The Tree Parser

'sct_config' reads the configuration file to memory and passes it to a parser. 

The parser parses the configuration file and for each keyword it recognizes, such as 'rule', 'syscall_name' or 'filter_expression', it calls a parser for that keyword's value. 
        
The value can be a simple token, such as 'before', or a complex token such as the entire rule's contents or a filter expression, like 'PID != 1 && PARAMS[1] in ("boo", "bee", "bah")'. 

The parser should one day be written using compiler construction tools, such as lex && yacc, but for now some of us derive an unholy pleasure from writing it by hand.