diff --git a/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp b/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp index 5dfbd5aa..9fba18db 100644 --- a/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp +++ b/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp @@ -101,7 +101,7 @@ TEST(ConfigureInterestingSets, engine_codes_syscalls_set) auto rules_event_set = engine->event_codes_for_ruleset(s_sample_source); auto rules_event_names = libsinsp::events::event_set_to_names(rules_event_set); ASSERT_NAMES_EQ(rules_event_names, strset_t({ - "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container"})); + "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container", "asyncevent"})); // test if sc code names were extracted from each rule in test ruleset. // note, this is not supposed to contain "container", as that's an event @@ -161,7 +161,7 @@ TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set) auto generic_names = libsinsp::events::event_set_to_names({ppm_event_code::PPME_GENERIC_E}); auto expected_names = strset_t({ "connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container", // ruleset - "procexit", "switch", "pluginevent"}); // from non-syscall event filters + "procexit", "switch", "pluginevent", "asyncevent"}); // from non-syscall event filters expected_names.insert(generic_names.begin(), generic_names.end()); ASSERT_NAMES_EQ(rules_event_names, expected_names); diff --git a/userspace/engine/evttype_index_ruleset.cpp b/userspace/engine/evttype_index_ruleset.cpp index 645e1408..5666e5b8 100644 --- a/userspace/engine/evttype_index_ruleset.cpp +++ b/userspace/engine/evttype_index_ruleset.cpp @@ -178,6 +178,7 @@ void evttype_index_ruleset::add( wrap->sc_codes = { }; wrap->event_codes = { ppm_event_code::PPME_PLUGINEVENT_E }; } + wrap->event_codes.insert(ppm_event_code::PPME_ASYNCEVENT_E); m_filters.insert(wrap); } catch (const sinsp_exception& e) diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp index 47dec22a..d6fc5ac3 100644 --- a/userspace/engine/rule_loader_compiler.cpp +++ b/userspace/engine/rule_loader_compiler.cpp @@ -495,12 +495,11 @@ void rule_loader::compiler::compile_rule_infos( } // populate set of event types and emit an special warning - libsinsp::events::set evttypes = { ppm_event_code::PPME_PLUGINEVENT_E }; if(rule.source == falco_common::syscall_source) { - evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get()); - if ((evttypes.empty() || evttypes.size() > 100) - && r.warn_evttypes) + auto evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get()); + evttypes.insert(ppm_event_code::PPME_ASYNCEVENT_E); + if ((evttypes.empty() || evttypes.size() > 100) && r.warn_evttypes) { cfg.res->add_warning( falco::load_result::load_result::LOAD_NO_EVTTYPE,