mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-12 21:16:33 +00:00
refactor: adapt event set configuration changes to new libs definition
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
poiana
@@ -16,201 +16,19 @@ See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
*/
|
||||
#include <sstream>
|
||||
#include <cstring>
|
||||
#include <iomanip>
|
||||
#include <unordered_set>
|
||||
#include <set>
|
||||
#include <iterator>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <sinsp.h>
|
||||
|
||||
#include "falco_utils.h"
|
||||
#include "utils.h"
|
||||
#include "banned.h" // This raises a compilation error when certain functions are used
|
||||
|
||||
extern sinsp_evttables g_infotables;
|
||||
|
||||
namespace falco
|
||||
{
|
||||
|
||||
namespace utils
|
||||
{
|
||||
|
||||
std::unordered_set<uint32_t> get_ppm_sc_set_from_syscalls(const std::unordered_set<std::string>& syscalls)
|
||||
{
|
||||
std::unordered_set<uint32_t> ppm_sc_set = {};
|
||||
for (int ppm_sc_code = 0; ppm_sc_code < PPM_SC_MAX; ++ppm_sc_code)
|
||||
{
|
||||
std::string ppm_sc_name = g_infotables.m_syscall_info_table[ppm_sc_code].name;
|
||||
if (syscalls.find(ppm_sc_name) != syscalls.end())
|
||||
{
|
||||
ppm_sc_set.insert(ppm_sc_code);
|
||||
}
|
||||
}
|
||||
return ppm_sc_set;
|
||||
}
|
||||
|
||||
std::unordered_set<uint32_t> enforce_io_ppm_sc_set(std::unordered_set<uint32_t> ppm_sc_set)
|
||||
{
|
||||
const int bitmask = EC_SYSCALL - 1;
|
||||
for(int ppm_sc_code = 0; ppm_sc_code < PPM_SC_MAX; ppm_sc_code++)
|
||||
{
|
||||
switch(g_infotables.m_syscall_info_table[ppm_sc_code].category & bitmask)
|
||||
{
|
||||
case EC_IO_READ:
|
||||
case EC_IO_WRITE:
|
||||
ppm_sc_set.insert(ppm_sc_code);
|
||||
}
|
||||
}
|
||||
return ppm_sc_set;
|
||||
}
|
||||
|
||||
std::unordered_set<uint32_t> enforce_sinsp_state_ppme(std::unordered_set<uint32_t> ppm_event_info_of_interest)
|
||||
{
|
||||
/* Fill-up the set of event infos of interest. This is needed to ensure critical non syscall PPME events are activated, e.g. container or proc exit events. */
|
||||
for (uint32_t ev = 2; ev < PPM_EVENT_MAX; ev++)
|
||||
{
|
||||
if (!sinsp::is_old_version_event(ev)
|
||||
&& !sinsp::is_unused_event(ev)
|
||||
&& !sinsp::is_unknown_event(ev))
|
||||
{
|
||||
/* So far we only covered syscalls, so we add other kinds of
|
||||
interesting events. In this case, we are also interested in
|
||||
metaevents and in the procexit tracepoint event. */
|
||||
if (sinsp::is_metaevent(ev) || ev == PPME_PROCEXIT_1_E)
|
||||
{
|
||||
ppm_event_info_of_interest.insert(ev);
|
||||
}
|
||||
}
|
||||
}
|
||||
return ppm_event_info_of_interest;
|
||||
}
|
||||
|
||||
// unordered_set_to_ordered
|
||||
template<typename T>
|
||||
std::set<T> unordered_set_to_ordered(const std::unordered_set<T>& unordered_set)
|
||||
{
|
||||
std::set<T> s;
|
||||
for(const auto& val : unordered_set)
|
||||
{
|
||||
s.insert(val);
|
||||
}
|
||||
return s;
|
||||
}
|
||||
template std::set<uint32_t> unordered_set_to_ordered(const std::unordered_set<uint32_t>& unordered_set);
|
||||
template std::set<std::string> unordered_set_to_ordered(const std::unordered_set<std::string>& unordered_set);
|
||||
|
||||
// unordered_set_difference, equivalent to SQL left_anti join operation
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_difference(const std::unordered_set<T>& a, const std::unordered_set<T>& b)
|
||||
{
|
||||
std::unordered_set<T> s;
|
||||
for(const auto& val : a)
|
||||
{
|
||||
if (b.find(val) == b.end())
|
||||
{
|
||||
s.insert(val);
|
||||
}
|
||||
}
|
||||
return s;
|
||||
}
|
||||
template std::unordered_set<std::string> unordered_set_difference(const std::unordered_set<std::string>& a, const std::unordered_set<std::string>& b);
|
||||
template std::unordered_set<uint32_t> unordered_set_difference(const std::unordered_set<uint32_t>& a, const std::unordered_set<uint32_t>& b);
|
||||
|
||||
// set_difference, equivalent to SQL left_anti join operation
|
||||
template<typename T>
