github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-11-03 10:39:21 +00:00
Code Issues Projects Releases Wiki Activity

Add support bundle (#517)

Browse Source 
* Expose required_engine_version when loading rules

When loading a rules file, have alternate methods that return the
required_engine_version. The existing methods remain unchanged and just
call the new methods with a dummy placeholder.

* Add --support argument to print support bundle

Add an argument --support that can be used as a single way to collect
necessary support information, including the falco version, config,
commandline, and all rules files.

There might be a big of extra structure to the rules files, as they
actually support an array of "variants", but we're thinking ahead to
cases where there might be a comprehensive library of rules files and
choices, so we're adding the extra structure.
This commit is contained in:
Mark Stemm
2019-02-06 16:36:33 -08:00
committed by GitHub
parent bd4c3ffa39
commit 5e9bbd139c
6 changed files with 102 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/engine/lua/rule_loader.lua
View File

@@ -195,10 +195,11 @@ function load_rules(sinsp_lua_parser,
min_priority)
local rules = yaml.load(rules_content)
local required_engine_version = 0
if rules == nil then
-- An empty rules file is acceptable
return
return required_engine_version
end
if type(rules) ~= "table" then
@@ -216,6 +217,7 @@ function load_rules(sinsp_lua_parser,
end
if (v['required_engine_version']) then
required_engine_version = v['required_engine_version']
if falco_rules.engine_version(rules_mgr) < v['required_engine_version'] then
error("Rules require engine version "..v['required_engine_version']..", but engine version is "..falco_rules.engine_version(rules_mgr))
end
@@ -549,6 +551,8 @@ function load_rules(sinsp_lua_parser,
end
io.flush()
return required_engine_version
end
local rule_fmt = "%-50s %s"