mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
Add automated tests that verify the ability to tag sets of rules, disable them with -T, and run them with -t, works: - New test option disable_tags adds -T <tag> arguments to the falco command line, and run_tags adds -t <tag> arguments to the falco command line. - A new trace file open-multiple-files.scap opens 13 different files, and a new rules file has 13 different rules with all combinations of the tags a, b, c (both forward and backward), a rule with an empty list of tags, a rule with no tags field, and a rule with a completely different tag d. Using the above, add tests for: - Both disabling all combations of a, b, c using disable_tags as well as run all combinations of a, b, c, using run_tags. - Specifying both disabled (-T/-D) and enabled (-t) rules. Not allowed. - Specifying a ruleset while having tagged rules enabled, rules based on a name disabled, and no particular rules enabled or disabled.
558 lines
13 KiB
YAML
558 lines
13 KiB
YAML
trace_files: !mux
|
|
builtin_rules_no_warnings:
|
|
detect: False
|
|
trace_file: trace_files/empty.scap
|
|
rules_warning: False
|
|
|
|
test_warnings:
|
|
detect: False
|
|
trace_file: trace_files/empty.scap
|
|
rules_file: rules/falco_rules_warnings.yaml
|
|
rules_warning:
|
|
- no_evttype
|
|
- evttype_not_equals
|
|
- leading_not
|
|
- not_equals_at_end
|
|
- not_at_end
|
|
- not_before_trailing_evttype
|
|
- not_equals_before_trailing_evttype
|
|
- not_equals_and_not
|
|
- not_equals_before_in
|
|
- not_before_in
|
|
- not_in_before_in
|
|
- leading_in_not_equals_before_evttype
|
|
- leading_in_not_equals_at_evttype
|
|
- not_with_evttypes
|
|
- not_with_evttypes_addl
|
|
- not_equals_before_evttype
|
|
- not_equals_before_in_evttype
|
|
- not_before_evttype
|
|
- not_before_evttype_using_in
|
|
rules_events:
|
|
- no_warnings: [execve]
|
|
- no_evttype: [all]
|
|
- evttype_not_equals: [all]
|
|
- leading_not: [all]
|
|
- not_equals_after_evttype: [execve]
|
|
- not_after_evttype: [execve]
|
|
- leading_trailing_evttypes: [execve,open]
|
|
- leading_multtrailing_evttypes: [connect,execve,open]
|
|
- leading_multtrailing_evttypes_using_in: [connect,execve,open]
|
|
- not_equals_at_end: [all]
|
|
- not_at_end: [all]
|
|
- not_before_trailing_evttype: [all]
|
|
- not_equals_before_trailing_evttype: [all]
|
|
- not_equals_and_not: [all]
|
|
- not_equals_before_in: [all]
|
|
- not_before_in: [all]
|
|
- not_in_before_in: [all]
|
|
- evttype_in: [execve,open]
|
|
- evttype_in_plus_trailing: [connect,execve,open]
|
|
- leading_in_not_equals_before_evttype: [all]
|
|
- leading_in_not_equals_at_evttype: [all]
|
|
- not_with_evttypes: [all]
|
|
- not_with_evttypes_addl: [all]
|
|
- not_equals_before_evttype: [all]
|
|
- not_equals_before_in_evttype: [all]
|
|
- not_before_evttype: [all]
|
|
- not_before_evttype_using_in: [all]
|
|
- repeated_evttypes: [open]
|
|
- repeated_evttypes_with_in: [open]
|
|
- repeated_evttypes_with_separate_in: [open]
|
|
- repeated_evttypes_with_mix: [open]
|
|
|
|
rule_names_with_spaces:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/rule_names_with_spaces.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules_first_empty:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules_last_empty:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/empty_rules.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules:
|
|
detect: True
|
|
detect_level:
|
|
- WARNING
|
|
- INFO
|
|
- ERROR
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/double_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules_overriding:
|
|
detect: False
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/override_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
macro_overriding:
|
|
detect: False
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/override_macro.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
list_overriding:
|
|
detect: False
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/override_list.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
nested_list_overriding:
|
|
detect: False
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/override_nested_list.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
invalid_rule_output:
|
|
exit_status: 1
|
|
stderr_contains: "Runtime error: Error loading rules:.* Invalid output format 'An open was seen %not_a_real_field': 'invalid formatting token not_a_real_field'. Exiting."
|
|
rules_file:
|
|
- rules/invalid_rule_output.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_rules:
|
|
detect: False
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
disabled_rules:
|
|
- open_from_cat
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_rules_using_regex:
|
|
detect: False
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
disabled_rules:
|
|
- "open.*"
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_rules_using_enabled_flag:
|
|
detect: False
|
|
rules_file:
|
|
- rules/single_rule_enabled_flag.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_and_enabled_rules_1:
|
|
exit_status: 1
|
|
stderr_contains: "Runtime error: You can not specify both disabled .-D/-T. and enabled .-t. rules. Exiting."
