mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 11:29:26 +00:00
Address feedback from PR
- Instead of having a possibly null string pointer as the argument to enable_* and process_event, have wrapper versions that assume a default falco ruleset. The default ruleset name is a static member of the falco_engine class, and the default ruleset id is created/found in the constructor. - This makes the whole mechanism simple enough that it doesn't require seprarate testing, so remove the capability within falco to read a ruleset from the environment and remove automated tests that specify a ruleset. - Make pattern/tags/ruleset arguments to enable_* functions const. (I'll squash this down before I commit)
This commit is contained in:
@@ -23,8 +23,6 @@ class FalcoTest(Test):
|
||||
self.should_detect = self.params.get('detect', '*', default=False)
|
||||
self.trace_file = self.params.get('trace_file', '*')
|
||||
|
||||
self.env = {}
|
||||
|
||||
if not os.path.isabs(self.trace_file):
|
||||
self.trace_file = os.path.join(self.basedir, self.trace_file)
|
||||
|
||||
@@ -125,10 +123,6 @@ class FalcoTest(Test):
|
||||
if self.run_tags == '':
|
||||
self.run_tags=[]
|
||||
|
||||
self.ruleset = self.params.get('ruleset', '*', default='')
|
||||
if self.ruleset != '':
|
||||
self.env["FALCO_RULESET"] = self.ruleset
|
||||
|
||||
def check_rules_warnings(self, res):
|
||||
|
||||
found_warning = sets.Set()
|
||||
@@ -250,7 +244,7 @@ class FalcoTest(Test):
|
||||
for tag in self.run_tags:
|
||||
cmd += ' -t {}'.format(tag)
|
||||
|
||||
self.falco_proc = process.SubProcess(cmd, env=self.env)
|
||||
self.falco_proc = process.SubProcess(cmd)
|
||||
|
||||
res = self.falco_proc.run(timeout=180, sig=9)
|
||||
|
||||
|
@@ -483,75 +483,3 @@ trace_files: !mux
|
||||
- open_11: 1
|
||||
- open_12: 0
|
||||
- open_13: 0
|
||||
|
||||
# Trying one of the combinations with a ruleset specified. Should get same output and no errors.
|
||||
run_tags_c_ruleset:
|
||||
detect: True
|
||||
detect_level: WARNING
|
||||
rules_file:
|
||||
- rules/tagged_rules.yaml
|
||||
trace_file: trace_files/open-multiple-files.scap
|
||||
run_tags: [c]
|
||||
ruleset: my-ruleset
|
||||
detect_counts:
|
||||
- open_1: 0
|
||||
- open_2: 0
|
||||
- open_3: 1
|
||||
- open_4: 0
|
||||
- open_5: 1
|
||||
- open_6: 1
|
||||
- open_7: 1
|
||||
- open_8: 0
|
||||
- open_9: 1
|
||||
- open_10: 1
|
||||
- open_11: 0
|
||||
- open_12: 0
|
||||
- open_13: 0
|
||||
|
||||
# Disabling one rule with a ruleset specified. Should get that one rule missing and no errors.
|
||||
disabled_with_ruleset:
|
||||
detect: True
|
||||
detect_level: WARNING
|
||||
rules_file:
|
||||
- rules/tagged_rules.yaml
|
||||
trace_file: trace_files/open-multiple-files.scap
|
||||
disabled_rules:
|
||||
- "open_4"
|
||||
ruleset: my-ruleset
|
||||
detect_counts:
|
||||
- open_1: 1
|
||||
- open_2: 1
|
||||
- open_3: 1
|
||||
- open_4: 0
|
||||
- open_5: 1
|
||||
- open_6: 1
|
||||
- open_7: 1
|
||||
- open_8: 1
|
||||
- open_9: 1
|
||||
- open_10: 1
|
||||
- open_11: 1
|
||||
- open_12: 1
|
||||
- open_13: 1
|
||||
|
||||
# Enabling all rules with a ruleset specified. Should get all rules matching.
|
||||
default_with_ruleset:
|
||||
detect: True
|
||||
detect_level: WARNING
|
||||
rules_file:
|
||||
- rules/tagged_rules.yaml
|
||||
trace_file: trace_files/open-multiple-files.scap
|
||||
ruleset: my-ruleset
|
||||
detect_counts:
|
||||
- open_1: 1
|
||||
- open_2: 1
|
||||
- open_3: 1
|
||||
- open_4: 1
|
||||
- open_5: 1
|
||||
- open_6: 1
|
||||
- open_7: 1
|
||||
- open_8: 1
|
||||
- open_9: 1
|
||||
- open_10: 1
|
||||
- open_11: 1
|
||||
- open_12: 1
|
||||
- open_13: 1
|
||||
|
Reference in New Issue
Block a user