From 86aae6fec45f34f7515c65da26c00193034cbd59 Mon Sep 17 00:00:00 2001 From: daemon1024 Date: Fri, 29 Mar 2024 16:38:35 +0530 Subject: [PATCH] fix(enforcer): suppress permission denied alerts for any non bpflsm enforcer Signed-off-by: daemon1024 --- KubeArmor/feeder/feeder.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/KubeArmor/feeder/feeder.go b/KubeArmor/feeder/feeder.go index 14f781ebfc..570f2fdc81 100644 --- a/KubeArmor/feeder/feeder.go +++ b/KubeArmor/feeder/feeder.go @@ -518,9 +518,9 @@ func (fd *Feeder) PushLog(log tp.Log) { in case of enforcer = AppArmor only Default Posture logs will be converted to container/host log depending upon the defaultPostureLogs flag */ - if (cfg.GlobalCfg.EnforcerAlerts && fd.Enforcer == "BPFLSM" && log.Enforcer != "BPFLSM") || (fd.Enforcer == "AppArmor" && !cfg.GlobalCfg.DefaultPostureLogs) { + if (cfg.GlobalCfg.EnforcerAlerts && fd.Enforcer == "BPFLSM" && log.Enforcer != "BPFLSM") || (fd.Enforcer != "BPFLSM" && !cfg.GlobalCfg.DefaultPostureLogs) { log = fd.UpdateMatchedPolicy(log) - if (log.Type == "MatchedPolicy" || log.Type == "MatchedHostPolicy") && ((fd.Enforcer == "BPFLSM" && (strings.Contains(log.PolicyName, "DefaultPosture") || !strings.Contains(log.Action, "Audit"))) || (fd.Enforcer == "AppArmor" && strings.Contains(log.PolicyName, "DefaultPosture"))) { + if (log.Type == "MatchedPolicy" || log.Type == "MatchedHostPolicy") && ((fd.Enforcer == "BPFLSM" && (strings.Contains(log.PolicyName, "DefaultPosture") || !strings.Contains(log.Action, "Audit"))) || (fd.Enforcer != "BPFLSM" && strings.Contains(log.PolicyName, "DefaultPosture"))) { if log.Type == "MatchedPolicy" { log.Type = "ContainerLog" } else if log.Type == "MatchedHostPolicy" {