diff --git a/unit_tests/falco/app/actions/test_configure_syscall_buffer_num.cpp b/unit_tests/falco/app/actions/test_configure_syscall_buffer_num.cpp index 13288faf..ddbea31d 100644 --- a/unit_tests/falco/app/actions/test_configure_syscall_buffer_num.cpp +++ b/unit_tests/falco/app/actions/test_configure_syscall_buffer_num.cpp @@ -30,7 +30,7 @@ TEST(ActionConfigureSyscallBufferNum, variable_number_of_CPUs) // not modern ebpf engine, we do nothing { falco::app::state s; - s.options.modern_bpf = false; + s.config->m_engine_mode = engine_kind_t::MODERN_EBPF; EXPECT_ACTION_OK(action(s)); } @@ -38,7 +38,7 @@ TEST(ActionConfigureSyscallBufferNum, variable_number_of_CPUs) // default `m_cpus_for_each_syscall_buffer` to online CPU number { falco::app::state s; - s.options.modern_bpf = true; + s.config->m_engine_mode = engine_kind_t::MODERN_EBPF; s.config->m_modern_ebpf.m_cpus_for_each_syscall_buffer = online_cpus + 1; EXPECT_ACTION_OK(action(s)); EXPECT_EQ(s.config->m_modern_ebpf.m_cpus_for_each_syscall_buffer, online_cpus); @@ -48,7 +48,7 @@ TEST(ActionConfigureSyscallBufferNum, variable_number_of_CPUs) // we don't modify `m_cpus_for_each_syscall_buffer` { falco::app::state s; - s.options.modern_bpf = true; + s.config->m_engine_mode = engine_kind_t::MODERN_EBPF; s.config->m_modern_ebpf.m_cpus_for_each_syscall_buffer = online_cpus - 1; EXPECT_ACTION_OK(action(s)); EXPECT_EQ(s.config->m_modern_ebpf.m_cpus_for_each_syscall_buffer, online_cpus - 1); diff --git a/userspace/falco/app/actions/configure_syscall_buffer_num.cpp b/userspace/falco/app/actions/configure_syscall_buffer_num.cpp index 6df84d8f..aed2534c 100644 --- a/userspace/falco/app/actions/configure_syscall_buffer_num.cpp +++ b/userspace/falco/app/actions/configure_syscall_buffer_num.cpp @@ -23,7 +23,7 @@ using namespace falco::app::actions; falco::app::run_result falco::app::actions::configure_syscall_buffer_num(falco::app::state& s) { #ifdef __linux__ - if(!s.options.modern_bpf) + if(!s.is_modern_ebpf()) { return run_result::ok(); } diff --git a/userspace/falco/app/actions/create_requested_paths.cpp b/userspace/falco/app/actions/create_requested_paths.cpp index eae38154..5eba04ac 100644 --- a/userspace/falco/app/actions/create_requested_paths.cpp +++ b/userspace/falco/app/actions/create_requested_paths.cpp @@ -39,10 +39,10 @@ falco::app::run_result falco::app::actions::create_requested_paths(falco::app::s { // This is bad: parsing gvisor config to get endpoint // to be able to auto-create the path to the file for the user. - std::ifstream reader(s.options.gvisor_config); + std::ifstream reader(s.config->m_gvisor.m_config); if (reader.fail()) { - return run_result::fatal(s.options.gvisor_config + ": cannot open file"); + return run_result::fatal(s.config->m_gvisor.m_config + ": cannot open file"); } nlohmann::json parsed_json; @@ -53,7 +53,7 @@ falco::app::run_result falco::app::actions::create_requested_paths(falco::app::s } catch (const std::exception &e) { - return run_result::fatal(s.options.gvisor_config + ": cannot parse JSON: " + e.what()); + return run_result::fatal(s.config->m_gvisor.m_config + ": cannot parse JSON: " + e.what()); } try @@ -62,7 +62,7 @@ falco::app::run_result falco::app::actions::create_requested_paths(falco::app::s } catch (const std::exception &e) { - return run_result::fatal(s.options.gvisor_config + ": failed to fetch config.endpoint: " + e.what()); + return run_result::fatal(s.config->m_gvisor.m_config + ": failed to fetch config.endpoint: " + e.what()); } int ret = create_dir(gvisor_socket); diff --git a/userspace/falco/app/actions/helpers_generic.cpp b/userspace/falco/app/actions/helpers_generic.cpp index 44e205ed..2a199158 100644 --- a/userspace/falco/app/actions/helpers_generic.cpp +++ b/userspace/falco/app/actions/helpers_generic.cpp @@ -75,7 +75,7 @@ void falco::app::actions::print_enabled_event_sources(falco::app::state& s) } else { - if (src != falco_common::syscall_source || s.options.nodriver) + if (src != falco_common::syscall_source || s.is_nodriver()) { falco_logger::log(falco_logger::level::WARNING, "Enabled event source '" + src + "' can be opened with multiple loaded plugins, will use only '" @@ -84,7 +84,7 @@ void falco::app::actions::print_enabled_event_sources(falco::app::state& s) } } } - if (!first_plugin && s.options.nodriver) + if (!first_plugin && s.is_nodriver()) { falco_logger::log(falco_logger::level::WARNING, "Enabled event source '" + src + "' will be opened with no driver, no event will be produced"); @@ -126,4 +126,3 @@ void falco::app::actions::format_plugin_info(std::shared_ptr p, st os << " - Async Events" << std::endl; } } - diff --git a/userspace/falco/app/actions/load_config.cpp b/userspace/falco/app/actions/load_config.cpp index ebfb203f..fb140e93 100644 --- a/userspace/falco/app/actions/load_config.cpp +++ b/userspace/falco/app/actions/load_config.cpp @@ -27,6 +27,10 @@ using namespace falco::app::actions; // applies legacy/in-deprecation options to the current state static falco::app::run_result apply_deprecated_options(falco::app::state& s) { + // Please note: is not possible to mix command line options and configs to obtain a configuration + // we need to use only one method. For example, is not possible to set the gvisor-config through + // the command line and the gvisor-root through the config file. + // // If overridden from CLI options (soon to be removed), // use the requested driver. if (getenv(FALCO_BPF_ENV_VARIABLE)) diff --git a/userspace/falco/app/options.cpp b/userspace/falco/app/options.cpp index e6d07c4f..32ea07ec 100644 --- a/userspace/falco/app/options.cpp +++ b/userspace/falco/app/options.cpp @@ -39,7 +39,8 @@ options::options() markdown(false), modern_bpf(false), dry_run(false), - nodriver(false) + nodriver(false), + trace_filename("") { } diff --git a/userspace/falco/app/state.h b/userspace/falco/app/state.h index 226772c8..ba6caee5 100644 --- a/userspace/falco/app/state.h +++ b/userspace/falco/app/state.h @@ -155,6 +155,16 @@ struct state return config->m_engine_mode == engine_kind_t::GVISOR; } + inline bool is_modern_ebpf() const + { + return config->m_engine_mode == engine_kind_t::MODERN_EBPF; + } + + inline bool is_nodriver() const + { + return config->m_engine_mode == engine_kind_t::NONE; + } + inline bool is_source_enabled(const std::string& src) const { return enabled_sources.find(falco_common::syscall_source) != enabled_sources.end(); diff --git a/userspace/falco/configuration.cpp b/userspace/falco/configuration.cpp index fe3b7dee..750519a7 100644 --- a/userspace/falco/configuration.cpp +++ b/userspace/falco/configuration.cpp @@ -122,7 +122,7 @@ void falco_configuration::load_engine_config(const std::string& config_name, con } else { - throw std::logic_error("Error reading config file (" + config_name + "): wrong engine.kind specified."); + throw std::logic_error("Error reading config file (" + config_name + "): engine.kind '"+ driver_mode_str + "' is not a valid kind."); } switch (m_engine_mode)