mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
c140b23678
Add test that cover reading from multiple sets of rule files and
disabling rules. Specific changes:
- Modify falco to allow multiple -r arguments to read from multiple
files.
- In the test multiplex file, add a disabled_rules attribute,
containing a sequence of rules to disable. Result in -D arguments
when running falco.
- In the test multiplex file, 'rules_file' can be a sequence. It
results in multiple -r arguments when running falco.
- In the test multiplex file, 'detect_level' can be a squence of
multiple severity levels. All levels will be checked for in the
output.
- Move all test rules files to a rules subdirectory and all trace files
to a traces subdirectory.
- Add a small trace file for a simple cat of /dev/null. Used by the
new tests.
- Add the following new tests:
- Reading from multiple files, with the first file being
empty. Ensure that the rules from the second file are properly
loaded.
- Reading from multiple files with the last being empty. Ensures
that the empty file doesn't overwrite anything from the first
file.
- Reading from multiple files with varying severity levels for each
rule. Ensures that both files are properly read.
- Disabling rules from a rules file, both with full rule names
and regexes. Will result in not detecting anything.
108 lines
3.1 KiB
YAML
108 lines
3.1 KiB
YAML
trace_files: !mux
|
|
builtin_rules_no_warnings:
|
|
detect: False
|
|
trace_file: trace_files/empty.scap
|
|
rules_warning: False
|
|
|
|
test_warnings:
|
|
detect: False
|
|
trace_file: trace_files/empty.scap
|
|
rules_file: rules/falco_rules_warnings.yaml
|
|
rules_warning:
|
|
- no_evttype
|
|
- evttype_not_equals
|
|
- leading_not
|
|
- not_equals_at_end
|
|
- not_at_end
|
|
- not_before_trailing_evttype
|
|
- not_equals_before_trailing_evttype
|
|
- not_equals_and_not
|
|
- not_equals_before_in
|
|
- not_before_in
|
|
- not_in_before_in
|
|
- leading_in_not_equals_before_evttype
|
|
- leading_in_not_equals_at_evttype
|
|
- not_with_evttypes
|
|
- not_with_evttypes_addl
|
|
- not_equals_before_evttype
|
|
- not_equals_before_in_evttype
|
|
- not_before_evttype
|
|
- not_before_evttype_using_in
|
|
rules_events:
|
|
- no_warnings: [execve]
|
|
- no_evttype: [all]
|
|
- evttype_not_equals: [all]
|
|
- leading_not: [all]
|
|
- not_equals_after_evttype: [execve]
|
|
- not_after_evttype: [execve]
|
|
- leading_trailing_evttypes: [execve,open]
|
|
- leading_multtrailing_evttypes: [connect,execve,open]
|
|
- leading_multtrailing_evttypes_using_in: [connect,execve,open]
|
|
- not_equals_at_end: [all]
|
|
- not_at_end: [all]
|
|
- not_before_trailing_evttype: [all]
|
|
- not_equals_before_trailing_evttype: [all]
|
|
- not_equals_and_not: [all]
|
|
- not_equals_before_in: [all]
|
|
- not_before_in: [all]
|
|
- not_in_before_in: [all]
|
|
- evttype_in: [execve,open]
|
|
- evttype_in_plus_trailing: [connect,execve,open]
|
|
- leading_in_not_equals_before_evttype: [all]
|
|
- leading_in_not_equals_at_evttype: [all]
|
|
- not_with_evttypes: [all]
|
|
- not_with_evttypes_addl: [all]
|
|
- not_equals_before_evttype: [all]
|
|
- not_equals_before_in_evttype: [all]
|
|
- not_before_evttype: [all]
|
|
- not_before_evttype_using_in: [all]
|
|
- repeated_evttypes: [open]
|
|
- repeated_evttypes_with_in: [open]
|
|
- repeated_evttypes_with_separate_in: [open]
|
|
- repeated_evttypes_with_mix: [open]
|
|
|
|
multiple_rules_first_empty:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules_last_empty:
|
|
detect: True
|
|
detect_level: WARNING
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/empty_rules.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
multiple_rules:
|
|
detect: True
|
|
detect_level:
|
|
- WARNING
|
|
- INFO
|
|
- ERROR
|
|
rules_file:
|
|
- rules/single_rule.yaml
|
|
- rules/double_rule.yaml
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_rules:
|
|
detect: False
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
disabled_rules:
|
|
- open_from_cat
|
|
trace_file: trace_files/cat_write.scap
|
|
|
|
disabled_rules_using_regex:
|
|
detect: False
|
|
rules_file:
|
|
- rules/empty_rules.yaml
|
|
- rules/single_rule.yaml
|
|
disabled_rules:
|
|
- "open.*"
|
|
trace_file: trace_files/cat_write.scap
|