rules yaml files updated as per yaml linting conditions #238

h4l0gen · 2024-03-22T17:58:01Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

Proposed rule maturity level

Uncomment one (or more) /area <> lines (only for PRs that add or modify rules):

/area maturity-stable

/area maturity-incubating

/area maturity-sandbox

/area maturity-deprecated

What this PR does / why we need it:
to pass yaml lint workflow test.
Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

h4l0gen · 2024-03-22T18:00:12Z

Yaml_lint may fail on some lines. Am looking into them, and fix it ASAP!

github-actions · 2024-03-22T20:37:26Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 1740ba32f196727f6f34e22e91c98f8e0b4b8f2b with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T20:38:01Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 40a1468a19b372fbf455ede472131060851b1f11 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:32:05Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 95e445358b8b0901d4a93b7db3a408f6eec1dfc8 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:32:44Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 0806a17d2dab5d00a13f61e72782014db0b49d09 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:34:40Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 804237cf161c89f45f2af340183b77ff50751688 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:35:16Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 236f8b92ef940ec9953253a4e1d01951639ec0cb with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:45:26Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing e386e2e686d6e023d7b43984de905d31265e9a38 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:46:00Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing ba34e8fdd0d6cb09c52f788a24c1addc3ce1273a with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:57:21Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 07d2b6a65136e9ff807b5bbd4d4bf65dcb572352 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

github-actions · 2024-03-22T21:57:55Z

Rules files suggestions

falco-deprecated_rules.yaml

Comparing 7af2051f65ad6568887e3c1dae1544ff23220784 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

leogr

/hold

~~I've just realized that with this change, we will put the output: on multiple lines, and I'm not sure that is what we want.~~ Never mind, I was wrong, sorry

Update: Anyway, after talking with some other maintainers, we are still determining if this linting style is what we want. I will investigate further and possibly come back with a "rule style" that works for anyone.

h4l0gen · 2024-05-08T13:07:34Z

Hi @leogr, what are your thoughts on this PR? Have we made any decisions yet? Feel free to assign me any related tasks; I would love to work on them.

leogr · 2024-05-08T13:26:32Z

Hi @leogr, what are your thoughts on this PR? Have we made any decisions yet? Feel free to assign me any related tasks; I would love to work on them.

I have only two points:

Line-width: 80 characters are too few, IMO. I'd propose 120 or more (@falcosecurity/rules-maintainers we need to reach a consensus on this - cc @falcosecurity/core-maintainers your opinion is welcome).
Using > in yaml should be avoided since it appends an unwanted new line at the end (see example below)

- example1: 
    bla bla bla
  example2: >
    bla bla bla

👇

[
    {
        "example1": "bla bla bla",
        "example2": "bla bla bla\n"
    }
]

@h4l0gen, you can proceed to update this PR if you want to (it may be useful as a preview of the end result), but we need to reach a consensus on the style before merging it.

leogr · 2024-05-22T09:44:42Z

Hi @leogr, what are your thoughts on this PR? Have we made any decisions yet? Feel free to assign me any related tasks; I would love to work on them.

I have only two points:

Line-width: 80 characters are too few, IMO. I'd propose 120 or more (@falcosecurity/rules-maintainers we need to reach a consensus on this - cc @falcosecurity/core-maintainers your opinion is welcome).

Using > in yaml should be avoided since it appends an unwanted new line at the end (see example below)
- example1: 
    bla bla bla
  example2: >
    bla bla bla
👇
[
    {
        "example1": "bla bla bla",
        "example2": "bla bla bla\n"
    }
]
@h4l0gen, you can proceed to update this PR if you want to (it may be useful as a preview of the end result), but we need to reach a consensus on the style before merging it.

@falcosecurity/rules-maintainers @darryk10 @loresuso any thoughts on my above proposal?

darryk10 · 2024-05-22T13:19:07Z

Hi @leogr, what are your thoughts on this PR? Have we made any decisions yet? Feel free to assign me any related tasks; I would love to work on them.

I have only two points:

Line-width: 80 characters are too few, IMO. I'd propose 120 or more (@falcosecurity/rules-maintainers we need to reach a consensus on this - cc @falcosecurity/core-maintainers your opinion is welcome).

Using > in yaml should be avoided since it appends an unwanted new line at the end (see example below)
- example1: 
    bla bla bla
  example2: >
    bla bla bla
👇
[
    {
        "example1": "bla bla bla",
        "example2": "bla bla bla\n"
    }
]
@h4l0gen, you can proceed to update this PR if you want to (it may be useful as a preview of the end result), but we need to reach a consensus on the style before merging it.
@falcosecurity/rules-maintainers @darryk10 @loresuso any thoughts on my above proposal?

