search

chainguard-dev / malcontent

#supply #chain #attack #detection
Apache License 2.0
446 stars 31 forks source link

Log an error if an override rule has no underlying, overridden rule #597

Closed egibs closed 1 week ago

egibs commented 1 week ago

Right now, it's not obvious whether an override rule is correctly overriding an underling rule. This PR adds logging to show when this is occurring to help with troubleshooting.

For example:

$ go run cmd/mal/mal.go --format strings analyze ./out/samples-01cc2a1248c20c8a3d2b8b0acff0daf04196d487/linux/clean/cpack
🔎 Scanning "./out/samples-01cc2a1248c20c8a3d2b8b0acff0daf04196d487/linux/clean/cpack"
time=2024-11-06T16:58:43.245-06:00 level=ERROR source=.../repos/chainguard-dev/malcontent/pkg/report/report.go:467 msg="Override fake_override matched with no overridden rule\n" path=out/samples-01cc2a1248c20c8a3d2b8b0acff0daf04196d487/linux/clean/cpack mime=application/x-elf
time=2024-11-06T16:58:43.246-06:00 level=ERROR source=.../repos/chainguard-dev/malcontent/pkg/report/report.go:467 msg="Override fake_override matched with no overridden rule\n" path=out/samples-01cc2a1248c20c8a3d2b8b0acff0daf04196d487/linux/clean/cpack mime=application/x-elf

In this case, a rule named fake_override:

rule fake_override: override {
    meta:
        fakerule="low"
    ...
}

did not match fakerule since it did not exist.