Merge pull request #162 from kubescape/empty

skip exec events with empty path
kubescape · Dec 21, 2023 · 2d895fc · 2d895fc
2 parents 85abd9b + 19d637b
commit 2d895fc
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/pkg/applicationprofilemanager/v1/applicationprofile_manager.go b/pkg/applicationprofilemanager/v1/applicationprofile_manager.go
@@ -356,6 +356,10 @@ func (am *ApplicationProfileManager) ReportCapability(k8sContainerID, capability
 }
 
 func (am *ApplicationProfileManager) ReportFileExec(k8sContainerID, path string, args []string) {
+	// skip empty path
+	if path == "" {
+		return
+	}
 	execMap := am.execSets.Get(k8sContainerID)
 	if execMap.Has(path) {
 		execMap.Get(path).Append(args...)

diff --git a/pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go b/pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go
@@ -52,6 +52,7 @@ func TestApplicationProfileManager(t *testing.T) {
 	// report capability
 	am.ReportCapability("ns/pod/cont", "NET_BIND_SERVICE")
 	// report file exec
+	am.ReportFileExec("ns/pod/cont", "", []string{"ls"})
 	am.ReportFileExec("ns/pod/cont", "/bin/bash", []string{"-c", "ls"})
 	// report file open
 	am.ReportFileOpen("ns/pod/cont", "/etc/passwd", []string{"O_RDONLY"})