|
|
disable_tags: [a]
|
|
run_tags: [a]
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_and_enabled_rules_2:
|
|
exit_status: 1
|
|
stderr_contains: "Runtime error: You can not specify both disabled .-D/-T. and enabled .-t. rules. Exiting."
|
|
disabled_rules:
|
|
- "open.*"
|
|
run_tags: [a]
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
null_output_field:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/null_output_field.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
stdout_contains: "Warning An open was seen .cport=<NA> command=cat /dev/null."
|
|
|
|
file_output:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
conf_file: confs/file_output.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
outputs:
|
|
- /tmp/falco_outputs/file_output.txt: Warning An open was seen
|
|
|
|
program_output:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
conf_file: confs/program_output.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
outputs:
|
|
- /tmp/falco_outputs/program_output.txt: Warning An open was seen
|
|
|
|
detect_counts:
|
|
detect: True
|
|
detect_level: WARNING
|
|
trace_file: traces-positive/falco-event-generator.scap
|
|
detect_counts:
|
|
- "Write below binary dir": 1
|
|
- "Read sensitive file untrusted": 3
|
|
- "Run shell in container": 1
|
|
- "Write below rpm database": 1
|
|
- "Write below etc": 1
|
|
- "System procs network activity": 1
|
|
- "Mkdir binary dirs": 1
|
|
- "System user interactive": 1
|
|
- "DB program spawned process": 1
|
|
- "Non sudo setuid": 1
|
|
- "Create files below dev": 1
|
|
- "Modify binary dirs": 2
|
|
- "Change thread namespace": 2
|
|
|
|
disabled_tags_a:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disable_tags: [a]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 1
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 0
|
|
- open_6: 1
|
|
- open_7: 0
|
|
- open_8: 0
|
|
- open_9: 0
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
disabled_tags_b:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disable_tags: [b]
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 0
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 1
|
|
- open_6: 0
|
|
- open_7: 0
|
|
- open_8: 0
|
|
- open_9: 1
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
disabled_tags_c:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disable_tags: [c]
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 1
|
|
- open_3: 0
|
|
- open_4: 1
|
|
- open_5: 0
|
|
- open_6: 0
|
|
- open_7: 0
|
|
- open_8: 1
|
|
- open_9: 0
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
disabled_tags_ab:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disable_tags: [a, b]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 0
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 0
|
|
- open_6: 0
|
|
- open_7: 0
|
|
- open_8: 0
|
|
- open_9: 0
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
disabled_tags_abc:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disable_tags: [a, b, c]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 0
|
|
- open_3: 0
|
|
- open_4: 0
|
|
- open_5: 0
|
|
- open_6: 0
|
|
- open_7: 0
|
|
- open_8: 0
|
|
- open_9: 0
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
run_tags_a:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [a]
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 0
|
|
- open_3: 0
|
|
- open_4: 1
|
|
- open_5: 1
|
|
- open_6: 0
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_b:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [b]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 1
|
|
- open_3: 0
|
|
- open_4: 1
|
|
- open_5: 0
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 0
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_c:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [c]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 0
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 0
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_ab:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [a, b]
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 1
|
|
- open_3: 0
|
|
- open_4: 1
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_bc:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [b, c]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 1
|
|
- open_3: 1
|
|
- open_4: 1
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_abc:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [a, b, c]
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 1
|
|
- open_3: 1
|
|
- open_4: 1
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
run_tags_d:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [d]
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 0
|
|
- open_3: 0
|
|
- open_4: 0
|
|
- open_5: 0
|
|
- open_6: 0
|
|
- open_7: 0
|
|
- open_8: 0
|
|
- open_9: 0
|
|
- open_10: 0
|
|
- open_11: 1
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
# Trying one of the combinations with a ruleset specified. Should get same output and no errors.
|
|
run_tags_c_ruleset:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
run_tags: [c]
|
|
ruleset: my-ruleset
|
|
detect_counts:
|
|
- open_1: 0
|
|
- open_2: 0
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 0
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 0
|
|
- open_12: 0
|
|
- open_13: 0
|
|
|
|
# Disabling one rule with a ruleset specified. Should get that one rule missing and no errors.
|
|
disabled_with_ruleset:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
disabled_rules:
|
|
- "open_4"
|
|
ruleset: my-ruleset
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 1
|
|
- open_3: 1
|
|
- open_4: 0
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|
|
|
|
# Enabling all rules with a ruleset specified. Should get all rules matching.
|
|
default_with_ruleset:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/tagged_rules.yaml
|
|
trace_file: trace_files/open-multiple-files.scap
|
|
ruleset: my-ruleset
|
|
detect_counts:
|
|
- open_1: 1
|
|
- open_2: 1
|
|
- open_3: 1
|
|
- open_4: 1
|
|
- open_5: 1
|
|
- open_6: 1
|
|
- open_7: 1
|
|
- open_8: 1
|
|
- open_9: 1
|
|
- open_10: 1
|
|
- open_11: 1
|
|
- open_12: 1
|
|
- open_13: 1
|