Allow overrides #177
Merged
Allow overrides #177
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add the ability to clear the set of loaded rules from lua. It simply recreates the sinsp_evttype_filter instance m_evttype_filter, which is now a unique_ptr.
Allow any list/macro/rule to be overridden by a subsequent file. The
persistent state that lives across invocations of load_rules are the 3
arrays ordered_{list,macro,rule}_names, which have the
lists/macros/rules in the order in which they first appear, and tables
{rules,macros,lists}_by_name, which maps from a name to a yaml object.
With each call to load_rules, the set of loaded rules is reset and the
state of expanded lists, compiled macros, compiled rules, and rule
metadata are recreated from scratch, using the ordered_*_names arrays
and *_by_name tables. That way, any list/macro/rule can be redefined in
a subsequent file with new values.
New tests that test every possible override: - Overriding a rule with one that doesn't match - Overriding a macro to one that doesn't match - Overriding a top level list to a binary that doesn't match - Overriding an embedded list to one that doesn't match In each case, the override results in no longer matching an open by the program "cat".
mstemm
added a commit
that referenced
this pull request
Dec 30, 2016
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix #177.
mstemm
added a commit
that referenced
this pull request
Dec 30, 2016
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix #177. Also switch to using pmatch (parallel prefix search) to make the rule cleaner and faster.
mstemm
added a commit
that referenced
this pull request
Dec 30, 2016
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix #177. Also reformat to avoid long lines.
mstemm
added a commit
that referenced
this pull request
Dec 30, 2016
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix #177. Also reformat to avoid long lines.
mstemm
added a commit
that referenced
this pull request
Jan 27, 2017
We had added this image while the changes in #177 made it to everyone. This is in a release now, so we'll remove it from the rule set.
Merged
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix falcosecurity/falco#177. Also reformat to avoid long lines.
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
We had added this image while the changes in falcosecurity/falco#177 made it to everyone. This is in a release now, so we'll remove it from the rule set.
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
Add cchh/sysdig as a trusted container. We'll probably remove this once the next agent release occurs that has the fix falcosecurity/falco#177. Also reformat to avoid long lines.
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
We had added this image while the changes in falcosecurity/falco#177 made it to everyone. This is in a release now, so we'll remove it from the rule set.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Allow a subsequent yaml file to override a list, macro, or rule specified in a prior yaml file.
This fixes #176.