github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-18 16:07:21 +00:00
Code Issues Projects Releases Wiki Activity

update: improve control and UX of ignored events

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
2023-04-27 08:09:17 +00:00
committed by poiana
parent 4d24a02ad6
commit 1f4919bfe1
6 changed files with 41 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
View File

@@ -17,6 +17,7 @@ limitations under the License.
#include <falco_engine.h>
#include <falco/app/app.h>
#include <falco/app/state.h>
#include <falco/app/actions/actions.h>
@@ -199,14 +200,14 @@ TEST(ConfigureInterestingSets, selection_not_allevents)
ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
// check that all IO syscalls have been erased from the selection
auto io_set = libsinsp::events::io_sc_set();
auto erased_sc_names = libsinsp::events::sc_set_to_event_names(io_set);
auto ignored_set = falco::app::ignored_sc_set();
auto erased_sc_names = libsinsp::events::sc_set_to_event_names(ignored_set);
ASSERT_NAMES_NOCONTAIN(selected_sc_names, erased_sc_names);
// check that final selected set is exactly sinsp state + ruleset
auto rule_set = s2.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
auto state_set = libsinsp::events::sinsp_state_sc_set();
for (const auto &erased : io_set)
for (const auto &erased : ignored_set)
{
rule_set.remove(erased);
state_set.remove(erased);
@@ -273,7 +274,7 @@ TEST(ConfigureInterestingSets, selection_generic_evts)
"socket", "bind", "close" // from sinsp state set (network, files)
});
ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(libsinsp::events::io_sc_set());
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
}
@@ -361,7 +362,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set)
"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "procexit"
});
ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(libsinsp::events::io_sc_set());
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
}
@@ -389,7 +390,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set_repair)
"bind", "socket", "clone3", "close", "setuid"
});
ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(libsinsp::events::io_sc_set());
auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
}
@@ -418,3 +419,13 @@ TEST(ConfigureInterestingSets, selection_empty_custom_base_set_repair)
ASSERT_EQ(s7.selected_sc_set, s7_state_set);
ASSERT_EQ(s7.selected_sc_set.size(), s7_state_set.size());
}
TEST(ConfigureInterestingSets, ignored_set_expected_size)
{
// unit test fence to make sure we don't have unexpected regressions
// in the ignored set, to be updated in the future
ASSERT_EQ(falco::app::ignored_sc_set().size(), 14);
// we don't expect to ignore any syscall in the default base set
ASSERT_EQ(falco::app::ignored_sc_set().intersect(libsinsp::events::sinsp_state_sc_set()).size(), 0);
}