github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-26 06:42:08 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): updated no evt.type specified lua warning string.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2022-01-24 15:55:43 +01:00 committed by poiana
parent 43bdfce6e5
commit 4d3fc354fa
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/engine/lua/rule_loader.lua
View File

@ -1059,11 +1059,9 @@ function load_rules(rules_content,
else
num_evttypes = falco_rules.add_filter(rules_mgr, lua_parser, v['rule'], v['source'], v['tags'])
if num_evttypes == 0 or num_evttypes > 100 then
if v['source'] == "syscall" and (num_evttypes == 0 or num_evttypes > 100) then
if warn_evttypes == true then
msg = "Rule "..v['rule']..": warning (no-evttype):\n"
msg = msg.." did not contain any evt.type restriction, meaning it will run for all event types.\n"
msg = msg.." This has a significant performance penalty. Consider adding an evt.type restriction if possible.\n"
msg = "Rule "..v['rule']..": warning (no-evttype):\n".." matches too many evt.type values.\n".." This has a significant performance penalty.\n"
warnings[#warnings + 1] = msg
end
end