_fail_test_log", "/proc/sys/kernel/random/rng_pass_test_log", "/proc/sys/kernel/random/rng_test_fail_log", "/proc/sys/kernel/random/rng_test_pass_log", "/proc/sys/kernel/random/rng_fail_test_error", "/proc/sys/kernel/random/rng_pass_test_error", "/proc/sys/kernel/random/rng_test_fail_error", "/proc/sys/kernel/random/rng_test_pass_error", "/proc/sys/kernel/random/rng_fail_test_warning", "/proc/sys/kernel/random/rng_pass_test_warning", "/proc/sys/kernel/random/rng_test_fail_warning", "/proc/sys/kernel/random/rng_test_pass_warning", "/proc/sys/kernel/random/rng_fail_test_alert", "/proc/sys/kernel/random/rng_pass_test_alert", "/proc/sys/kernel/random/rng_test_fail_alert", "/proc/sys/kernel/random/rng_test_pass_alert", "/proc/sys/kernel/random/rng_fail_test_critical", "/proc/sys/kernel/random/rng_pass_test_critical", "/proc/sys/kernel/random/rng_test_fail_critical", "/proc/sys/kernel/random/rng_test_pass_critical", "/proc/sys/kernel/random/rng_fail_test_emergency", "/proc/sys/kernel/random/rng_pass_test_emergency", "/proc/sys/kernel/random/rng_test_fail_emergency", "/proc/sys/kernel/random/rng_test_pass_emergency", "/proc/sys/kernel/random/rng_fail_test_panic", "/proc/sys/kernel/random/rng_pass_test_panic", "/proc/sys/kernel/random/rng_test_fail_panic", "/proc/sys/kernel/random/rng_test_pass_panic", "/proc/sys/kernel/random/rng_fail_test_fatal", "/proc/sys/kernel/random/rng_pass_test_fatal", "/proc/sys/kernel/random/rng_test_fail_fatal", "/proc/sys/kernel/random/rng_test_pass_fatal", "/proc/sys/kernel/random/rng_fail_test_abort", "/proc/sys/kernel/random/rng_pass_test_abort", "/proc/sys/kernel/random/rng_test_fail_abort", "/proc/sys/kernel/random/rng_test_pass_abort", "/proc/sys/kernel/random/rng_fail_test_fail", "/proc/sys/kernel/random/rng_pass_test_fail", "/proc/sys/kernel/random/rng_test_fail_fail", "/proc/sys/kernel/random/rng_test_pass_fail", "/proc/sys/kernel/random/rng_fail_test_pass", "/proc/sys/kernel/random/rng_pass_test_pass", "/proc/sys/kernel/random/rng_test_fail_pass", "/proc/sys/kernel/random/rng_test_pass_pass", "/proc/sys/kernel/random/rng_fail_test_seed", "/proc/sys/kernel/random/rng_pass_test_seed", "/proc/sys/kernel/random/rng_test_fail_seed", "/proc/sys/kernel/random/rng_test_pass_seed", "/proc/sys/kernel/random/rng_fail_test_state", "/proc/sys/kernel/random/rng_pass_test_state", "/proc/sys/kernel/random/rng_test_fail_state", "/proc/sys/kernel/random/rng_test_pass_state", "/proc/sys/kernel/random/rng_fail_test_test", "/proc/sys/kernel/random/rng_pass_test_test", "/proc/sys/kernel/random/rng_test_fail_test", "/proc/sys/kernel/random/rng_test_pass_test", "/proc/sys/kernel/random/rng_fail_test_dump", "/proc/sys/kernel/random/rng_pass_test_dump", "/proc/sys/kernel/random/rng_test_fail_dump", "/proc/sys/kernel/random/rng_test_pass_dump", "/proc/sys/kernel/random/rng_fail_test_config", "/proc/sys/kernel/random/rng_pass_test_config", "/proc/sys/kernel/random/rng_test_fail_config", "/proc/sys/kernel/random/rng_test_pass_config", "/proc/sys/kernel/random/rng_fail_test_status", "/proc/sys/kernel/random/rng_pass_test_status", "/proc/sys/kernel/random/rng_test_fail_status", "/proc/sys/kernel/random/rng_test_pass_status", "/proc/sys/kernel/random/rng_fail_test_control", "/proc/sys/kernel/random/rng_pass_test_control", "/proc/sys/kernel/random/rng_test