Allow unknown sources

[mstemm]

What type of PR is this?

In #1427 rule processing was already relaxed a bit to allow rules to have new properties without failures. This further relaxes processing to completely ignore rules that have a source other than "syscall" or "k8s_audit"., for example:

- rule: Rule with unknown source
  condition: some unknown filteer
  output: some unknown output
  priority: INFO

Without this change, falco will try to read rules with unknown sources and match the filtercheck fields against known supported sets for k8s audit/syscall.

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area rules

/area tests

/area proposals

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Silently allow and ignore rules where the source is something other than "syscall" or "k8s_audit" (or blank, which defaults to "syscall").

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign mstemm after the PR has been reviewed.
You can assign the PR to them by writing /assign @mstemm in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

Please note that the if append then is evaluated after the check to skip unknown sources. So, it seems to me that by doing so, the append property will not be considered for sources other than syscall and k8s_audit.

If that was intended, then I don't understand the reason.

[mstemm]

The idea is to entirely skip rules where the source is something other than syscall/k8s_audit. So that would also mean skipping appending rules to other rules, since the appended rule would be one that falco should skip anyway. I think I got that part right--which if append then were you looking at?

[leogr]

The idea is to entirely skip rules where the source is something other than syscall/k8s_audit. So that would also mean skipping appending rules to other rules, since the appended rule would be one that falco should skip anyway. I think I got that part right--which if append then were you looking at?

Ok, your intent is clear to me now, thanks for the explanation.

Anyway, another point: it is not exactly clear to me (as a user) what's the purpose to silently ignore those rules. It could lead to errors that can be hard to discover (imagine a typo on a filter name that would produce an unknown filter). So, what's the use case, could you provide an example?

[mstemm]

I discussed more with @leogr and I'm going to close this for now. Maybe we'll bring it back when falco starts handling a wider variety of event sources.