mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
Allow append skipped rules (#346)
* Allow appending to skipped rules If a rule has an append attribute but the original rule was skipped (due to having lower priority than the configured priority), silently skip the appending rule instead of returning an error. * Unit test for appending to skipped rules Unit test verifies fix for appending to skipped rules. One rules file defines a rule with priority WARNING, a second rules file appends to that rules file, and the configured priority is ERROR. Ensures that falco rules without errors.
This commit is contained in:
3
test/rules/append_single_rule.yaml
Normal file
3
test/rules/append_single_rule.yaml
Normal file
@@ -0,0 +1,3 @@
|
||||
- rule: open_from_cat
|
||||
append: true
|
||||
condition: and fd.name=/tmp
|
Reference in New Issue
Block a user