github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-07 09:40:44 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(userspace/engine,userspace/falco): drop replace_container_info flag.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro
2025-04-30 11:06:11 +02:00
committed by poiana
parent 0326210f49
commit 6e4b7663ca
5 changed files with 8 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
userspace/engine/falco_engine.cpp
View File

@@ -986,9 +986,8 @@ void falco_engine::set_sampling_multiplier(double sampling_multiplier) {
void falco_engine::add_extra_output_format(const std::string &format,
const std::string &source,
const std::set<std::string> &tags,
const std::string &rule,
bool replace_container_info) {
m_extra_output_format.push_back({format, source, tags, rule, replace_container_info});
const std::string &rule) {
m_extra_output_format.push_back({format, source, tags, rule});
}
void falco_engine::add_extra_output_formatted_field(const std::string &key,

3
userspace/engine/falco_engine.h
View File

@@ -199,8 +199,7 @@ public:
void add_extra_output_format(const std::string &format,
const std::string &source,
const std::set<std::string> &tags,
const std::string &rule,
bool replace_container_info);
const std::string &rule);
// You can optionally add fields that will only show up in the object
// output (e.g. json, gRPC) alongside other output_fields

1
userspace/engine/rule_loader.h
View File

@@ -272,7 +272,6 @@ struct extra_output_format_conf {
std::string m_source;
std::set<std::string> m_tags;
std::string m_rule;
bool m_replace_container_info;
};
struct extra_output_field_conf {

16
userspace/engine/rule_loader_compiler.cpp
View File

@@ -434,21 +434,7 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
continue;
}
if(extra.m_replace_container_info) {
if(rule.output.find(s_container_info_fmt) != std::string::npos) {
cfg.res->add_warning(falco::load_result::load_result::LOAD_DEPRECATED_ITEM,
"%container.info is deprecated and no more useful, and "
"will be dropped by Falco 1.0.0. "
"The container plugin will automatically add required "
"fields to the output message.",
r.ctx);
rule.output = replace(rule.output, s_container_info_fmt, extra.m_format);
} else {
rule.output = rule.output + " " + extra.m_format;
}
} else {
rule.output = rule.output + " " + extra.m_format;
}
rule.output = rule.output + " " + extra.m_format;
}
if(rule.output.find(s_container_info_fmt) != std::string::npos) {

13
userspace/falco/app/actions/init_falco_engine.cpp
View File

@@ -52,8 +52,7 @@ static void add_suggested_output(const falco::app::state& s,
s.engine->add_extra_output_format(format_suggested_field(fldinfo),
src,
eo.m_tags,
eo.m_rule,
false);
eo.m_rule);
}
}
}
@@ -62,11 +61,7 @@ static void add_suggested_output(const falco::app::state& s,
void configure_output_format(falco::app::state& s) {
for(auto& eo : s.config->m_append_output) {
if(eo.m_format != "") {
s.engine->add_extra_output_format(eo.m_format,
eo.m_source,
eo.m_tags,
eo.m_rule,
false);
s.engine->add_extra_output_format(eo.m_format, eo.m_source, eo.m_tags, eo.m_rule);
}
// Add suggested filtercheck formats to each source output
@@ -109,9 +104,9 @@ void configure_output_format(falco::app::state& s) {
s.options.print_additional == "container-gvisor" ||
s.options.print_additional == "kg" ||
s.options.print_additional == "kubernetes-gvisor") {
s.engine->add_extra_output_format(gvisor_info, falco_common::syscall_source, {}, "", true);
s.engine->add_extra_output_format(gvisor_info, falco_common::syscall_source, {}, "");
} else {
s.engine->add_extra_output_format(s.options.print_additional, "", {}, "", false);
s.engine->add_extra_output_format(s.options.print_additional, "", {}, "");
}
}
}