github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-09 02:29:36 +00:00
Code Issues Projects Releases Wiki Activity

Skip macros with unknown sources

Browse Source 
Also skip macros with unknown sources. This matters primarily for
macros related to plugins that have a distinct event source.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2022-03-01 16:47:00 -08:00
committed by poiana
parent ad42baed7a
commit 3fbc90e99e
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
userspace/engine/lua/rule_loader.lua
View File

@@ -460,6 +460,14 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end
valid = falco_rules.is_source_valid(rules_mgr, v['source'])
if valid == false then
msg = "Macro "..v['macro']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_object
end
if state.macros_by_name[v['macro']] == nil then
state.ordered_macro_names[#state.ordered_macro_names+1] = v['macro']
end