Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(userspace/falco): monitor more types of events for rule directories and files #2965

Merged
merged 1 commit into from Dec 12, 2023

Conversation

NitroCao
Copy link
Contributor

@NitroCao NitroCao commented Dec 12, 2023

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

  • Monitor events of IN_CLOSE_WRITE | IN_MOVE_SELF | IN_DELETE_SELF type for rule files and events of IN_CREATE | IN_DELETE | IN_MOVE type for rule directories.

Which issue(s) this PR fixes:

Fixes #2943

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

update: now the `watch_config_files` config option monitors file/directory moving and deletion, too

Signed-off-by: Nitro Cao <jaycecao520@gmail.com>
@poiana
Copy link

poiana commented Dec 12, 2023

Welcome @NitroCao! It looks like this is your first PR to falcosecurity/falco 🎉

@poiana poiana requested review from Kaizhe and leogr December 12, 2023 02:38
@poiana poiana added the size/XS label Dec 12, 2023
@leogr
Copy link
Member

leogr commented Dec 12, 2023

Nice!

cc @FedeDP the original author of this feature

@FedeDP
Copy link
Contributor

FedeDP commented Dec 12, 2023

Makes sense! Thank you!
/milestone 0.37.0

@poiana poiana added this to the 0.37.0 milestone Dec 12, 2023
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link

poiana commented Dec 12, 2023

LGTM label has been added.

Git tree hash: 756f5efc6c8e4f6450ad19141193c3485e7a2ef6

Copy link
Contributor

@incertum incertum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link

poiana commented Dec 12, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, incertum, leogr, NitroCao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [FedeDP,incertum,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 4bfc42e into falcosecurity:master Dec 12, 2023
28 checks passed
@NitroCao NitroCao deleted the enhance-rule-monitor branch December 13, 2023 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

mv file /etc/falco/rule.d/ will not cause falco to restart, but cp -r file /etc/falco/rule.d/file can
5 participants