falco
falco copied to clipboard
Reject mismatched sources rules changes
What type of PR is this?
Uncomment one (or more)
/kind <>
lines:
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind release
Any specific area of the project related to this PR?
Uncomment one (or more)
/area <>
lines:
/area build
/area engine
/area tests
/area proposals
/area CI
What this PR does / why we need it: This fixes a bug where a second rule definition for a different source is mistakenly combined with the first rule definition of a different source. This now returns the same error as when defining a second rule.
Which issue(s) this PR fixes:
Fixes https://github.com/falcosecurity/falco/issues/3382
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
Explicitly disallow appending/modifying a rule with different sources.