github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-15 14:28:39 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): try to insert kernel module driver conditionally

Browse Source 
Do it only when not running with userspace instrumentation enabled and
the syscall input source is enabled (!disable_syscall)

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2020-07-14 18:45:38 +00:00
committed by poiana
parent 8ae6aa51b9
commit 596e7ee303
1 changed files with 20 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
userspace/falco/falco.cpp
View File

@@ -158,7 +158,7 @@ static void usage()
" This causes every single line emitted by falco to be flushed,\n" " This causes every single line emitted by falco to be flushed,\n"
" which generates higher CPU usage but is useful when piping those outputs\n" " which generates higher CPU usage but is useful when piping those outputs\n"
" into another process or into a script.\n" " into another process or into a script.\n"
" -u Parse events from userspace.\n" " -u, --userspace Parse events from userspace.\n"
" To be used in conjunction with the ptrace(2) based driver (pdig).\n" " To be used in conjunction with the ptrace(2) based driver (pdig).\n"
" -V, --validate <rules_file> Read the contents of the specified rules(s) file and exit.\n" " -V, --validate <rules_file> Read the contents of the specified rules(s) file and exit.\n"
" Can be specified multiple times to validate multiple files.\n" " Can be specified multiple times to validate multiple files.\n"
@@ -445,7 +445,7 @@ int falco_init(int argc, char **argv)
set<string> disable_sources; set<string> disable_sources;
bool disable_syscall = false; bool disable_syscall = false;
bool disable_k8s_audit = false; bool disable_k8s_audit = false;
bool udig = false; bool userspace = false;
// Used for writing trace files // Used for writing trace files
int duration_seconds = 0; int duration_seconds = 0;
@@ -485,7 +485,7 @@ int falco_init(int argc, char **argv)
{"stats-interval", required_argument, 0}, {"stats-interval", required_argument, 0},
{"support", no_argument, 0}, {"support", no_argument, 0},
{"unbuffered", no_argument, 0, 'U'}, {"unbuffered", no_argument, 0, 'U'},
{"udig", no_argument, 0, 'u'}, {"userspace", no_argument, 0, 'u'},
{"validate", required_argument, 0, 'V'}, {"validate", required_argument, 0, 'V'},
{"version", no_argument, 0, 0}, {"version", no_argument, 0, 0},
{"writefile", required_argument, 0, 'w'}, {"writefile", required_argument, 0, 'w'},
@@ -612,7 +612,7 @@ int falco_init(int argc, char **argv)
buffered_cmdline = true; buffered_cmdline = true;
break; break;
case 'u': case 'u':
udig = true; userspace = true;
break; break;
case 'v': case 'v':
verbose = true; verbose = true;
@@ -1098,17 +1098,14 @@ int falco_init(int argc, char **argv)
} }
else else
{ {
open_t open_cb = [&udig](sinsp* inspector) open_t open_cb = [&userspace](sinsp* inspector)
{ {
if(udig) if(userspace)
{ {
// open_udig() is the underlying method used in the capture // open_udig() is the underlying method used in the capture code to parse userspace events from the kernel.
// code to parse userspace events from the kernel. //
// // Falco uses a ptrace(2) based userspace implementation.
// In the case of falco we use ptrace(2) for one // Regardless of the implementation, the underlying method remains the same.
// of these userspace implementations. Regardless
// of the implementation, the underlying method
// remains the same.
inspector->open_udig(); inspector->open_udig();
} }
else else
@@ -1138,11 +1135,16 @@ int falco_init(int argc, char **argv)
} }
catch(sinsp_exception &e) catch(sinsp_exception &e)
{ {
if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null")) // If syscall input source is enabled and not through userspace instrumentation
if (!disable_syscall && !userspace)
{ {
falco_logger::log(LOG_ERR, "Unable to load the driver. Exiting.\n"); // Try to insert the Falco kernel module
if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
{
falco_logger::log(LOG_ERR, "Unable to load the driver. Exiting.\n");
}
open_f(inspector);
} }
open_f(inspector);
} }
} }
@@ -1161,7 +1163,7 @@ int falco_init(int argc, char **argv)
duration = ((double)clock()) / CLOCKS_PER_SEC; duration = ((double)clock()) / CLOCKS_PER_SEC;
// //
// run k8s, if required // Run k8s, if required
// //
if(k8s_api) if(k8s_api)
{ {
@@ -1200,7 +1202,7 @@ int falco_init(int argc, char **argv)
} }
// //
// run mesos, if required // Run mesos, if required
// //
if(mesos_api) if(mesos_api)
{ {