github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-04 16:20:18 +00:00
Code Issues Projects Releases Wiki Activity

Enable/disable rules using substrings not regexes

Browse Source 
Given the compiler we currently use, you can't actually enable/disable
regexes in falco_engine::enable_rule using a regex pattern. The regex
either will fail to compile or will compile but not actually match
strings. This is noted on the c++11 compatibility notes for gcc 4.8.2:
https://gcc.gnu.org/onlinedocs/gcc-4.8.2/libstdc++/manual/manual/status.html#status.iso.2011.

The only use of using enable_rule was treating the regex pattern as a
substring match anyway, so we can change the engine to treat the pattern
as a substring.

So change the method/supporting sub-classes to note that the argument is
a substring match, and change falco itself to refer to substrings
instead of patterns.

This fixes https://github.com/falcosecurity/falco/issues/742.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2019-07-29 12:10:58 -07:00
committed by Leo Di Donato
parent 4a4701b4fd
commit 3fedd00cfc
5 changed files with 26 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
userspace/engine/falco_engine.cpp
View File

@@ -206,17 +206,17 @@ void falco_engine::load_rules_file(const string &rules_filename, bool verbose, b
load_rules(rules_content, verbose, all_events, required_engine_version);
}
void falco_engine::enable_rule(const string &pattern, bool enabled, const string &ruleset)
void falco_engine::enable_rule(const string &substring, bool enabled, const string &ruleset)
{
uint16_t ruleset_id = find_ruleset_id(ruleset);
m_sinsp_rules->enable(pattern, enabled, ruleset_id);
m_k8s_audit_rules->enable(pattern, enabled, ruleset_id);
m_sinsp_rules->enable(substring, enabled, ruleset_id);
m_k8s_audit_rules->enable(substring, enabled, ruleset_id);
}
void falco_engine::enable_rule(const string &pattern, bool enabled)
void falco_engine::enable_rule(const string &substring, bool enabled)
{
enable_rule(pattern, enabled, m_default_ruleset);
enable_rule(substring, enabled, m_default_ruleset);
}
void falco_engine::enable_rule_by_tag(const set<string> &tags, bool enabled, const string &ruleset)