@@ -25,6 +25,7 @@ import (
25
25
"github.com/falcosecurity/testing/pkg/falco"
26
26
"github.com/falcosecurity/testing/tests"
27
27
"github.com/falcosecurity/testing/tests/data/outputs"
28
+ "github.com/falcosecurity/testing/tests/data/rules"
28
29
29
30
"github.com/stretchr/testify/assert"
30
31
)
@@ -155,3 +156,33 @@ func TestFalco_Print_IgnoredEvents(t *testing.T) {
155
156
assert .NoError (t , res .Err (), "%s" , res .Stderr ())
156
157
assert .Equal (t , res .ExitCode (), 0 )
157
158
}
159
+
160
+ func TestFalco_Print_Rules (t * testing.T ) {
161
+ t .Parallel ()
162
+ checkDefaultConfig (t )
163
+ runner := tests .NewFalcoExecutableRunner (t )
164
+ t .Run ("valid-rules" , func (t * testing.T ) {
165
+ t .Parallel ()
166
+ res := falco .Test (
167
+ runner ,
168
+ falco .WithArgs ("-L" ),
169
+ falco .WithRules (rules .DetectConnectUsingIn , rules .ListAppend , rules .CatchallOrder ),
170
+ )
171
+ rules := []string {"Open From Cat" , "Localhost connect" , "open_dev_null" , "dev_null" }
172
+ for _ , rule := range rules {
173
+ assert .Contains (t , res .Stdout (), rule )
174
+ }
175
+ assert .NoError (t , res .Err (), "%s" , res .Stderr ())
176
+ assert .Equal (t , res .ExitCode (), 0 )
177
+ })
178
+ t .Run ("invalid-rules" , func (t * testing.T ) {
179
+ t .Parallel ()
180
+ res := falco .Test (
181
+ runner ,
182
+ falco .WithArgs ("-L" ),
183
+ falco .WithRules (rules .InvalidRuleOutput ),
184
+ )
185
+ assert .Error (t , res .Err (), "%s" , res .Stderr ())
186
+ assert .Equal (t , res .ExitCode (), 1 )
187
+ })
188
+ }
0 commit comments