Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add gcc-6 to Dockerfiles #372

Closed
wants to merge 16 commits into from
Closed

Add gcc-6 to Dockerfiles #372

wants to merge 16 commits into from

Conversation

mfdii
Copy link
Member

@mfdii mfdii commented May 30, 2018

gcc-6 is needed to build the kernel module on some platforms (Debian Stretch). Fixes #371

@palmerabollo
Copy link
Contributor

I can confirm that it works. Without this patch, it fails with Debian Stretch as described in #371 (e.g. "k8s-1.9-debian-stretch-amd64-hvm-ebs-2018-03-11 AMI in EC2")

@ApsOps
Copy link

ApsOps commented Jun 11, 2018

@mfdii Hi. Could you please rebase since this is fixed in #379? :)

mstemm and others added 5 commits June 11, 2018 14:29
* Add ability to skip rules for unknown filters

Add the ability to skip a rule if its condition refers to a filtercheck
that doesn't exist. This allows defining a rules file that contains new
conditions that can still has limited backward compatibility with older
falco versions.

When compiling a filter, return a list of filtercheck names that are
present in the ast (which also includes filterchecks from any
macros). This set of filtercheck names is matched against the set of
filterchecks known to sinsp, expressed as lua patterns, and in the
global table defined_filters. If no match is found, the rule loader
throws an error.

The pattern changes slightly depending on whether the filter has
arguments or not. Two filters (proc.apid/proc.aname) can work with or
without arguments, so both styles of patterns are used.

If the rule has an attribute "skip-if-unknown-filter", the rule will be
skipped instead.

* Unit tests for skipping unknown filter

New unit test for skipping unknown filter. Test cases:

 - A rule that refers to an unknown filter results in an error.
 - A rule that refers to an unknown filter, but has
   "skip-if-unknown-filter: true", can be read, but doesn't match any events.
 - A rule that refers to an unknown filter, but has
   "skip-if-unknown-filter: false", returns an error.

Also test the case of a filtercheck like evt.arg.xxx working properly
with the embedded patterns as well as proc.aname/apid which work both ways.
@mfdii
Copy link
Member Author

mfdii commented Jun 12, 2018

@ApsOps done, I think. @mstemm could you make sure I did this right and merge.

@mfdii mfdii closed this Jun 12, 2018
@ApsOps
Copy link

ApsOps commented Jun 12, 2018

@mfdii Why did you close this? 🤔

@mfdii mfdii deleted the mfdii/include_gcc-6 branch June 12, 2018 19:02
@mfdii
Copy link
Member Author

mfdii commented Jun 12, 2018

I messed up the rebase, so it was easier to start over since it's a 3 line change

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants