mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
3fedd00cfc
Given the compiler we currently use, you can't actually enable/disable regexes in falco_engine::enable_rule using a regex pattern. The regex either will fail to compile or will compile but not actually match strings. This is noted on the c++11 compatibility notes for gcc 4.8.2: https://gcc.gnu.org/onlinedocs/gcc-4.8.2/libstdc++/manual/manual/status.html#status.iso.2011. The only use of using enable_rule was treating the regex pattern as a substring match anyway, so we can change the engine to treat the pattern as a substring. So change the method/supporting sub-classes to note that the argument is a substring match, and change falco itself to refer to substrings instead of patterns. This fixes https://github.com/falcosecurity/falco/issues/742. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>