diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 3731c6ff2f8..cad3029b9fd 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -641,6 +641,14 @@ trace_files: !mux - rules/disabled_rule_using_enabled_flag_only.yaml trace_file: trace_files/cat_write.scap + enabled_rule_using_false_enabled_flag_only: + detect: True + detect_level: WARNING + rules_file: + - rules/enabled_rule_using_enabled_flag_only.yaml + trace_file: trace_files/cat_write.scap + stdout_contains: "Warning An open was seen" + disabled_and_enabled_rules_1: exit_status: 1 stderr_contains: "Runtime error: You can not specify both disabled .-D/-T. and enabled .-t. rules. Exiting." diff --git a/test/rules/enabled_rule_using_enabled_flag_only.yaml b/test/rules/enabled_rule_using_enabled_flag_only.yaml new file mode 100644 index 00000000000..c27be642ebf --- /dev/null +++ b/test/rules/enabled_rule_using_enabled_flag_only.yaml @@ -0,0 +1,25 @@ +# +# Copyright (C) 2021 The Falco Authors. +# +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +- rule: open_from_cat + desc: A process named cat does an open + condition: evt.type=open and proc.name=cat + output: "An open was seen" + priority: WARNING + enabled: false + +- rule: open_from_cat + enabled: true