github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-07 01:30:13 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): adapt engine classes to new libsinsp event definitions

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
2023-02-17 11:17:37 +00:00
committed by poiana
parent 34ea7a8245
commit 6c38ecaf0e
4 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/engine/rule_loader_compiler.cpp
View File

@@ -21,7 +21,6 @@ limitations under the License.
#include "rule_loader_compiler.h"
#include "filter_macro_resolver.h"
#include "filter_evttype_resolver.h"
#include "filter_warning_resolver.h"
#define MAX_VISIBILITY ((uint32_t) -1)
@@ -496,11 +495,10 @@ void rule_loader::compiler::compile_rule_infos(
}
// populate set of event types and emit an special warning
std::set<uint16_t> evttypes = { ppm_event_type::PPME_PLUGINEVENT_E };
libsinsp::events::set<ppm_event_code> evttypes = { ppm_event_code::PPME_PLUGINEVENT_E };
if(rule.source == falco_common::syscall_source)
{
evttypes.clear();
filter_evttype_resolver().evttypes(ast, evttypes);
evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
if ((evttypes.empty() || evttypes.size() > 100)
&& r.warn_evttypes)
{