|
||||
std::set<T> set_difference(const std::set<T>& a, const std::set<T>& b)
|
||||
{
|
||||
std::set<T> out;
|
||||
std::set_difference(a.begin(), a.end(), b.begin(), b.end(), std::inserter(out, out.begin()));
|
||||
return out;
|
||||
}
|
||||
template std::set<std::string> set_difference(const std::set<std::string>& a, const std::set<std::string>& b);
|
||||
template std::set<uint32_t> set_difference(const std::set<uint32_t>& a, const std::set<uint32_t>& b);
|
||||
|
||||
// unordered_set_union
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_union(const std::unordered_set<T>& a, const std::unordered_set<T>& b)
|
||||
{
|
||||
std::unordered_set<T> s = a;
|
||||
for(const auto& val : b)
|
||||
{
|
||||
s.insert(val);
|
||||
}
|
||||
return s;
|
||||
}
|
||||
template std::unordered_set<std::string> unordered_set_union(const std::unordered_set<std::string>& a, const std::unordered_set<std::string>& b);
|
||||
template std::unordered_set<uint32_t> unordered_set_union(const std::unordered_set<uint32_t>& a, const std::unordered_set<uint32_t>& b);
|
||||
|
||||
// set_union
|
||||
template<typename T>
|
||||
std::set<T> set_union(const std::set<T>& a, const std::set<T>& b)
|
||||
{
|
||||
std::set<T> out;
|
||||
std::set_union(a.begin(), a.end(), b.begin(), b.end(), std::inserter(out, out.begin()));
|
||||
return out;
|
||||
}
|
||||
template std::set<std::string> set_union(const std::set<std::string>& a, const std::set<std::string>& b);
|
||||
template std::set<uint32_t> set_union(const std::set<uint32_t>& a, const std::set<uint32_t>& b);
|
||||
|
||||
// unordered_set_intersection
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_intersection(const std::unordered_set<T>& a, const std::unordered_set<T>& b)
|
||||
{
|
||||
std::unordered_set<T> s;
|
||||
for(const auto& val : a)
|
||||
{
|
||||
if (b.find(val) != b.end())
|
||||
{
|
||||
s.insert(val);
|
||||
}
|
||||
}
|
||||
return s;
|
||||
}
|
||||
template std::unordered_set<std::string> unordered_set_intersection(const std::unordered_set<std::string>& a, const std::unordered_set<std::string>& b);
|
||||
template std::unordered_set<uint32_t> unordered_set_intersection(const std::unordered_set<uint32_t>& a, const std::unordered_set<uint32_t>& b);
|
||||
|
||||
// set_intersection
|
||||
template<typename T>
|
||||
std::set<T> set_intersection(const std::set<T>& a, const std::set<T>& b)
|
||||
{
|
||||
std::set<T> out;
|
||||
std::set_intersection(a.begin(), a.end(), b.begin(), b.end(), std::inserter(out, out.begin()));
|
||||
return out;
|
||||
}
|
||||
template std::set<std::string> set_intersection(const std::set<std::string>& a, const std::set<std::string>& b);
|
||||
template std::set<uint32_t> set_intersection(const std::set<uint32_t>& a, const std::set<uint32_t>& b);
|
||||
|
||||
std::string concat_set_in_order(const std::unordered_set<std::string>& s, const std::string& delim)
|
||||
{
|
||||
if (s.empty())
|
||||
{
|
||||
return "";
|
||||
}
|
||||
std::set<std::string> s_ordered = unordered_set_to_ordered(s);
|
||||
std::stringstream ss;
|
||||
std::copy(s_ordered.begin(), s_ordered.end(),
|
||||
std::ostream_iterator<std::string>(ss, delim.c_str()));
|
||||
std::string s_str = ss.str();
|
||||
return s_str.substr(0, s_str.size() - delim.size());
|
||||
}
|
||||
|
||||
std::string concat_set_in_order(const std::set<std::string>& s, const std::string& delim)
|
||||
{
|
||||
if (s.empty())
|
||||
{
|
||||
return "";
|
||||
}
|
||||
std::stringstream ss;
|
||||
std::copy(s.begin(), s.end(),
|
||||
std::ostream_iterator<std::string>(ss, delim.c_str()));
|
||||
std::string s_str = ss.str();
|
||||
return s_str.substr(0, s_str.size() - delim.size());
|
||||
}
|
||||
|
||||
|
||||
std::string wrap_text(const std::string& in, uint32_t indent, uint32_t line_len)
|
||||
{
|
||||
std::istringstream is(in);
|
||||
|
||||
@@ -43,39 +43,6 @@ namespace falco
|
||||
namespace utils
|
||||
{
|
||||
|
||||
// TODO interim helper methods -> shall be integrated into sinsp APIs
|
