github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 07:07:23 +00:00
Code Issues Projects Releases Wiki Activity

new(userspace/falco): add support for kernel side simple consumer.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2022-01-10 09:30:17 +01:00 committed by poiana
parent 475ed0dbeb
commit 48a23121df
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
userspace/falco/falco.cpp
View File

@ -1206,6 +1206,11 @@ int falco_init(int argc, char **argv)
if(!all_events) if(!all_events)
{ {
// Drop EF_DROP_SIMPLE_CONS kernel side
inspector->set_simple_consumer();
// Eventually, drop any EF_DROP_SIMPLE_CONS event
// that reached userspace (there are some events that are not syscall-based
// like signaldeliver, that have the EF_DROP_SIMPLE_CONS flag)
inspector->set_drop_event_flags(EF_DROP_SIMPLE_CONS); inspector->set_drop_event_flags(EF_DROP_SIMPLE_CONS);
} }