vdk-audit: [bug fix] Fix incorrectly detected event

projects/vdk-plugins/vdk-audit/src/vdk/plugin/audit/audit_plugin.py

@@ -33,7 +33,7 @@ def initialize_job(self, context: JobContext) -> None:
 
         def _audit(event, args):
             if any(
-                event in not_permitted_event
+                event == not_permitted_event
                 for not_permitted_event in forbidden_events_list
             ):
                 logger.warning(

projects/vdk-plugins/vdk-audit/tests/functional/jobs/os-remove-command-job/10_os_remove_command_job.py

@@ -0,0 +1,12 @@
+# Copyright 2021-2023 VMware, Inc.
+# SPDX-License-Identifier: Apache-2.0
+import os
+
+from vdk.api.job_input import IJobInput
+
+
+def run(job_input: IJobInput):
+    with open("test_file.txt", "w") as f:
+        f.write("Some string")
+
+    os.remove("test_file.txt")

projects/vdk-plugins/vdk-audit/tests/functional/test_audit_plugin.py

@@ -128,3 +128,23 @@ def test_audit_multiple_events_enabled_and_permitted_action():
         print(result.output)
         cli_assert_equal(0, result)
         assert not os._exit.called
+
+
+def test_audit_single_event_enabled_and_not_misclassified_error():
+    with mock.patch.dict(
+        os.environ,
+        {
+            "VDK_AUDIT_HOOK_ENABLED": "True",
+            "VDK_AUDIT_HOOK_FORBIDDEN_EVENTS_LIST": "os.removexattr;",
+        },
+    ):
+        os._exit = mock.MagicMock()
+        runner = CliEntryBasedTestRunner(audit_plugin)
+
+        result: Result = runner.invoke(
+            ["run", jobs_path_from_caller_directory("os-remove-command-job")]
+        )
+
+        print(result.output)
+        cli_assert_equal(0, result)
+        assert not os._exit.called