-
Notifications
You must be signed in to change notification settings - Fork 39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added an event for defalult rule "Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)" #156
Added an event for defalult rule "Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)" #156
Conversation
Signed-off-by: GLVS Kiriti <[email protected]>
Closing and reopening to trigger the CI |
/reopen |
@leogr: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Function name must match the rules name as per our convention (see my comment below), otherwise SGTM.
events.WithDisabled(), // this rules is not included in falco_rules.yaml (stable rules), so disable the action | ||
) | ||
|
||
func PolkitLocalPrivilegeEscalationVulnerability(h events.Helper) error { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
func PolkitLocalPrivilegeEscalationVulnerability(h events.Helper) error { | |
func PolkitLocalPrivilegeEscalationVulnerability(h events.Helper) error { |
This won't match the exact rule name, which is Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
I guess the correct name should be PolkitLocalPrivilegeEscalationVulnerabilityCVE20214034,
but I have to double-check.
This convention is important because the tester package relies on that to match rules names:
event-generator/events/registry.go
Lines 87 to 96 in 298059d
// MatchRule returns true if the name of an action matches a given rule. | |
func MatchRule(name string, rule string) bool { | |
parts := strings.Split(name, ".") | |
l := len(parts) | |
if l == 0 { | |
return false | |
} | |
return strings.ToLower(parts[l-1]) == strings.ToLower(nonAlphaNumericReg.ReplaceAllString(rule, "")) | |
} |
Signed-off-by: GLVSKiriti <[email protected]>
LGTM label has been added. Git tree hash: 6a90a3299554faa7b92c3a58ef0562bd02bb2b0d
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: GLVSKiriti, leogr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area events
What this PR does / why we need it:
Added an event for defalult rule "Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)" as mentioned here
Which issue(s) this PR fixes:
Fixes #149
Special notes for your reviewer: