github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 00:22:15 +00:00
Code Issues Projects Releases Wiki Activity

Enable all rules (#379)

Browse Source 
* Proactively enable rules instead of only disabling

Previously, rules were enabled by default. Some performance improvements
in https://github.com/draios/sysdig/pull/1126 broke this, requiring that
each rule is explicitly enabled or disabled for a given ruleset.

So if enabled is true, explicitly enable the rule for the default ruleset.

* Get rid of shadowed res variable.

It was used both for the inspector loop and the falco result.
This commit is contained in:
Mark Stemm 2018-06-07 17:16:30 -07:00 committed by GitHub
parent c3b0f0d96d
commit 70f768d9ea
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
userspace/engine/lua/rule_loader.lua
View File

@ -449,6 +449,8 @@ function load_rules(rules_content, rules_mgr, verbose, all_events, extra, replac
if (v['enabled'] == false) then if (v['enabled'] == false) then
falco_rules.enable_rule(rules_mgr, v['rule'], 0) falco_rules.enable_rule(rules_mgr, v['rule'], 0)
else
falco_rules.enable_rule(rules_mgr, v['rule'], 1)
end end
-- If the format string contains %container.info, replace it -- If the format string contains %container.info, replace it

12
userspace/falco/falco.cpp
View File

@ -158,7 +158,7 @@ uint64_t do_inspect(falco_engine *engine,
bool all_events) bool all_events)
{ {
uint64_t num_evts = 0; uint64_t num_evts = 0;
int32_t res; int32_t rc;
sinsp_evt* ev; sinsp_evt* ev;
StatsFileWriter writer; StatsFileWriter writer;
uint64_t duration_start = 0; uint64_t duration_start = 0;
@ -179,7 +179,7 @@ uint64_t do_inspect(falco_engine *engine,
while(1) while(1)
{ {
res = inspector->next(&ev); rc = inspector->next(&ev);
writer.handle(); writer.handle();
@ -193,21 +193,21 @@ uint64_t do_inspect(falco_engine *engine,
{ {
break; break;
} }
else if(res == SCAP_TIMEOUT) else if(rc == SCAP_TIMEOUT)
{ {
continue; continue;
} }
else if(res == SCAP_EOF) else if(rc == SCAP_EOF)
{ {
break; break;
} }
else if(res != SCAP_SUCCESS) else if(rc != SCAP_SUCCESS)
{ {
// //
// Event read error. // Event read error.
// Notify the chisels that we're exiting, and then die with an error. // Notify the chisels that we're exiting, and then die with an error.
// //
cerr << "res = " << res << endl; cerr << "rc = " << rc << endl;
throw sinsp_exception(inspector->getlasterr().c_str()); throw sinsp_exception(inspector->getlasterr().c_str());
} }