Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v0.16.0] fix: derived event not triggering if base filtered #3287

Merged

Conversation

josedonizetti
Copy link
Collaborator

1. Explain what the PR does

commit: 00f71ab (main), cherry-pick

The bug happens because we pass a different event to matchPolicies inside the for, instead of passing the event that goes down the pipeline, so the logic of changing the bitmap is lost, because it happened on different events.

2. Explain how to test it

name: pol1
description: general policy
scope:
  - global
defaultActions: 
  - log
rules:
  - event: cgroup_mkdir
    filters:
      - args.cgroup_path!=/system.slice*
  - event: container_create
./dist/tracee -p policy.yaml
docker run ubuntu:latest ls

The container_created should be triggered but not the cgroup_mkdir.

3. Other comments

@rafaeldtinoco rafaeldtinoco changed the title [0.16.0] fix: derived event not triggering if base filtered [v0.16.0] fix: derived event not triggering if base filtered Jun 28, 2023
@rafaeldtinoco rafaeldtinoco merged commit 2b7382e into aquasecurity:v0.16.0 Jun 28, 2023
3 checks passed
@josedonizetti josedonizetti deleted the v0.16.0-fix-derived-events branch June 28, 2023 22:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants