diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 7a58aa4a..a6cb7eea 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -123,6 +123,18 @@ trace_files: !mux trace_file: trace_files/cat_write.scap all_events: True + multiple_docs: + detect: True + detect_level: + - WARNING + - INFO + - ERROR + rules_file: + - rules/single_rule.yaml + - rules/double_rule.yaml + trace_file: trace_files/cat_write.scap + all_events: True + rules_directory: detect: True detect_level: @@ -435,6 +447,35 @@ trace_files: !mux - rules/invalid_append_macro.yaml trace_file: trace_files/cat_write.scap + invalid_overwrite_macro_multiple_docs: + exit_status: 1 + stdout_is: |+ + Compilation error when compiling "foo": Undefined macro 'foo' used in filter. + --- + - macro: some macro + condition: foo + append: false + --- + validate_rules_file: + - rules/invalid_overwrite_macro_multiple_docs.yaml + trace_file: trace_files/cat_write.scap + + invalid_append_macro_multiple_docs: + exit_status: 1 + stdout_is: |+ + Compilation error when compiling "evt.type=execve foo": 17: syntax error, unexpected 'foo', expecting 'or', 'and' + --- + - macro: some macro + condition: evt.type=execve + + - macro: some macro + condition: foo + append: true + --- + validate_rules_file: + - rules/invalid_append_macro_multiple_docs.yaml + trace_file: trace_files/cat_write.scap + invalid_overwrite_rule: exit_status: 1 stdout_contains: |+ @@ -477,6 +518,44 @@ trace_files: !mux - rules/invalid_append_rule.yaml trace_file: trace_files/cat_write.scap + invalid_overwrite_rule_multiple_docs: + exit_status: 1 + stdout_is: |+ + Undefined macro 'bar' used in filter. + --- + - rule: some rule + desc: some desc + condition: bar + output: some output + priority: INFO + append: false + --- + validate_rules_file: + - rules/invalid_overwrite_rule_multiple_docs.yaml + trace_file: trace_files/cat_write.scap + + invalid_append_rule_multiple_docs: + exit_status: 1 + stdout_contains: |+ + Compilation error when compiling "evt.type=open bar": 15: syntax error, unexpected 'bar', expecting 'or', 'and' + --- + - rule: some rule + desc: some desc + condition: evt.type=open + output: some output + priority: INFO + + - rule: some rule + desc: some desc + condition: bar + output: some output + priority: INFO + append: true + --- + validate_rules_file: + - rules/invalid_append_rule_multiple_docs.yaml + trace_file: trace_files/cat_write.scap + invalid_missing_rule_name: exit_status: 1 stdout_is: |+ diff --git a/test/rules/invalid_append_macro_multiple_docs.yaml b/test/rules/invalid_append_macro_multiple_docs.yaml new file mode 100644 index 00000000..60a4f88c --- /dev/null +++ b/test/rules/invalid_append_macro_multiple_docs.yaml @@ -0,0 +1,8 @@ +--- +- macro: some macro + condition: evt.type=execve +--- +- macro: some macro + condition: foo + append: true + diff --git a/test/rules/invalid_append_rule_multiple_docs.yaml b/test/rules/invalid_append_rule_multiple_docs.yaml new file mode 100644 index 00000000..92c5e6e4 --- /dev/null +++ b/test/rules/invalid_append_rule_multiple_docs.yaml @@ -0,0 +1,13 @@ +--- +- rule: some rule + desc: some desc + condition: evt.type=open + output: some output + priority: INFO +--- +- rule: some rule + desc: some desc + condition: bar + output: some output + priority: INFO + append: true \ No newline at end of file diff --git a/test/rules/invalid_overwrite_macro_multiple_docs.yaml b/test/rules/invalid_overwrite_macro_multiple_docs.yaml new file mode 100644 index 00000000..723312e9 --- /dev/null +++ b/test/rules/invalid_overwrite_macro_multiple_docs.yaml @@ -0,0 +1,8 @@ +--- +- macro: some macro + condition: evt.type=execve +--- +- macro: some macro + condition: foo + append: false + diff --git a/test/rules/invalid_overwrite_rule_multiple_docs.yaml b/test/rules/invalid_overwrite_rule_multiple_docs.yaml new file mode 100644 index 00000000..eef86359 --- /dev/null +++ b/test/rules/invalid_overwrite_rule_multiple_docs.yaml @@ -0,0 +1,13 @@ +--- +- rule: some rule + desc: some desc + condition: evt.type=open + output: some output + priority: INFO +--- +- rule: some rule + desc: some desc + condition: bar + output: some output + priority: INFO + append: false \ No newline at end of file diff --git a/test/rules/multiple_docs.yaml b/test/rules/multiple_docs.yaml new file mode 100644 index 00000000..1857ee07 --- /dev/null +++ b/test/rules/multiple_docs.yaml @@ -0,0 +1,66 @@ +--- +# +# Copyright (C) 2016-2018 Draios Inc dba Sysdig. +# +# This file is part of falco. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +- required_engine_version: 2 + +- list: cat_binaries + items: [cat] + +- list: cat_capable_binaries + items: [cat_binaries] + +- macro: is_cat + condition: proc.name in (cat_capable_binaries) + +- rule: open_from_cat + desc: A process named cat does an open + condition: evt.type=open and is_cat + output: "An open was seen (command=%proc.cmdline)" + priority: WARNING +--- +# +# Copyright (C) 2016-2018 Draios Inc dba Sysdig. +# +# This file is part of falco. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This ruleset depends on the is_cat macro defined in single_rule.yaml + +- rule: exec_from_cat + desc: A process named cat does execve + condition: evt.type=execve and is_cat + output: "An exec was seen (command=%proc.cmdline)" + priority: ERROR + +- rule: access_from_cat + desc: A process named cat does an access + condition: evt.type=access and is_cat + output: "An access was seen (command=%proc.cmdline)" + priority: INFO \ No newline at end of file