github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-06 01:00:36 +00:00
Code Issues Projects Releases Wiki Activity

refactor(userspace/falco): remove k8s audit references from falco

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
2022-03-23 13:35:31 +00:00
committed by poiana
parent 21b127ef65
commit 42fcc7291f
13 changed files with 34 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
userspace/engine/rule_loader.cpp
View File

@@ -721,7 +721,7 @@ void rule_loader::compile_rule_infos(
}
// populate set of event types and emit an special warning
set<uint16_t> evttypes;
set<uint16_t> evttypes = { ppm_event_type::PPME_PLUGINEVENT_E };
if(rule.source == falco_common::syscall_source)
{
filter_evttype_resolver().evttypes(ast, evttypes);
@@ -734,16 +734,6 @@ void rule_loader::compile_rule_infos(
+ " This has a significant performance penalty.");
}
}
else if (rule.source == "k8s_audit")
{
// todo(jasondellaluce): remove this case once k8saudit
// gets ported to a plugin
evttypes = { ppm_event_type::PPME_GENERIC_X };
}
else
{
evttypes = { ppm_event_type::PPME_PLUGINEVENT_E };
}
// add rule and its filter in the engine
cfg.engine->add_filter(filter, rule.name, rule.source, evttypes, rule.tags);