search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
648 stars 179 forks source link

Support a "is_global" and "is_private" member on Rules. #130

Closed wxsBSD closed 4 years ago

wxsBSD commented 4 years ago

When writing linters it is currently impossible to know (via rule introspection) if a given rule is private or global. We have banned global rules for our use case and we have to resort to a janky regex against our rules files to know if anyone is about to commit a global rule. I figure exposing these two flags via python will be useful for programatically checking those bits.

I'm not very pleased with the name "is_global" - I wanted to go with just "global" and "private" but "global" is a reserved keyword and rule.global breaks the python interpreter. I'm open to changing the member names if you have any suggestions.

wxsBSD commented 4 years ago

I know you're working on bringing in changes for 4.0 but pulling this in would make my life at work a bit easier (we can remove some janky checks for global rules and filter private rules easier). Curious if you plan to merge this for 4.0?