From 6b3a5da343cf3e32102c8f841ee63019edb99fe9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gustavo=20I=C3=B1iguez=20Goia?= Date: Fri, 10 Nov 2023 11:28:54 +0100 Subject: [PATCH] Control checksums feature from a global cfg item Previously it was enabled only if at least 1 rule had a checksum item configured. Enable by default md5. --- daemon/rule/loader.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/daemon/rule/loader.go b/daemon/rule/loader.go index 4704e61e..8cc28b28 100644 --- a/daemon/rule/loader.go +++ b/daemon/rule/loader.go @@ -68,6 +68,7 @@ func (l *Loader) EnableChecksums(enable bool) { log.Debug("[rules loader] EnableChecksums: %v", enable) l.checkSums = enable procmon.EventsCache.SetComputeChecksums(enable) + procmon.EventsCache.AddChecksumHash(string(OpProcessHashMD5)) } // HasChecksums checks if the rule will check for binary checksum matches @@ -209,13 +210,11 @@ func (l *Loader) loadRule(fileName string) error { } } else { if err := r.Operator.Compile(); err != nil { - l.HasChecksums(r.Operator.Operand) log.Warning("Operator.Compile() error: %s: %s", err, r.Operator.Data) return fmt.Errorf("(1) Error compiling rule: %s", err) } if r.Operator.Type == List { for i := 0; i < len(r.Operator.List); i++ { - l.HasChecksums(r.Operator.List[i].Operand) if err := r.Operator.List[i].Compile(); err != nil { log.Warning("Operator.Compile() error: %s: ", err) return fmt.Errorf("(1) Error compiling list rule: %s", err)