github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-03-18 18:58:41 +00:00
Code Issues Projects Releases Wiki Activity

Skip rules/macros with unknown sources

Browse Source 
If the rule/macro's source is something other than "syscall" or
"k8s_audit", silently ignore the rule/macro.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2021-01-26 10:19:26 -08:00
parent 6408270476
commit d8a793030e
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
userspace/engine/lua/rule_loader.lua
View File

@@ -436,6 +436,11 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end
-- Ignore macros with unknown sources
if (v['source'] ~= "syscall" and v['source'] ~= "k8s_audit") then
goto next_object
end
if state.macros_by_name[v['macro']] == nil then
state.ordered_macro_names[#state.ordered_macro_names+1] = v['macro']
end
@@ -522,6 +527,11 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end
-- Ignore rules with unknown sources
if (v['source'] ~= "syscall" and v['source'] ~= "k8s_audit") then
goto next_object
end
-- Add an empty exceptions property to the rule if not
-- defined, but add a warning about defining one
if v['exceptions'] == nil then
@@ -668,6 +678,8 @@ function load_rules_doc(rules_mgr, doc, load_state)
arr = build_error_with_context(context, "Unknown top level object: "..table.tostring(v))
warnings[#warnings + 1] = arr[1]
end
::next_object::
end
return true, {}, warnings