diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp index dc8673b7..9b47f363 100644 --- a/userspace/engine/falco_engine.cpp +++ b/userspace/engine/falco_engine.cpp @@ -206,17 +206,17 @@ void falco_engine::load_rules_file(const string &rules_filename, bool verbose, b load_rules(rules_content, verbose, all_events, required_engine_version); } -void falco_engine::enable_rule(const string &pattern, bool enabled, const string &ruleset) +void falco_engine::enable_rule(const string &substring, bool enabled, const string &ruleset) { uint16_t ruleset_id = find_ruleset_id(ruleset); - m_sinsp_rules->enable(pattern, enabled, ruleset_id); - m_k8s_audit_rules->enable(pattern, enabled, ruleset_id); + m_sinsp_rules->enable(substring, enabled, ruleset_id); + m_k8s_audit_rules->enable(substring, enabled, ruleset_id); } -void falco_engine::enable_rule(const string &pattern, bool enabled) +void falco_engine::enable_rule(const string &substring, bool enabled) { - enable_rule(pattern, enabled, m_default_ruleset); + enable_rule(substring, enabled, m_default_ruleset); } void falco_engine::enable_rule_by_tag(const set &tags, bool enabled, const string &ruleset) diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h index d77b83eb..de7da082 100644 --- a/userspace/engine/falco_engine.h +++ b/userspace/engine/falco_engine.h @@ -76,16 +76,17 @@ public: void load_rules(const std::string &rules_content, bool verbose, bool all_events, uint64_t &required_engine_version); // - // Enable/Disable any rules matching the provided pattern - // (regex). When provided, enable/disable these rules in the + // Enable/Disable any rules matching the provided substring. + // If the substring is "", all rules are enabled/disabled. + // When provided, enable/disable these rules in the // context of the provided ruleset. The ruleset (id) can later // be passed as an argument to process_event(). This allows // for different sets of rules being active at once. // - void enable_rule(const std::string &pattern, bool enabled, const std::string &ruleset); + void enable_rule(const std::string &substring, bool enabled, const std::string &ruleset); // Wrapper that assumes the default ruleset - void enable_rule(const std::string &pattern, bool enabled); + void enable_rule(const std::string &substring, bool enabled); // // Enable/Disable any rules with any of the provided tags (set, exact matches only) diff --git a/userspace/engine/ruleset.cpp b/userspace/engine/ruleset.cpp index 642d4ba5..57ed0ef0 100644 --- a/userspace/engine/ruleset.cpp +++ b/userspace/engine/ruleset.cpp @@ -202,19 +202,8 @@ void falco_ruleset::add(string &name, } } -void falco_ruleset::enable(const string &pattern, bool enabled, uint16_t ruleset) +void falco_ruleset::enable(const string &substring, bool enabled, uint16_t ruleset) { - regex re; - bool match_using_regex = true; - - try { - re.assign(pattern); - } - catch (std::regex_error e) - { - match_using_regex = false; - } - while (m_rulesets.size() < (size_t) ruleset + 1) { m_rulesets.push_back(new ruleset_filters()); @@ -223,14 +212,9 @@ void falco_ruleset::enable(const string &pattern, bool enabled, uint16_t ruleset for(const auto &val : m_filters) { bool matches; - if(match_using_regex) - { - matches = regex_match(val.first, re); - } - else - { - matches = (val.first.find(pattern) != string::npos); - } + + matches = (substring == "" || (val.first.find(substring) != string::npos)); + if (matches) { if(enabled) diff --git a/userspace/engine/ruleset.h b/userspace/engine/ruleset.h index 51891332..0a9f1a59 100644 --- a/userspace/engine/ruleset.h +++ b/userspace/engine/ruleset.h @@ -24,7 +24,6 @@ limitations under the License. #include #include #include -#include #include "sinsp.h" #include "filter.h" @@ -48,9 +47,9 @@ public: // specifying unnecessarily large rulesets will result in // unnecessarily large vectors. - // Find those rules matching the provided pattern and set + // Find those rules matching the provided substring and set // their enabled status to enabled. - void enable(const std::string &pattern, bool enabled, uint16_t ruleset = 0); + void enable(const std::string &substring, bool enabled, uint16_t ruleset = 0); // Find those rules that have a tag in the set of tags and set // their enabled status to enabled. Note that the enabled diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index dc957397..76a4fc91 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -87,7 +87,7 @@ static void usage() " --cri Path to CRI socket for container metadata\n" " Use the specified socket to fetch data from a CRI-compatible runtime\n" " -d, --daemon Run as a daemon\n" - " -D Disable any rules matching the regex . Can be specified multiple times.\n" + " -D Disable any rules with names having the substring . Can be specified multiple times.\n" " Can not be specified with -t.\n" " -e Read the events from (in .scap format for sinsp events, or jsonl for\n" " k8s audit events) instead of tapping into live.\n" @@ -471,9 +471,9 @@ int falco_init(int argc, char **argv) try { - set disabled_rule_patterns; - string pattern; - string all_rules = ".*"; + set disabled_rule_substrings; + string substring; + string all_rules = ""; set disabled_rule_tags; set enabled_rule_tags; @@ -502,8 +502,8 @@ int falco_init(int argc, char **argv) daemon = true; break; case 'D': - pattern = optarg; - disabled_rule_patterns.insert(pattern); + substring = optarg; + disabled_rule_substrings.insert(substring); break; case 'e': trace_filename = optarg; @@ -781,15 +781,15 @@ int falco_init(int argc, char **argv) } // You can't both disable and enable rules - if((disabled_rule_patterns.size() + disabled_rule_tags.size() > 0) && + if((disabled_rule_substrings.size() + disabled_rule_tags.size() > 0) && enabled_rule_tags.size() > 0) { throw std::invalid_argument("You can not specify both disabled (-D/-T) and enabled (-t) rules"); } - for (auto pattern : disabled_rule_patterns) + for (auto substring : disabled_rule_substrings) { - falco_logger::log(LOG_INFO, "Disabling rules matching pattern: " + pattern + "\n"); - engine->enable_rule(pattern, false); + falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n"); + engine->enable_rule(substring, false); } if(disabled_rule_tags.size() > 0)