mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-07 17:24:05 +00:00
fix(userspace/engine): don't count async event for evttype warning
Co-authored-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
parent
2d53fed0b8
commit
c603055acf
@ -498,7 +498,6 @@ void rule_loader::compiler::compile_rule_infos(
|
|||||||
if(rule.source == falco_common::syscall_source)
|
if(rule.source == falco_common::syscall_source)
|
||||||
{
|
{
|
||||||
auto evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
|
auto evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
|
||||||
evttypes.insert(ppm_event_code::PPME_ASYNCEVENT_E);
|
|
||||||
if ((evttypes.empty() || evttypes.size() > 100) && r.warn_evttypes)
|
if ((evttypes.empty() || evttypes.size() > 100) && r.warn_evttypes)
|
||||||
{
|
{
|
||||||
cfg.res->add_warning(
|
cfg.res->add_warning(
|
||||||
|
Loading…
Reference in New Issue
Block a user