github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-13 21:41:23 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/engine): expand %container.info extra format to empty string.

Browse Source 
Also, remove `container_id container_name` fields from `-pc` output.
These fields are now automatically appended since the `container` plugin
marks them as suggested.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro
2025-02-11 12:20:21 +01:00
committed by poiana
parent bb13702f0f
commit 9f1bc7d518
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
userspace/engine/rule_loader_compiler.cpp
View File

@@ -36,9 +36,12 @@ limitations under the License.
}
static std::string s_container_info_fmt = "%container.info";
static std::string s_default_extra_fmt =
"container_id=%container.id container_name=%container.name";
// We were previously expanding %container.info to "container_id=%container.id
// container_name=%container.name". Since the container plugin is now in use, and it exposes
// container.id and container.name as suggested output fields, we don't need to expand
// container.info anymore. We kept container.info in the ruleset to avoid a major breaking change.
// TODO: drop `container.info` magic once we make a major breaking change in the ruleset.
static std::string s_default_extra_fmt = "";
using namespace libsinsp::filter;
// todo(jasondellaluce): this breaks string escaping in lists and exceptions

4
userspace/falco/app/actions/init_falco_engine.cpp
View File

@@ -95,8 +95,8 @@ void configure_output_format(falco::app::state& s) {
// See https://falco.org/docs/rules/style-guide/
const std::string container_info =
"container_id=%container.id container_image=%container.image.repository "
"container_image_tag=%container.image.tag container_name=%container.name";
"container_image=%container.image.repository "
"container_image_tag=%container.image.tag";
const std::string k8s_info = "k8s_ns=%k8s.ns.name k8s_pod_name=%k8s.pod.name";
const std::string gvisor_info = "vpid=%proc.vpid vtid=%thread.vtid";