diff --git a/cmake/modules/driver.cmake b/cmake/modules/driver.cmake index 5141df67..65032c04 100644 --- a/cmake/modules/driver.cmake +++ b/cmake/modules/driver.cmake @@ -26,8 +26,8 @@ else() # In case you want to test against another driver version (or branch, or commit) just pass the variable - # ie., `cmake -DDRIVER_VERSION=dev ..` if(NOT DRIVER_VERSION) - set(DRIVER_VERSION "6ca2fc1fa9a9f5482dc92468a0a6e3404ae46723") - set(DRIVER_CHECKSUM "SHA256=4d390bdde2c061491cb73d5703a2e0db7bd681a4738b4a9e50252fff3628dd29") + set(DRIVER_VERSION "6c11056815b9eff787c69f9b2188a2ae503533c9") + set(DRIVER_CHECKSUM "SHA256=e0d671e09993c5f402054aab70858af5fe372eec201d4e1744c0a01d2959b750") endif() # cd /path/to/build && cmake /path/to/source diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake index 52134ce6..df55cd77 100644 --- a/cmake/modules/falcosecurity-libs.cmake +++ b/cmake/modules/falcosecurity-libs.cmake @@ -27,8 +27,8 @@ else() # In case you want to test against another falcosecurity/libs version (or branch, or commit) just pass the variable - # ie., `cmake -DFALCOSECURITY_LIBS_VERSION=dev ..` if(NOT FALCOSECURITY_LIBS_VERSION) - set(FALCOSECURITY_LIBS_VERSION "6ca2fc1fa9a9f5482dc92468a0a6e3404ae46723") - set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=4d390bdde2c061491cb73d5703a2e0db7bd681a4738b4a9e50252fff3628dd29") + set(FALCOSECURITY_LIBS_VERSION "6c11056815b9eff787c69f9b2188a2ae503533c9") + set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=e0d671e09993c5f402054aab70858af5fe372eec201d4e1744c0a01d2959b750") endif() # cd /path/to/build && cmake /path/to/source diff --git a/userspace/falco/app/actions/configure_interesting_sets.cpp b/userspace/falco/app/actions/configure_interesting_sets.cpp index 9d2f74fa..e4171017 100644 --- a/userspace/falco/app/actions/configure_interesting_sets.cpp +++ b/userspace/falco/app/actions/configure_interesting_sets.cpp @@ -159,16 +159,6 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set

sc_codes_for_ruleset(falco_common::syscall_source); select_event_set(s, rules_sc_set); check_for_rules_unsupported_events(s, rules_sc_set); - select_kernel_tracepoint_set(s); return run_result::ok(); } diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp index 11fded2c..763c67d7 100644 --- a/userspace/falco/app/actions/helpers_inspector.cpp +++ b/userspace/falco/app/actions/helpers_inspector.cpp @@ -81,7 +81,7 @@ falco::app::run_result falco::app::actions::open_live_inspector( { falco_logger::log(LOG_INFO, "Opening capture with modern BPF probe."); falco_logger::log(LOG_INFO, "One ring buffer every '" + std::to_string(s.config->m_cpus_for_each_syscall_buffer) + "' CPUs."); - inspector->open_modern_bpf(s.syscall_buffer_bytes_size, s.config->m_cpus_for_each_syscall_buffer, true, s.selected_sc_set, s.selected_tp_set); + inspector->open_modern_bpf(s.syscall_buffer_bytes_size, s.config->m_cpus_for_each_syscall_buffer, true, s.selected_sc_set); } else if(getenv(FALCO_BPF_ENV_VARIABLE) != NULL) /* BPF engine. */ { @@ -99,14 +99,14 @@ falco::app::run_result falco::app::actions::open_live_inspector( bpf_probe_path = full_path; } falco_logger::log(LOG_INFO, "Opening capture with BPF probe. BPF probe path: " + std::string(bpf_probe_path)); - inspector->open_bpf(bpf_probe_path, s.syscall_buffer_bytes_size, s.selected_sc_set, s.selected_tp_set); + inspector->open_bpf(bpf_probe_path, s.syscall_buffer_bytes_size, s.selected_sc_set); } else /* Kernel module (default). */ { try { falco_logger::log(LOG_INFO, "Opening capture with Kernel module"); - inspector->open_kmod(s.syscall_buffer_bytes_size, s.selected_sc_set, s.selected_tp_set); + inspector->open_kmod(s.syscall_buffer_bytes_size, s.selected_sc_set); } catch(sinsp_exception &e) { @@ -116,7 +116,7 @@ falco::app::run_result falco::app::actions::open_live_inspector( { falco_logger::log(LOG_ERR, "Unable to load the driver\n"); } - inspector->open_kmod(s.syscall_buffer_bytes_size, s.selected_sc_set, s.selected_tp_set); + inspector->open_kmod(s.syscall_buffer_bytes_size, s.selected_sc_set); } } } diff --git a/userspace/falco/app/state.h b/userspace/falco/app/state.h index 8a2612e1..f1b15157 100644 --- a/userspace/falco/app/state.h +++ b/userspace/falco/app/state.h @@ -67,7 +67,6 @@ struct state source_infos(), plugin_configs(), selected_sc_set(), - selected_tp_set(), syscall_buffer_bytes_size(DEFAULT_DRIVER_BUFFER_BYTES_DIM) { config = std::make_shared(); @@ -121,9 +120,6 @@ struct state // Set of syscalls we want the driver to capture libsinsp::events::set selected_sc_set; - // Set of tracepoints we want the driver to capture - libsinsp::events::set selected_tp_set; - // Dimension of the syscall buffer in bytes. uint64_t syscall_buffer_bytes_size;