Skip to content

Commit f6167c2

Browse files
authored
[CWS] Don't skip remaining rule actions on kill error (#46011)
### What does this PR do? Don't skip remaining rule actions on errors in kill or network_filter actions ### Motivation ### Describe how you validated your changes ### Additional Notes Co-authored-by: yoann.ghigoff <yoann.ghigoff@datadoghq.com>
1 parent c15069c commit f6167c2

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

pkg/security/probe/probe_ebpf.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3399,7 +3399,7 @@ func (p *EBPFProbe) HandleActions(ctx *eval.Context, rule *rules.Rule) {
33993399
case action.Def.Kill != nil:
34003400
// do not handle kill action on event with error
34013401
if ev.Error != nil {
3402-
return
3402+
continue
34033403
}
34043404

34053405
tryToKill, report := p.processKiller.KillAndReport(action.Def.Kill, rule, ev)
@@ -3425,7 +3425,7 @@ func (p *EBPFProbe) HandleActions(ctx *eval.Context, rule *rules.Rule) {
34253425
}
34263426
case action.Def.NetworkFilter != nil:
34273427
if !p.config.RuntimeSecurity.EnforcementEnabled {
3428-
return
3428+
continue
34293429
}
34303430

34313431
var policy rawpacket.Policy

pkg/security/probe/probe_ebpfless.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -660,7 +660,7 @@ func (p *EBPFLessProbe) HandleActions(ctx *eval.Context, rule *rules.Rule) {
660660
case action.Def.Kill != nil:
661661
// do not handle kill action on event with error
662662
if ev.Error != nil {
663-
return
663+
continue
664664
}
665665
tryToKill, _ := p.processKiller.KillAndReport(action.Def.Kill, rule, ev)
666666
if tryToKill {

0 commit comments

Comments
 (0)