Matched rules #4484
Matched rules #4484
Conversation
github-actions
bot
added
area/ebpf
area/testing
area/UX
area/events
area/build
area/flags
area/grpc
labels
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| PoliciesConfig: *cfg, | ||
| TraceePid: uint32(os.Getpid()), | ||
| Options: t.getOptionsConfig(), | ||
| CgroupV1Hid: uint32(t.cgroups.GetDefaultCgroupHierarchyID()), |
Check failure
Code scanning / CodeQL
Incorrect conversion between integer types High
There was a problem hiding this comment.
I've mentioned about this in #4482 (comment).
yanivagman
force-pushed
the
matched_rules
branch
9 times, most recently
from
2ebef5c to
c8e2c7b
Compare
yanivagman
force-pushed
the
matched_rules
branch
2 times, most recently
from
1f411ed to
6a0c8a7
Compare
| func (e *policyError) Is(target error) bool { | ||
| t, ok := target.(*policyError) | ||
| if !ok { | ||
| return false | ||
| } | ||
| return e.msg == t.msg |
There was a problem hiding this comment.
Perhaps it should be better to rely on the errors.Is() since it takes care of unwrapping.
| PoliciesConfig: *cfg, | ||
| TraceePid: uint32(os.Getpid()), | ||
| Options: t.getOptionsConfig(), | ||
| CgroupV1Hid: uint32(t.cgroups.GetDefaultCgroupHierarchyID()), |
There was a problem hiding this comment.
I've mentioned about this in #4482 (comment).
|
|
||
| if (!(str_filter->exact_enabled || str_filter->prefix_enabled || str_filter->suffix_enabled)) | ||
| return policies_cfg->enabled_policies; | ||
| return ~0ULL; |
There was a problem hiding this comment.
Opportunistic fix? @rscampos FYI.
| // Combine rules that use string filters with those that do not | ||
| res |= mask_no_str_filter_rules; | ||
|
|
||
| return res; |
|
|
||
| program_data_t p = {}; | ||
| if (!init_program_data(&p, ctx, NO_EVENT_SUBMIT)) | ||
| if (!init_program_data(&p, ctx, POLICY_SCOPES)) |
There was a problem hiding this comment.
What does the internal POLICY_SCOPES event must communicate?
| typedef struct event_config { | ||
| u64 submit_for_policies; | ||
| u16 rules_version; | ||
| u8 has_overflow; |
There was a problem hiding this comment.
Could you elaborate more about has_overflow?
pkg/ebpf/events_pipeline.go
Outdated
| continue | ||
| // range through each userland filterable rule | ||
| for _, rule := range t.policyManager.GetUserlandRules(eventID) { | ||
| if rule.ID > 63 { |
There was a problem hiding this comment.
It would be good to use a MaxRules alike const.
yanivagman
force-pushed
the
matched_rules
branch
from
6a0c8a7 to
e1a6b4c
Compare
2 participants
1. Explain what the PR does
WIP
2. Explain how to test it
3. Other comments