github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-07 01:30:13 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(app_actions): adjust configure_interesting_sets

Browse Source 
* address reviewers feedback
* improve clarity around new -A and -i behavior
* additional cleanup (e.g. use generic set operations only)
* extend unit tests

Note: sinsp ppm sc API is undergoing a refactor, therefore current lookups are interim
and will subsequently be refactored as well.

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby
2023-02-13 18:44:07 +00:00
committed by poiana
parent f77f8667a1
commit 72439b2eed
9 changed files with 286 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
userspace/engine/falco_utils.h
View File

@@ -24,6 +24,10 @@ limitations under the License.
#include <iostream>
#include <string>
#include <thread>
#include <unordered_set>
#include <set>
#include <vector>
#include <string>
#ifdef __GNUC__
#define likely(x) __builtin_expect(!!(x), 1)
@@ -39,6 +43,39 @@ namespace falco
namespace utils
{
// TODO interim helper methods -> shall be integrated into sinsp APIs
std::unordered_set<uint32_t> get_ppm_sc_set_from_syscalls(const std::unordered_set<std::string>& syscalls);
std::unordered_set<uint32_t> enforce_sinsp_state_ppme(std::unordered_set<uint32_t> ppm_event_info_of_interest = {});
std::unordered_set<uint32_t> enforce_io_ppm_sc_set(std::unordered_set<uint32_t> ppm_sc_set = {}); // needs libs bump hence duplicated in meantime
// end interim helper methods
// TODO interim libs utils methods
template<typename T>
std::set<T> unordered_set_to_ordered(const std::unordered_set<T>& unordered_set);
template<typename T>
std::unordered_set<T> unordered_set_difference(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
template<typename T>
std::set<T> set_difference(const std::set<T>& a, const std::set<T>& b);
template<typename T>
std::unordered_set<T> unordered_set_union(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
template<typename T>
std::set<T> set_union(const std::set<T>& a, const std::set<T>& b);
template<typename T>
std::unordered_set<T> unordered_set_intersection(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
template<typename T>
std::set<T> set_intersection(const std::set<T>& a, const std::set<T>& b);
std::string concat_set_in_order(const std::unordered_set<std::string>& s, const std::string& delim = ", ");
std::string concat_set_in_order(const std::set<std::string>& s, const std::string& delim = ", ");
// end interim libs utils methods
std::string wrap_text(const std::string& in, uint32_t indent, uint32_t linelen);
void readfile(const std::string& filename, std::string& data);