Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix outputs #117

Merged
merged 3 commits into from
Aug 24, 2016
Merged

Fix outputs #117

merged 3 commits into from
Aug 24, 2016

Commits on Aug 23, 2016

  1. Don't alert on falco program notifications. 

    Falco itself spawns a shell when using program notifications, so add
falco to the set of trusted programs. (Also add some other programs like
make, awk, configure, that are run while building).
    @mstemm
    mstemm committed Aug 23, 2016
    Configuration menu
    Copy the full SHA
    3ee1c0f View commit details
    Browse the repository at this point in the history

  2. Fix output methods that take configurations. 

    The falco engine changes broke the output methods that take
configuration (like the filename for file output, or the program for
program output). Fix that by properly passing the options argument to
each method's output function.
    @mstemm
    mstemm committed Aug 23, 2016
    Configuration menu
    Copy the full SHA
    23a9b6e View commit details
    Browse the repository at this point in the history

  3. Add regression tests for configurable outputs. 

     - In the regression tests, make the config file configurable in the
   multiplex file via 'conf_file'.
 - A new multiplex file item 'outputs' containing a list of <filename>:
   <regex> tuples. For each item, the test reads the file and matches
   each line against the regex. A match must be found for the test to
   pass.
 - Add 2 new tests that test file output and program output. They write
   to files below /tmp/falco_outputs/ and the contents are checked to
   ensure that alerts are written.
    @mstemm
    mstemm committed Aug 23, 2016
    Configuration menu
    Copy the full SHA
    ef52e62 View commit details
    Browse the repository at this point in the history