fix(userspace/engine): solve description of macro-only rules

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
falcosecurity · Nov 2, 2023 · 2e7cacb · 2e7cacb
1 parent 214e41d
commit 2e7cacb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/userspace/engine/filter_details_resolver.cpp b/userspace/engine/filter_details_resolver.cpp
@@ -41,6 +41,8 @@ void filter_details::reset()
 void filter_details_resolver::run(ast::expr* filter, filter_details& details)
 {
 	visitor v(details);
+	// note: we may have ASTs composed on only one macro ref
+	v.m_expect_macro = true;
 	filter->accept(&v);
 }