github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 17:12:21 +00:00
Code Issues Projects Releases Wiki Activity

new(scripts): add a falco.target that consists of falco-X.service units.

Browse Source 
falcoctl will then run and bind to falco.target.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2023-01-19 16:02:02 +01:00 committed by poiana
parent 394d495040
commit 2591ed4d68
10 changed files with 23 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
cmake/cpack/CMakeCPackOptions.cmake
View File

@ -1,6 +1,7 @@
if(CPACK_GENERATOR MATCHES "DEB" OR CPACK_GENERATOR MATCHES "RPM")
list(APPEND CPACK_INSTALL_COMMANDS "mkdir -p _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp -r scripts/systemd/falco-kmod-inject.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/systemd/falco.target _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/systemd/falco-kmod-inject.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/systemd/falco-kmod.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/systemd/falco-bpf.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/systemd/falco-modern-bpf.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")

2
scripts/CMakeLists.txt
View File

@ -16,6 +16,8 @@
#
# Systemd
file(COPY "${PROJECT_SOURCE_DIR}/scripts/systemd/falco.target"
DESTINATION "${PROJECT_BINARY_DIR}/scripts/systemd")
file(COPY "${PROJECT_SOURCE_DIR}/scripts/systemd/falco-kmod-inject.service"
DESTINATION "${PROJECT_BINARY_DIR}/scripts/systemd")
file(COPY "${PROJECT_SOURCE_DIR}/scripts/systemd/falco-kmod.service"

6
scripts/debian/prerm.in
View File

@ -24,11 +24,7 @@ set -e
case "$1" in
remove|upgrade|deconfigure)
echo "[PRE-REMOVE] Stop all Falco services:"
systemctl --system stop 'falco-kmod.service' || true
systemctl --system stop 'falco-bpf.service' || true
systemctl --system stop 'falco-modern-bpf.service' || true
systemctl --system stop 'falco-plugin.service' || true
systemctl --system stop 'falcoctl.service' || true
systemctl --system stop 'falco.target' || true
echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'"
falco-driver-loader --clean

6
scripts/rpm/preuninstall.in
View File

@ -18,11 +18,7 @@ set -e
# Currently running falco service uses the driver, so stop it before driver cleanup
echo "[PRE-REMOVE] Stop all Falco services:"
systemctl --system stop 'falco-kmod.service' || true
systemctl --system stop 'falco-bpf.service' || true
systemctl --system stop 'falco-modern-bpf.service' || true
systemctl --system stop 'falco-plugin.service' || true
systemctl --system stop 'falcoctl.service' || true
systemctl --system stop 'falco.target' || true
echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'"
falco-driver-loader --clean

4
scripts/systemd/falco-bpf.service
View File

@ -1,6 +1,7 @@
[Unit]
Description=Falco: Container Native Runtime Security with ebpf
Documentation=https://falco.org/docs/
PartOf=falco.target
Conflicts=falco-kmod.service
Conflicts=falco-modern-bpf.service
Conflicts=falco-plugin.service
@ -22,6 +23,3 @@ ProtectKernelTunables=true
RestrictRealtime=true
RestrictAddressFamilies=~AF_PACKET
StandardOutput=null
[Install]
WantedBy=multi-user.target

4
scripts/systemd/falco-kmod.service
View File

@ -3,6 +3,7 @@ Description=Falco: Container Native Runtime Security with kmod
Documentation=https://falco.org/docs/
After=falco-kmod-inject.service
Requires=falco-kmod-inject.service
PartOf=falco.target
Conflicts=falco-bpf.service
Conflicts=falco-modern-bpf.service
Conflicts=falco-plugin.service
@ -24,6 +25,3 @@ ReadWritePaths=/sys/module/falco
RestrictRealtime=true
RestrictAddressFamilies=~AF_PACKET
StandardOutput=null
[Install]
WantedBy=multi-user.target

4
scripts/systemd/falco-modern-bpf.service
View File

@ -1,6 +1,7 @@
[Unit]
Description=Falco: Container Native Runtime Security with modern ebpf
Documentation=https://falco.org/docs/
PartOf=falco.target
Conflicts=falco-kmod.service
Conflicts=falco-bpf.service
Conflicts=falco-plugin.service
@ -21,6 +22,3 @@ ProtectKernelTunables=true
RestrictRealtime=true
RestrictAddressFamilies=~AF_PACKET
StandardOutput=null
[Install]
WantedBy=multi-user.target

4
scripts/systemd/falco-plugin.service
View File

@ -1,6 +1,7 @@
[Unit]
Description=Falco: Container Native Runtime Security with plugin
Documentation=https://falco.org/docs/
PartOf=falco.target
Conflicts=falco-kmod.service
Conflicts=falco-bpf.service
Conflicts=falco-modern-bpf.service
@ -21,6 +22,3 @@ ProtectKernelTunables=true
RestrictRealtime=true
RestrictAddressFamilies=~AF_PACKET
StandardOutput=null
[Install]
WantedBy=multi-user.target

7
scripts/systemd/falco.target Normal file
View File

@ -0,0 +1,7 @@
[Unit]
Description=Main Falco target
Requires=multi-user.target
After=multi-user.target
[Install]
WantedBy=multi-user.target

5
scripts/systemd/falcoctl.service
View File

@ -1,6 +1,8 @@
[Unit]
Description=Falco: Automatic rules update service
Documentation=https://falco.org/docs/
After=falco.target
BindsTo=falco.target
[Service]
Type=simple
@ -15,8 +17,7 @@ NoNewPrivileges=yes
ProtectSystem=true
ProtectKernelTunables=true
RestrictRealtime=true
#RestrictAddressFamilies=~AF_PACKET
#StandardOutput=null
StandardOutput=null
[Install]
WantedBy=multi-user.target