github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-17 08:11:32 +00:00
Code Issues Projects Releases Wiki Activity

Print ignored events/syscalls with -i (#359)

Browse Source 
When run with -i, print out all ignored syscalls/event names and exit.
This commit is contained in:
Mark Stemm 2018-04-24 16:07:28 -07:00 committed by GitHub
parent 9d3392e9b9
commit 30ae3447c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 59 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
userspace/falco/falco.cpp
View File

@ -22,6 +22,8 @@ along with falco. If not, see <http://www.gnu.org/licenses/>.
#include <fstream>
#include <set>
#include <list>
#include <vector>
#include <algorithm>
#include <string>
#include <signal.h>
#include <fcntl.h>
@ -32,6 +34,7 @@ along with falco. If not, see <http://www.gnu.org/licenses/>.
#include <sinsp.h>
#include "logger.h"
#include "utils.h"
#include "configuration.h"
#include "falco_engine.h"
@ -241,6 +244,47 @@ uint64_t do_inspect(falco_engine *engine,
return num_evts;
}
static void print_all_ignored_events(sinsp *inspector)
{
sinsp_evttables* einfo = inspector->get_event_info_tables();
const struct ppm_event_info* etable = einfo->m_event_info;
const struct ppm_syscall_desc* stable = einfo->m_syscall_info_table;
std::set<string> ignored_event_names;
for(uint32_t j = 0; j < PPM_EVENT_MAX; j++)
{
if(!sinsp::falco_consider_evtnum(j))
{
std::string name = etable[j].name;
// Ignore event names NA*
if(name.find("NA") != 0)
{
ignored_event_names.insert(name);
}
}
}
for(uint32_t j = 0; j < PPM_SC_MAX; j++)
{
if(!sinsp::falco_consider_syscallid(j))
{
std::string name = stable[j].name;
// Ignore event names NA*
if(name.find("NA") != 0)
{
ignored_event_names.insert(name);
}
}
}
printf("Ignored Event(s):");
for(auto it : ignored_event_names)
{
printf(" %s", it.c_str());
}
printf("\n");
}
//
// ARGUMENT PARSING AND PROGRAM SETUP
//
@ -270,6 +314,7 @@ int falco_init(int argc, char **argv)
string output_format = "";
bool replace_container_info = false;
int duration_to_tot = 0;
bool print_ignored_events = false;
// Used for writing trace files
int duration_seconds = 0;
@ -299,6 +344,7 @@ int falco_init(int argc, char **argv)
{"version", no_argument, 0, 0 },
{"validate", required_argument, 0, 'V' },
{"writefile", required_argument, 0, 'w' },
{"ignored-events", no_argument, 0, 'i'},
{0, 0, 0, 0}
};
@ -315,7 +361,7 @@ int falco_init(int argc, char **argv)
// Parse the args
//
while((op = getopt_long(argc, argv,
"hc:AdD:e:k:K:Ll:m:M:o:P:p:r:s:T:t:UvV:w:",
"hc:AdD:e:ik:K:Ll:m:M:o:P:p:r:s:T:t:UvV:w:",
long_options, &long_index)) != -1)
{
switch(op)
@ -341,6 +387,9 @@ int falco_init(int argc, char **argv)
k8s_api = new string();
mesos_api = new string();
break;
case 'i':
print_ignored_events = true;
break;
case 'k':
k8s_api = new string(optarg);
break;
@ -431,12 +480,20 @@ int falco_init(int argc, char **argv)
return EXIT_SUCCESS;
}
inspector = new sinsp();
if(print_ignored_events)
{
print_all_ignored_events(inspector);
delete(inspector);
return EXIT_SUCCESS;
}
engine = new falco_engine();
engine->set_inspector(inspector);
engine->set_extra(output_format, replace_container_info);
outputs = new falco_outputs();
outputs->set_inspector(inspector);