filters: flags: change mntns and pidns filter expressions (#2302)

* filters: flags: fail mntns and pidns greater/less Only accept equality and inequality expressions for mntns and pidns. There's no real use cases for greater and less filtering. Their removal is a step of performance improvement for multi-scope feature. * filters: flags: update docs
aquasecurity · Oct 26, 2022 · f51b41a · f51b41a
1 parent df6d661
commit f51b41a
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/cmd/tracee-ebpf/flags/filter.go b/cmd/tracee-ebpf/flags/filter.go
@@ -209,6 +209,9 @@ func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
 		}
 
 		if filterName == "mntns" {
+			if strings.ContainsAny(operatorAndValues, "<>") {
+				return tracee.Filter{}, filters.InvalidExpression(operatorAndValues)
+			}
 			err := filter.MntNSFilter.Parse(operatorAndValues)
 			if err != nil {
 				return tracee.Filter{}, err
@@ -217,6 +220,9 @@ func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
 		}
 
 		if filterName == "pidns" {
+			if strings.ContainsAny(operatorAndValues, "<>") {
+				return tracee.Filter{}, filters.InvalidExpression(operatorAndValues)
+			}
 			err := filter.PidNSFilter.Parse(operatorAndValues)
 			if err != nil {
 				return tracee.Filter{}, err

diff --git a/docs/docs/tracing/event-filtering.md b/docs/docs/tracing/event-filtering.md
@@ -147,13 +147,13 @@ expected.
     1) --trace uts!=ab356bc4dd554 
     ```
 
-1. **PID Namespace** `(Operators: =, !=, <, >)`
+1. **PID Namespace** `(Operators: =, !=)`
 
     ```text
     1) --trace pidns!=4026531836
     ```
 
-1. **MOUNT Namespace** `(Operators: =, !=, <, >)`
+1. **MOUNT Namespace** `(Operators: =, !=)`
 
     ```text
     1) --trace mntns=4026531840