Can mistakenly append to a base rule from a rule with a different source.

[mstemm]

Describe the bug

There is a bug in rule loading where a second rule definition with a different source and append: true is mistakenly being combined with the original rule instead of reporting an error.

How to reproduce it

Put this content in a file invalid_append.yaml and try to validate it with falco using falco -V ./invalid_append.yaml. You need to enable the k8saudit plugin.

- rule: my rule
  desc: Some desc
  condition: evt.name[xxx]=true
  output: some output
  priority: INFO
  source: k8s_audit

- rule: my rule
  desc: Some desc
  condition: and proc.name=apache
  output: Some output
  priority: INFO
  source: syscall
  append: true

You get this validation error. Note that the second rule condition is appended to the first rule when it should not:

./invalid_append.yaml: Invalid
1 Errors:
In rules content: (./invalid_append.yaml:0:0)
    rule 'my rule': (./invalid_append.yaml:0:2)
    rule condition: (./invalid_append.yaml:2:13)
    condition expression: ("evt.name[xxx]=t...":3:14)
------
evt.name[xxx]=true and proc.name=apache
                                        ^
------
LOAD_ERR_COMPILE_CONDITION (Error compiling condition): filter_check called with nonexistent field evt.name[xxx]

Expected behaviour

Instead, the rule loader should return the same error that you get when defining a rule again with a different source "Rule has been re-defined with a different source".

Screenshots

Environment

• Falco version: 0.39.0
• System info: { "machine": "x86_64", "nodename": "mstemm-ubuntu-2004", "release": "5.15.0-113-generic", "sysname": "Linux", "version": "#123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024" }
• Cloud provider or hardware configuration: None
• OS: PRETTY_NAME="Ubuntu 22.04.4 LTS" NAME="Ubuntu" VERSION_ID="22.04" VERSION="22.04.4 LTS (Jammy Jellyfish)" VERSION_CODENAME=jammy ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=jammy
• Kernel: Linux mstemm-ubuntu-2004 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
• Installation method: DEB

Additional context