Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot add rules with multiple key filters #158

Open
KSpaceer opened this issue Jun 25, 2024 · 0 comments
Open

Cannot add rules with multiple key filters #158

KSpaceer opened this issue Jun 25, 2024 · 0 comments

Comments

@KSpaceer
Copy link

KSpaceer commented Jun 25, 2024

Hello! Thanks for this great project!

I've encountered a problem: parsed rules with multiple key filters (-F key=<key>) cannot be added to the kernel - an "invalid argument" error is returned.

I use the library like this:

ruleWithTwoKeyFormats := "-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F key=firstkey -F key=secondkey"

r, err := flags.Parse(ruleWithTwoKeyFormats)
if err != nil {
     return err
}

data, err := rule.Build(r)
if err != nil {
     return err
}

if err := client.AddRule(data); err != nil {
    return err
}

fmt.Println("added rule")

When -k <key> syntax is used instead of -F key=<key>, it works correctly. Mixing both formats again leads to this error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant