github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-24 21:40:11 +00:00
Code Issues Projects Releases Wiki Activity

Support enabled flag for rules.

Browse Source 
If a rule has a enabled attribute, and if the value is false, call the
engine's enable_rule() method to disable the rule. Like add_filter,
there's a static method which takes the object as the first argument and
a non-static method that calls the engine.

This fixes #72.
This commit is contained in:
Mark Stemm
2016-09-03 08:37:35 -07:00
parent 897df28036
commit f68fba103e
3 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
userspace/engine/rules.h
View File

@@ -18,9 +18,11 @@ class falco_rules
static void init(lua_State *ls);
static int add_filter(lua_State *ls);
static int enable_rule(lua_State *ls);
private:
void add_filter(string &rule, list<uint32_t> &evttypes);
void enable_rule(string &rule, bool enabled);
lua_parser* m_lua_parser;
sinsp* m_inspector;