github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 23:57:29 +00:00
Code Issues Projects Releases Wiki Activity

Enable all rules (#379)

Browse Source 
* Proactively enable rules instead of only disabling

Previously, rules were enabled by default. Some performance improvements
in https://github.com/draios/sysdig/pull/1126 broke this, requiring that
each rule is explicitly enabled or disabled for a given ruleset.

So if enabled is true, explicitly enable the rule for the default ruleset.

* Get rid of shadowed res variable.

It was used both for the inspector loop and the falco result.
This commit is contained in:
Mark Stemm 2018-06-07 17:16:30 -07:00 committed by GitHub
parent c3b0f0d96d
commit 70f768d9ea
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
userspace/engine/lua/rule_loader.lua
View File

@ -449,6 +449,8 @@ function load_rules(rules_content, rules_mgr, verbose, all_events, extra, replac
if (v['enabled'] == false) then
falco_rules.enable_rule(rules_mgr, v['rule'], 0)
else
falco_rules.enable_rule(rules_mgr, v['rule'], 1)
end
-- If the format string contains %container.info, replace it

12
userspace/falco/falco.cpp
View File

@ -158,7 +158,7 @@ uint64_t do_inspect(falco_engine *engine,
bool all_events)
{
uint64_t num_evts = 0;
int32_t res;
int32_t rc;
sinsp_evt* ev;
StatsFileWriter writer;
uint64_t duration_start = 0;
@ -179,7 +179,7 @@ uint64_t do_inspect(falco_engine *engine,
while(1)
{
res = inspector->next(&ev);
rc = inspector->next(&ev);
writer.handle();
@ -193,21 +193,21 @@ uint64_t do_inspect(falco_engine *engine,
{
break;
}
else if(res == SCAP_TIMEOUT)
else if(rc == SCAP_TIMEOUT)
{
continue;
}
else if(res == SCAP_EOF)
else if(rc == SCAP_EOF)
{
break;
}
else if(res != SCAP_SUCCESS)
else if(rc != SCAP_SUCCESS)
{
//
// Event read error.
// Notify the chisels that we're exiting, and then die with an error.
//
cerr << "res = " << res << endl;
cerr << "rc = " << rc << endl;
throw sinsp_exception(inspector->getlasterr().c_str());
}