Custom macro expansion issues in falco_rules.local.yaml

[JPLachance]

Greetings,

I an trying to define some custom conditions in the user_read_sensitive_file_conditions macro. That macro is defined in falco_rules.yaml and I'm overriding it in falco_rules.local.yaml.

To make my YAML file cleaner, I'm defining the following macro:

- macro: puppet_access_sudoers
  condition: proc.name=puppet and proc.cmdline="puppet /usr/bin/puppet agent" and fd.name startswith "/etc/sudoers"

Then, I'm using the puppet_access_sudoers in the override of user_read_sensitive_file_conditions:

- macro: user_read_sensitive_file_conditions
  condition: puppet_access_sudoers

The result is the following error:

Fri Jan 25 22:02:20 2019: Runtime error: Error loading rules: /usr/share/falco/lua/compiler.lua:78: Undefined macro 'puppet_access_sudoers' used in filter.. Exiting.

The puppet_access_sudoers is defined above the override user_read_sensitive_file_conditions, but the Lua compiler fails to find it.

A workaround is the following:

- macro: user_read_sensitive_file_conditions
  condition: proc.name=puppet and proc.cmdline="puppet /usr/bin/puppet agent" and fd.name startswith "/etc/sudoers"

It works, but it will be more complicated to maintain. :)

Thanks for your help!

[mfdii]

@mstemm any thoughts on why the Lua compiler isn't working for this macro?

[mstemm]

When I debugged it with him, I think it had to due to the fact that the user macro was in a separate file.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JPLachance]

Hello! I think we need this one because it will allow users to make their rules cleaner 🙂

[mstemm]

Ok, reopening.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[leodido]

Related to #706

[fntlnz]

I think we can close this since it had been detailed a lot more in #706 - wdyt @JPLachance ?

[JPLachance]

Have fun! :)