Use falcoctl 0.0.4+ tests for space/dash psp names

Use falcoctl, which properly handles psp names containing spaces/dashes. Also add tests that verify that the resulting rules are valid. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
falcosecurity · Oct 24, 2019 · b18050d · b18050d
1 parent 5c61276
commit b18050d
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 2 deletions.
diff --git a/test/falco_test.py b/test/falco_test.py
@@ -43,7 +43,7 @@ def setUp(self):
         self.falcodir = self.params.get('falcodir', '/', default=build_dir)
 
         self.psp_conv_path = os.path.join(build_dir, "falcoctl")
-        self.psp_conv_url = "https://github.com/falcosecurity/falcoctl/releases/download/v0.0.3/falcoctl-0.0.3-linux-amd64"
+        self.psp_conv_url = "https://github.com/falcosecurity/falcoctl/releases/download/v0.0.4/falcoctl-0.0.4-linux-amd64"
 
         self.stdout_is = self.params.get('stdout_is', '*', default='')
         self.stderr_is = self.params.get('stderr_is', '*', default='')

diff --git a/test/falco_tests_psp.yaml b/test/falco_tests_psp.yaml
@@ -643,4 +643,24 @@ trace_files: !mux
     rules_file: []
     conf_file: confs/psp.yaml
     psp_file: psps/allowed_proc_mount_types.yaml
-    trace_file: trace_files/psp/proc_mount_type_default.json
+    trace_file: trace_files/psp/proc_mount_type_default.json
+
+  psp_name_with_dashes:
+    detect: True
+    detect_level: WARNING
+    detect_counts:
+      - "PSP no_privileged Violation (privileged) System Activity": 1
+    rules_file: []
+    conf_file: confs/psp.yaml
+    psp_file: psps/privileged_name_with_dashes.yaml
+    trace_file: trace_files/psp/privileged.scap
+
+  psp_name_with_spaces:
+    detect: True
+    detect_level: WARNING
+    detect_counts:
+      - "PSP no_privileged Violation (privileged) System Activity": 1
+    rules_file: []
+    conf_file: confs/psp.yaml
+    psp_file: psps/privileged_name_with_spaces.yaml
+    trace_file: trace_files/psp/privileged.scap
diff --git a/test/psps/privileged_name_with_dashes.yaml b/test/psps/privileged_name_with_dashes.yaml
@@ -0,0 +1,8 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  annotations:
+    falco-rules-psp-images: "[nginx]"
+  name: no-privileged
+spec:
+  privileged: false
diff --git a/test/psps/privileged_name_with_spaces.yaml b/test/psps/privileged_name_with_spaces.yaml
@@ -0,0 +1,8 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  annotations:
+    falco-rules-psp-images: "[nginx]"
+  name: no privileged
+spec:
+  privileged: false