From 1c66b640f255569b33d14d6f2e9c09668020329a Mon Sep 17 00:00:00 2001 From: Gianmatteo Palmieri Date: Tue, 4 Jun 2024 18:02:00 +0200 Subject: [PATCH] Revert "fix(engine): apply output substitutions for all sources" This reverts commit 4ef7c9553aaea2bfe75aa867650c7e9745c2909f. Signed-off-by: Gianmatteo Palmieri --- userspace/engine/rule_loader_compiler.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp index 96a499e8a50..4bf24c61bda 100644 --- a/userspace/engine/rule_loader_compiler.cpp +++ b/userspace/engine/rule_loader_compiler.cpp @@ -509,7 +509,10 @@ void rule_loader::compiler::compile_rule_infos( // build rule output message rule.output = r.output; - apply_output_substitutions(cfg, rule.output); + if (r.source == falco_common::syscall_source) + { + apply_output_substitutions(cfg, rule.output); + } // validate the rule's output if(!is_format_valid(*cfg.sources.at(r.source), rule.output, err))