github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-31 14:11:41 +00:00
Code Issues Projects Releases Wiki Activity

Simple script to list ignored syscalls

Browse Source
This commit is contained in:
Henri DF 2016-05-01 23:35:16 +00:00
parent c7648e01ee
commit 14c1e30c24
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
scripts/ignored-calls.sh Executable file
View File

@ -0,0 +1,16 @@
#!/bin/bash
cat ../sysdig/userspace/libscap/syscall_info_table.c | grep EF_DROP_FALCO | sed -e 's/.*\"\(.*\)\".*/\1/' | sort > ignored_syscall_info_table.txt
cat ../sysdig/driver/event_table.c | grep EF_DROP_FALCO | sed -e 's/[^\"]*\"\([^\"]*\)\".*/\1/' | sort | uniq > ignored_driver_event_table.txt
cat ../sysdig/userspace/libscap/event_table.c | grep EF_DROP_FALCO | sed -e 's/[^\"]*\"\([^\"]*\)\".*/\1/' | sort | uniq > ignored_userspace_event_table.txt
diff -up ignored_driver_event_table.txt ignored_userspace_event_table.txt
if [ $? -ne 0 ]; then
echo "Expected ignored_driver_event_table.txt and ignored_userspace_event_table.txt to have same calls"
fi
cat ignored_userspace_event_table.txt ignored_syscall_info_table.txt | sort | uniq | tr '\n' ', '