mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-15 06:19:12 +00:00
Add a source to rule_update_info
It's possible that someone might want to override a property for a non-syscall rule source. To assist in this, decode any source property for rules with append/override and save it in the rule_update_info object. For the source property only, the value for source can be empty e.g. 'source: ' or an empty string e.g. 'source: ""'. Both of those are considered valid but result in an empty source. A later change will ensure that the sources match up when appending/redefining/overriding/enabling. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
@@ -66,6 +66,11 @@ public:
|
||||
const char* key,
|
||||
T& out,
|
||||
const rule_loader::context& ctx);
|
||||
template<typename T>
|
||||
static void decode_optional_empty_val(const YAML::Node& item,
|
||||
const char* key,
|
||||
T& out,
|
||||
const rule_loader::context& ctx);
|
||||
|
||||
protected:
|
||||
virtual void read_item(rule_loader::configuration& cfg,
|
||||
|
Reference in New Issue
Block a user