diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 2c629bf9..3731c6ff 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -634,7 +634,13 @@ trace_files: !mux rules_file: - rules/single_rule_enabled_flag.yaml trace_file: trace_files/cat_write.scap - + + disabled_rule_using_false_enabled_flag_only: + detect: False + rules_file: + - rules/disabled_rule_using_enabled_flag_only.yaml + trace_file: trace_files/cat_write.scap + disabled_and_enabled_rules_1: exit_status: 1 stderr_contains: "Runtime error: You can not specify both disabled .-D/-T. and enabled .-t. rules. Exiting." diff --git a/test/rules/disabled_rule_using_enabled_flag_only.yaml b/test/rules/disabled_rule_using_enabled_flag_only.yaml new file mode 100644 index 00000000..d063b8c5 --- /dev/null +++ b/test/rules/disabled_rule_using_enabled_flag_only.yaml @@ -0,0 +1,24 @@ +# +# Copyright (C) 2021 The Falco Authors. +# +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +- rule: open_from_cat + desc: A process named cat does an open + condition: evt.type=open and proc.name=cat + output: "An open was seen" + priority: WARNING + +- rule: open_from_cat + enabled: false