_fail_control", "/proc/sys/kernel/random/rng_test_pass_control", "/proc/sys/kernel/random/rng_fail_test_enable", "/proc/sys/kernel/random/rng_pass_test_enable", "/proc/sys/kernel/random/rng_test_fail_enable", "/proc/sys/kernel/random/rng_test_pass_enable", "/proc/sys/kernel/random/rng_fail_test_disable", "/proc/sys/kernel/random/rng_pass_test_disable", "/proc/sys/kernel/random/rng_test_fail_disable", "/proc/sys/kernel/random/rng_test_pass_disable", "/proc/sys/kernel/random/rng_fail_test_reset", "/proc/sys/kernel/random/rng_pass_test_reset", "/proc/sys/kernel/random/rng_test_fail_reset", "/proc/sys/kernel/random/rng_test_pass_reset", "/proc/sys/kernel/random/rng_fail_test_init", "/proc/sys/kernel/random/rng_pass_test_init", "/proc/sys/kernel/random/rng_test_fail_init", "/proc/sys/kernel/random/rng_test_pass_init", "/proc/sys/kernel/random/rng_fail_test_exit", "/proc/sys/kernel/random/rng_pass_test_exit", "/proc/sys/kernel/random/rng_test_fail_exit", "/proc/sys/kernel/random/rng_test_pass_exit", "/proc/sys/kernel/random/rng_fail_test_start", "/proc/sys/kernel/random/rng_pass_test_start", "/proc/sys/kernel/random/rng_test_fail_start", "/proc/sys/kernel/random/rng_test_pass_start", "/proc/sys/kernel/random/rng_fail_test_stop", "/proc/sys/kernel/random/rng_pass_test_stop", "/proc/sys/kernel/random/rng_test_fail_stop", "/proc/sys/kernel/random/rng_test_pass_stop", "/proc/sys/kernel/random/rng_fail_test_pause", "/proc/sys/kernel/random/rng_pass_test_pause", "/proc/sys/kernel/random/rng_test_fail_pause", "/proc/sys/kernel/random/rng_test_pass_pause", "/proc/sys/kernel/random/rng_fail_test_resume", "/proc/sys/kernel/random/rng_pass_test_resume", "/proc/sys/kernel/random/rng_test_fail_resume", "/proc/sys/kernel/random/rng_test_pass_resume", "/proc/sys/kernel/random/rng_fail_test_set", "/proc/sys/kernel/random/rng_pass_test_set", "/proc/sys/kernel/random/rng_test_fail_set", "/proc/sys/kernel/random/rng_test_pass_set", "/proc/sys/kernel/random/rng_fail_test_get", "/proc/sys/kernel/random/rng_pass_test_get", "/proc/sys/kernel/random/rng_test_fail_get", "/proc/sys/kernel/random/rng_test_pass_get", "/proc/sys/kernel/random/rng_fail_test_show", "/proc/sys/kernel/random/rng_pass_test_show", "/proc/sys/kernel/random/rng_test_fail_show", "/proc/sys/kernel/random/rng_test_pass_show", "/proc/sys/kernel/random/rng_fail_test_list", "/proc/sys/kernel/random/rng_pass_test_list", "/proc/sys/kernel/random/rng_test_fail_list", "/proc/sys/kernel/random/rng_test_pass_list", "/proc/sys/kernel/random/rng_fail_test_info", "/proc/sys/kernel/random/rng_pass_test_info", "/proc/sys/kernel/random/rng_test_fail_info", "/proc/sys/kernel/random/rng_test_pass_info", "/proc/sys/kernel/random/rng_fail_test_debug", "/proc/sys/kernel/random/rng_pass_test_debug", "/proc/sys/kernel/random/rng_test_fail_debug", "/proc/sys/kernel/random/rng_test_pass_debug", "/proc/sys/kernel/random/rng_fail_test_trace", "/proc/sys/kernel/random/rng_pass_test_trace", "/proc/sys/kernel/random/rng_test_fail_trace", "/proc/sys/kernel/random/rng_test_pass_trace", "/proc/sys/kernel/random/rng_fail_test_log", "/proc/sys/kernel/random/rng_pass_test_log", "/proc/sys/kernel/random/rng_test_fail_log", "/proc/sys/kernel/random/rng_test_pass_log", "/proc/sys/kernel/random/rng_fail_test_error", "/proc/sys/kernel/random/rng_pass_test