Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: default paranoia settings break CRS #339

Merged
merged 4 commits into from
Feb 27, 2025

Conversation

theseion
Copy link
Contributor

@theseion theseion commented Feb 26, 2025

We are still setting PARANOIA as default in some places, which causes detection and blocking levels to be in an invalid state (detection must be >= blocking).

This PR also adds running CRS tests to the verification, as we've run into issues multiple times that we would have caught, had we run the test suite (this issue in particular).

When `PARANOIA` and `BLOCKING_PARANOIA` are both set but
`DETECTION_PARANOIA` isn't, the detection paranoia level may be set to a
value smaller than the blocking paranoia, which triggers a rule that
checks for this situation. Since `PARANOIA` is deprecated, simply don't
set it by default.
@theseion theseion requested a review from fzipi February 26, 2025 06:36
@theseion
Copy link
Contributor Author

@fzipi I want to merge this PR and then release.

@theseion theseion changed the title Fix default paranoia settings fix: default paranoia settings break CRS Feb 26, 2025
@theseion theseion force-pushed the fix-default-paranoia-settings branch from 7548d19 to 22fc82d Compare February 26, 2025 06:45
@theseion theseion force-pushed the fix-default-paranoia-settings branch from 22fc82d to d6f5a2b Compare February 26, 2025 06:54
@theseion
Copy link
Contributor Author

Well bummer. I'll need to investigate those issues, but tonight I won't be around. It will have to wait until Thursday evening probably.

The alpine images segfault. The read-only images still have an issue
with the setup.
@theseion
Copy link
Contributor Author

@fzipi Ready. I had to disable alpine and read-only builds. The alpine images have had issues for a while, I think.

@theseion theseion merged commit b3f9ae4 into coreruleset:main Feb 27, 2025
3 checks passed
@theseion theseion deleted the fix-default-paranoia-settings branch February 27, 2025 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants