Falco validation does not catch an exception that is not defined correctly

[ben-m-lucas]

Describe the bug

If a falco rule is appending an exception and defines the exception with a property of value, it passes falco validation even though it is not valid.

How to reproduce it
The following test file can be used:
testCase.yaml

- rule: Test rule with exception append
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
  condition: >
    evt.type=setuid
  output: >
    Test output
  exceptions:
  - name: image_suffix
    fields: [container.image.repository]
    comps: [endswith]
    values:
    - [test]
  priority: NOTICE
  tags: [container]
  
- rule: Test rule with exception append
  exceptions:
    - name: image_suffix
      value: secure-inline-scan
  append: true

Run falco -V testCase.yaml

Falco responds that this file is ok.

Expected behaviour
An error message should be returned that the rule is not valid.

• Falco version:
  Falco version: 0.33.1
  Libs version: 0.9.2
  Plugin API: 2.0.0
  Driver:
  API version: 2.0.0
  Schema version: 2.0.0
  Default driver: 3.0.1+driver

• System info:
  Falco version: 0.33.1
  Libs version: 0.9.2
  Plugin API: 2.0.0
  Driver:
  API version: 2.0.0
  Schema version: 2.0.0
  Default driver: 3.0.1+driver

• Cloud provider or hardware configuration:

• OS:
  PRETTY_NAME="Debian GNU/Linux 10 (buster)"
  NAME="Debian GNU/Linux"
  VERSION_ID="10"
  VERSION="10 (buster)"
  VERSION_CODENAME=buster
  ID=debian
  HOME_URL="https://www.debian.org/"
  SUPPORT_URL="https://www.debian.org/support"
  BUG_REPORT_URL="https://bugs.debian.org/"

• Kernel:
  Linux 678de6959a21 5.15.79.1-microsoft-standard-WSL2 Digwatch compiler #1 SMP Wed Nov 23 01:01:46 UTC 2022 x86_64 GNU/Linux

• Installation method:
  used docker image falcosecurity/falco;latest

Additional context

[jasondellaluce]

/milestone 0.35.0

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[jasondellaluce]

/remove-lifecycle stale

[FedeDP]

/milestone 0.36.0

[FedeDP]

@jasondellaluce did you have the time, by chance, to work on this?

[jasondellaluce]

@FedeDP unfortunately not, we'll need to set this for the next milestone.

[FedeDP]

No problem man ❤️

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[jasondellaluce]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[FedeDP]

/remove-lifecycle stale