From 3e0f0d3692d764311dcb7832d57f268000cf8383 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Mon, 27 Mar 2023 05:10:38 +0000 Subject: [PATCH] cleanup(unit_tests): revert some test extensions in interim Signed-off-by: Melissa Kilby --- .../test_configure_interesting_sets.cpp | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp b/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp index fc00a546..89a20713 100644 --- a/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp +++ b/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp @@ -47,7 +47,7 @@ static std::string s_sample_ruleset = "sample-ruleset"; static std::string s_sample_source = falco_common::syscall_source; static strset_t s_sample_filters = { - "evt.type=connect or evt.type=accept or evt.type=accept4 or evt.type=umount2", + "evt.type=connect or evt.type=accept", "evt.type in (open, ptrace, mmap, execve, read, container)", "evt.type in (open, execve, mprotect) and not evt.type=mprotect"}; @@ -99,7 +99,7 @@ TEST(ConfigureInterestingSets, engine_codes_syscalls_set) auto rules_event_set = engine->event_codes_for_ruleset(s_sample_source); auto rules_event_names = libsinsp::events::event_set_to_names(rules_event_set); ASSERT_NAMES_EQ(rules_event_names, strset_t({ - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container"})); + "connect", "accept", "open", "ptrace", "mmap", "execve", "read", "container"})); // test if sc code names were extracted from each rule in test ruleset. // note, this is not supposed to contain "container", as that's an event @@ -107,7 +107,7 @@ TEST(ConfigureInterestingSets, engine_codes_syscalls_set) auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source); auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set); ASSERT_NAMES_EQ(rules_sc_names, strset_t({ - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read"})); + "connect", "accept", "accept4", "open", "ptrace", "mmap", "execve", "read"})); } TEST(ConfigureInterestingSets, preconditions_postconditions) @@ -158,7 +158,7 @@ TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set) // This is a good example of information loss from ppm_event_code <-> ppm_sc_code. auto generic_names = libsinsp::events::event_set_to_names({ppm_event_code::PPME_GENERIC_E}); auto expected_names = strset_t({ - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container", // ruleset + "connect", "accept", "open", "ptrace", "mmap", "execve", "read", "container", // ruleset "procexit", "switch", "pluginevent"}); // from non-syscall event filters expected_names.insert(generic_names.begin(), generic_names.end()); ASSERT_NAMES_EQ(rules_event_names, expected_names); @@ -166,7 +166,7 @@ TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set) auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source); auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set); ASSERT_NAMES_EQ(rules_sc_names, strset_t({ - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", + "connect", "accept", "accept4", "open", "ptrace", "mmap", "execve", "read", "syncfs", "fanotify_init", // from generic event filters })); } @@ -189,7 +189,7 @@ TEST(ConfigureInterestingSets, selection_not_allevents) auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set); auto expected_sc_names = strset_t({ // note: we expect the "read" syscall to have been erased - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", // from ruleset + "connect", "accept", "open", "ptrace", "mmap", "execve", // from ruleset "clone", "clone3", "fork", "vfork", // from sinsp state set (spawned_process) "socket", "bind", "close" // from sinsp state set (network, files) }); @@ -232,7 +232,7 @@ TEST(ConfigureInterestingSets, selection_allevents) auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set); auto expected_sc_names = strset_t({ // note: we expect the "read" syscall to not be erased - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", // from ruleset + "connect", "accept", "open", "ptrace", "mmap", "execve", "read", // from ruleset "clone", "clone3", "fork", "vfork", // from sinsp state set (spawned_process) "socket", "bind", "close" // from sinsp state set (network, files) }); @@ -264,7 +264,7 @@ TEST(ConfigureInterestingSets, selection_generic_evts) auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set); auto expected_sc_names = strset_t({ // note: we expect the "read" syscall to not be erased - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", // from ruleset + "connect", "accept", "open", "ptrace", "mmap", "execve", // from ruleset "syncfs", "fanotify_init", // from ruleset (generic events) "clone", "clone3", "fork", "vfork", // from sinsp state set (spawned_process) "socket", "bind", "close" // from sinsp state set (network, files) @@ -288,6 +288,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set) auto default_base_set = libsinsp::events::sinsp_state_sc_set(); // non-empty custom base set (both positive and negative) + s.config->m_base_syscalls_repair = false; s.config->m_base_syscalls_custom_set = {"syncfs", "!accept"}; auto result = falco::app::actions::configure_interesting_sets(s); ASSERT_TRUE(result.success); @@ -305,6 +306,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set) ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names); // non-empty custom base set (both positive and negative with collision) + s.config->m_base_syscalls_repair = false; s.config->m_base_syscalls_custom_set = {"syncfs", "accept", "!accept"}; result = falco::app::actions::configure_interesting_sets(s); ASSERT_TRUE(result.success); @@ -372,7 +374,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set_repair) auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set); auto expected_sc_names = strset_t({ // note: expecting syscalls from mock rules and `sinsp_repair_state_sc_set` enforced syscalls - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "sched_process_exit", \ + "connect", "accept", "open", "ptrace", "mmap", "execve", "sched_process_exit", \ "bind", "socket", "clone3", "setuid" }); ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);