mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-17 07:18:26 +00:00
Only have -pc/-pk apply to syscall rules (#495)
Currently, -pc/-pk results in extra fields added to the output field of all rules. They should only be added for syscall rules.
This commit is contained in:
@@ -493,6 +493,7 @@ function load_rules(sinsp_lua_parser,
|
||||
-- If the format string contains %container.info, replace it
|
||||
-- with extra. Otherwise, add extra onto the end of the format
|
||||
-- string.
|
||||
if v['source'] == "syscall" then
|
||||
if string.find(v['output'], "%container.info", nil, true) ~= nil then
|
||||
|
||||
-- There may not be any extra, or we're not supposed
|
||||
@@ -513,6 +514,7 @@ function load_rules(sinsp_lua_parser,
|
||||
v['output'] = v['output'].." "..extra
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
-- Ensure that the output field is properly formatted by
|
||||
-- creating a formatter from it. Any error will be thrown
|
||||
|
Reference in New Issue
Block a user