I agree with both points.
If we can remove the < , it would simplify the overall syntax, and it would be easier to maintain.

h4l0gen · 2024-05-24T18:16:45Z

Hi @leogr, Sorry for being late, I am a little busy nowadays 😅. I'll be back, just give me a week 🙏. I will make changes as per your and other maintainers' suggestions.

h4l0gen · 2024-05-25T05:00:09Z

@leogr If we increase line length value, we will solve many issues of formatting, as I've accepted this format

- example1: 
    bla bla bla
  example2: >
    bla bla bla

Above this one

[
    {
        "example1": "bla bla bla",
        "example2": "bla bla bla\n"
    }
]

as it gives line-length issue. So my vote to increase line length value.

poiana · 2024-06-28T13:42:44Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: h4l0gen
Once this PR has been reviewed and has the lgtm label, please ask for approval from leogr. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

rules/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2024-06-28T13:43:56Z

Rules files suggestions

falco-sandbox_rules.yaml

Comparing b8a2223fd4364cc1e3877e55f5fd3cc3d1b724a1 with latest tag falco-sandbox-rules-4.0.0

Major changes:

Macro etckeeper_activities has been removed
Macro etckeeper has been removed

Minor changes:

Rule BPF Program Not Profiled has been added
Macro bpf_profiled_procs has been added
List bpf_profiled_binaries has been added

Patch changes:

List user_known_k8s_ns_kube_system_images has some item added or removed

falco-deprecated_rules.yaml

Comparing b8a2223fd4364cc1e3877e55f5fd3cc3d1b724a1 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

falco_rules.yaml

Comparing b8a2223fd4364cc1e3877e55f5fd3cc3d1b724a1 with latest tag falco-rules-3.1.0

Major changes:

Macro known_drop_and_execute_activities has been removed

Patch changes:

List falco_privileged_images has some item added or removed

falco-incubating_rules.yaml

Comparing b8a2223fd4364cc1e3877e55f5fd3cc3d1b724a1 with latest tag falco-incubating-rules-4.0.0

Major changes:

Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been removed
Rule BPF Program Not Profiled has been removed
Macro bpf_profiled_procs has been removed
List bpf_profiled_binaries has been removed

Patch changes:

List falco_privileged_images has some item added or removed

h4l0gen · 2024-06-29T06:49:57Z

Hi @leogr, need your confirmation, which one you prefer

- macro: inbound
  condition:
    (((evt.type in (accept,accept4,listen) and evt.dir=<) or
      (evt.type in (recvfrom,recvmsg) and evt.dir=< and
       fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS))

or

- macro: inbound
  condition:
    (
     (
      (evt.type in (accept,accept4,listen) and evt.dir=<) or
      (evt.type in (recvfrom,recvmsg) and evt.dir=< and fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)
     ) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS)
   )

Signed-off-by: h4l0gen <[email protected]> rules files are updated Signed-off-by: h4l0gen <[email protected]> updated rule files Signed-off-by: h4l0gen <[email protected]> updated rules file Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updated falco rules files Signed-off-by: h4l0gen <[email protected]> updating Signed-off-by: h4l0gen <[email protected]> final Signed-off-by: h4l0gen <[email protected]> final Signed-off-by: h4l0gen <[email protected]> final Signed-off-by: h4l0gen <[email protected]> tags format updated Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]> format updated Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]> updated Signed-off-by: h4l0gen <[email protected]>

Signed-off-by: h4l0gen <[email protected]>

github-actions · 2024-06-30T19:07:02Z

Rules files suggestions

falco-sandbox_rules.yaml

Comparing c105a423700e2ee5b4414a8cc17cdf1b57e47cb9 with latest tag falco-sandbox-rules-4.0.0

Major changes:

Macro etckeeper_activities has been removed
Macro etckeeper has been removed

Minor changes:

Rule BPF Program Not Profiled has been added
Macro bpf_profiled_procs has been added
List bpf_profiled_binaries has been added

Patch changes:

List safe_etc_dirs has some item added or removed
List user_known_k8s_ns_kube_system_images has some item added or removed

falco-deprecated_rules.yaml

Comparing c105a423700e2ee5b4414a8cc17cdf1b57e47cb9 with latest tag falco-deprecated-rules-3.0.0

Major changes:

Rule Disallowed SSH Connection has less tags than before

Patch changes:

Rule Disallowed SSH Connection has more tags than before

falco_rules.yaml

Comparing c105a423700e2ee5b4414a8cc17cdf1b57e47cb9 with latest tag falco-rules-3.1.0

Major changes:

Macro known_drop_and_execute_activities has been removed

Patch changes:

List falco_privileged_images has some item added or removed

falco-incubating_rules.yaml

Comparing c105a423700e2ee5b4414a8cc17cdf1b57e47cb9 with latest tag falco-incubating-rules-4.0.0

Major changes:

Rule BPF Program Not Profiled has been removed
Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been removed
Macro bpf_profiled_procs has been removed
List bpf_profiled_binaries has been removed

Patch changes:

