From 4da39ed46fd92df50dcff342b649042a659d793d Mon Sep 17 00:00:00 2001 From: Prateek Date: Thu, 28 Nov 2024 16:04:31 +0530 Subject: [PATCH] fix(policymatcher): secPolicy.Source should be checked with log.Source rather than log.ParentProcessName Signed-off-by: Prateek --- KubeArmor/feeder/policyMatcher.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/KubeArmor/feeder/policyMatcher.go b/KubeArmor/feeder/policyMatcher.go index c1063d466..c369291e3 100644 --- a/KubeArmor/feeder/policyMatcher.go +++ b/KubeArmor/feeder/policyMatcher.go @@ -1299,7 +1299,7 @@ func (fd *Feeder) UpdateMatchedPolicy(log tp.Log) tp.Log { break // break, so that once source is matched for a log it doesn't look for other cases } // match sources - if (!secPolicy.IsFromSource) || (secPolicy.IsFromSource && (secPolicy.Source == log.ParentProcessName || secPolicy.Source == log.ProcessName)) { + if (!secPolicy.IsFromSource) || (secPolicy.IsFromSource && (strings.HasPrefix(log.Source, secPolicy.Source+" ") || secPolicy.Source == log.ProcessName)) { matchedFlags := false protocol := fetchProtocol(log.Resource) @@ -1481,7 +1481,7 @@ func (fd *Feeder) UpdateMatchedPolicy(log tp.Log) tp.Log { continue } // match sources - if (!secPolicy.IsFromSource) || (secPolicy.IsFromSource && (secPolicy.Source == log.ParentProcessName || secPolicy.Source == log.ProcessName)) { + if (!secPolicy.IsFromSource) || (secPolicy.IsFromSource && (strings.HasPrefix(log.Source, secPolicy.Source+" ") || secPolicy.Source == log.ProcessName)) { skip := false for _, matchCapability := range strings.Split(secPolicy.Resource, ",") {