Allow append skipped rules (#346)

* Allow appending to skipped rules

If a rule has an append attribute but the original rule was skipped (due
to having lower priority than the configured priority), silently skip
the appending rule instead of returning an error.

* Unit test for appending to skipped rules

Unit test verifies fix for appending to skipped rules. One rules file
defines a rule with priority WARNING, a second rules file appends to
that rules file, and the configured priority is ERROR.

Ensures that falco rules without errors.
This commit is contained in:
Mark Stemm
2018-04-05 10:28:45 -07:00
committed by GitHub
parent a0053dba18
commit a5daf8b058
3 changed files with 21 additions and 5 deletions

View File

@@ -0,0 +1,3 @@
- rule: open_from_cat
append: true
condition: and fd.name=/tmp