List falco_privileged_images has some item added or removed

leogr · 2024-07-18T14:06:15Z

Hi @leogr, need your confirmation, which one you prefer

- macro: inbound
  condition:
    (((evt.type in (accept,accept4,listen) and evt.dir=<) or
      (evt.type in (recvfrom,recvmsg) and evt.dir=< and
       fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS))

or

- macro: inbound
  condition:
    (
     (
      (evt.type in (accept,accept4,listen) and evt.dir=<) or
      (evt.type in (recvfrom,recvmsg) and evt.dir=< and fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)
     ) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS)
   )

I prefer the first one.

poiana · 2024-10-16T16:11:28Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana · 2024-11-15T16:12:07Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana added kind/failing-test dco-signoff: yes area/rules labels Mar 22, 2024

poiana requested review from darryk10 and Kaizhe March 22, 2024 17:58

poiana added the size/XXL label Mar 22, 2024

h4l0gen force-pushed the linted-falco-rules branch 5 times, most recently from 0c88cb0 to 07cfd7c Compare March 22, 2024 20:36

h4l0gen force-pushed the linted-falco-rules branch 4 times, most recently from 9d1d2b3 to 1f2926e Compare March 22, 2024 21:31

h4l0gen force-pushed the linted-falco-rules branch from 28a1985 to f9bee5f Compare March 22, 2024 21:33

h4l0gen force-pushed the linted-falco-rules branch from 58da868 to c81a986 Compare March 22, 2024 21:44

h4l0gen force-pushed the linted-falco-rules branch from 4e2352d to 2c98e4f Compare March 22, 2024 21:56

h4l0gen force-pushed the linted-falco-rules branch from 35b534a to 068de7f Compare March 22, 2024 22:14

poiana assigned leogr Mar 26, 2024

leogr reviewed Mar 26, 2024

View reviewed changes

poiana added the do-not-merge/hold label Mar 26, 2024

leogr added this to the falco-0.38-rules milestone Mar 26, 2024

leogr mentioned this pull request Apr 29, 2024

fix: the correct usage is <NA> not N/A #244

Merged

h4l0gen changed the title ~~rules yaml files updated as per yaml linting conditions~~ wip: rules yaml files updated as per yaml linting conditions Jun 28, 2024

poiana added the do-not-merge/work-in-progress label Jun 28, 2024

h4l0gen force-pushed the linted-falco-rules branch from 4ed334b to faec9cc Compare June 28, 2024 13:42

h4l0gen added 2 commits June 30, 2024 19:04

changes according to line-length<130 and modifiers are removed

81a4b92

Signed-off-by: h4l0gen <[email protected]>

h4l0gen force-pushed the linted-falco-rules branch from faec9cc to 81a4b92 Compare June 30, 2024 19:05

h4l0gen changed the title ~~wip: rules yaml files updated as per yaml linting conditions~~ rules yaml files updated as per yaml linting conditions Jul 5, 2024

poiana removed the do-not-merge/work-in-progress label Jul 5, 2024

leogr mentioned this pull request Aug 28, 2024

Improve rule files validity checking falcosecurity/falco#1332

Open

poiana added the lifecycle/stale label Oct 16, 2024

poiana added lifecycle/rotten and removed lifecycle/stale labels Nov 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rules yaml files updated as per yaml linting conditions #238

rules yaml files updated as per yaml linting conditions #238

h4l0gen commented Mar 22, 2024

h4l0gen commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

leogr left a comment •

edited

Loading

h4l0gen commented May 8, 2024

leogr commented May 8, 2024

leogr commented May 22, 2024

darryk10 commented May 22, 2024

h4l0gen commented May 24, 2024

h4l0gen commented May 25, 2024

poiana commented Jun 28, 2024

github-actions bot commented Jun 28, 2024

h4l0gen commented Jun 29, 2024

github-actions bot commented Jun 30, 2024

leogr commented Jul 18, 2024

poiana commented Oct 16, 2024

poiana commented Nov 15, 2024

rules yaml files updated as per yaml linting conditions #238

Are you sure you want to change the base?

rules yaml files updated as per yaml linting conditions #238

Conversation

h4l0gen commented Mar 22, 2024

h4l0gen commented Mar 22, 2024

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

github-actions bot commented Mar 22, 2024

Rules files suggestions

falco-deprecated_rules.yaml

leogr left a comment • edited Loading

Choose a reason for hiding this comment

h4l0gen commented May 8, 2024

leogr commented May 8, 2024

leogr commented May 22, 2024

darryk10 commented May 22, 2024

h4l0gen commented May 24, 2024

h4l0gen commented May 25, 2024

poiana commented Jun 28, 2024

github-actions bot commented Jun 28, 2024

Rules files suggestions

falco-sandbox_rules.yaml

falco-deprecated_rules.yaml

falco_rules.yaml

falco-incubating_rules.yaml

h4l0gen commented Jun 29, 2024

github-actions bot commented Jun 30, 2024

Rules files suggestions

falco-sandbox_rules.yaml

falco-deprecated_rules.yaml

falco_rules.yaml

falco-incubating_rules.yaml

leogr commented Jul 18, 2024

poiana commented Oct 16, 2024

poiana commented Nov 15, 2024

leogr left a comment •

edited

Loading