mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 12:27:10 +00:00
f68fba103e
If a rule has a enabled attribute, and if the value is false, call the engine's enable_rule() method to disable the rule. Like add_filter, there's a static method which takes the object as the first argument and a non-static method that calls the engine. This fixes #72.
38 lines
874 B
C++
38 lines
874 B
C++
#pragma once
|
|
|
|
#include <list>
|
|
|
|
#include "sinsp.h"
|
|
|
|
#include "lua_parser.h"
|
|
|
|
class falco_engine;
|
|
|
|
class falco_rules
|
|
{
|
|
public:
|
|
falco_rules(sinsp* inspector, falco_engine *engine, lua_State *ls);
|
|
~falco_rules();
|
|
void load_rules(const string &rules_content, bool verbose, bool all_events);
|
|
void describe_rule(string *rule);
|
|
|
|
static void init(lua_State *ls);
|
|
static int add_filter(lua_State *ls);
|
|
static int enable_rule(lua_State *ls);
|
|
|
|
private:
|
|
void add_filter(string &rule, list<uint32_t> &evttypes);
|
|
void enable_rule(string &rule, bool enabled);
|
|
|
|
lua_parser* m_lua_parser;
|
|
sinsp* m_inspector;
|
|
falco_engine *m_engine;
|
|
lua_State* m_ls;
|
|
|
|
string m_lua_load_rules = "load_rules";
|
|
string m_lua_ignored_syscalls = "ignored_syscalls";
|
|
string m_lua_ignored_events = "ignored_events";
|
|
string m_lua_events = "events";
|
|
string m_lua_describe_rule = "describe_rule";
|
|
};
|