rules
rules copied to clipboard
Duplicated entries across various `falco` rules files
Motivation
See https://github.com/falcosecurity/rules/pull/149#issuecomment-1705527047
The common use case is when a list or a macro is first defined in the stable rules file, but it is also needed (as-is or extended) by other rules files.
Feature
Likely, the simplest way to address this is to define a standard way to express list and macro dependencies requirements.
This would force the user to load another rules file with the missing list or macro definition, without the need of duplicating the whole list or macro.
However, the design of this feature is still TBD
@falcosecurity/core-maintainers
Alternatives
Keep duplicate entries, as it is now. In this way, duplicated items are just silently overwritten. The only con is that the loading order affects the end results when the duplicate item is not identical (for example, if it has been modified in one file but not in the other).
Additional context
See https://github.com/falcosecurity/rules/pull/149#issuecomment-1705527047