||||
std::unordered_set<uint32_t> get_ppm_sc_set_from_syscalls(const std::unordered_set<std::string>& syscalls);
|
||||
std::unordered_set<uint32_t> enforce_sinsp_state_ppme(std::unordered_set<uint32_t> ppm_event_info_of_interest = {});
|
||||
std::unordered_set<uint32_t> enforce_io_ppm_sc_set(std::unordered_set<uint32_t> ppm_sc_set = {}); // needs libs bump hence duplicated in meantime
|
||||
// end interim helper methods
|
||||
|
||||
// TODO interim libs utils methods
|
||||
template<typename T>
|
||||
std::set<T> unordered_set_to_ordered(const std::unordered_set<T>& unordered_set);
|
||||
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_difference(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
|
||||
|
||||
template<typename T>
|
||||
std::set<T> set_difference(const std::set<T>& a, const std::set<T>& b);
|
||||
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_union(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
|
||||
|
||||
template<typename T>
|
||||
std::set<T> set_union(const std::set<T>& a, const std::set<T>& b);
|
||||
|
||||
template<typename T>
|
||||
std::unordered_set<T> unordered_set_intersection(const std::unordered_set<T>& a, const std::unordered_set<T>& b);
|
||||
|
||||
template<typename T>
|
||||
std::set<T> set_intersection(const std::set<T>& a, const std::set<T>& b);
|
||||
|
||||
std::string concat_set_in_order(const std::unordered_set<std::string>& s, const std::string& delim = ", ");
|
||||
std::string concat_set_in_order(const std::set<std::string>& s, const std::string& delim = ", ");
|
||||
|
||||
// end interim libs utils methods
|
||||
|
||||
std::string wrap_text(const std::string& in, uint32_t indent, uint32_t linelen);
|
||||
|
||||
void readfile(const std::string& filename, std::string& data);
|
||||
|
||||
@@ -25,10 +25,6 @@ namespace actions {
|
||||
|
||||
bool check_rules_plugin_requirements(falco::app::state& s, std::string& err);
|
||||
void print_enabled_event_sources(falco::app::state& s);
|
||||
void extract_rules_event_names(falco::app::state& s, std::unique_ptr<sinsp>& inspector, std::unordered_set<std::string>& rules_evttypes_names);
|
||||
void activate_interesting_events(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names);
|
||||
void check_for_unsupported_events(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names);
|
||||
void activate_interesting_syscalls(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names);
|
||||
void activate_interesting_kernel_tracepoints(falco::app::state& s, std::unique_ptr<sinsp>& inspector);
|
||||
void check_for_ignored_events(falco::app::state& s);
|
||||
void format_plugin_info(std::shared_ptr<sinsp_plugin> p, std::ostream& os);
|
||||
|
||||
@@ -14,142 +14,137 @@ See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
#include "helpers.h"
|
||||
#include "actions.h"
|
||||
#include "falco_utils.h"
|
||||
#include <unordered_set>
|
||||
#include <sinsp.h>
|
||||
#include <sstream>
|
||||
|
||||
using namespace falco::app;
|
||||
using namespace falco::app::actions;
|
||||
using namespace falco::utils;
|
||||
|
||||
extern sinsp_evttables g_infotables;
|
||||
|
||||
void falco::app::actions::extract_rules_event_names(falco::app::state& s, std::unique_ptr<sinsp>& inspector, std::unordered_set<std::string>& rules_evttypes_names)
|
||||
static libsinsp::events::set<ppm_event_code> extract_rules_event_set(falco::app::state& s)
|
||||
{
|
||||
/* Get all (positive) PPME events from all rules as idx codes.
|
||||
* Events names from negative filter expression statements are NOT included.
|
||||
* PPME events in libsinsp are needed to map each event type into it's enter and exit event if applicable (e.g. for syscall events).
|
||||
*/
|
||||
std::set<uint16_t> rule_events;
|
||||
std::string source = falco_common::syscall_source;
|
||||
s.engine->evttypes_for_ruleset(source, rule_events);
|
||||
std::unordered_set<uint32_t> ppme_events_codes(rule_events.begin(), rule_events.end());
|
||||
|
||||
/* Translate PPME event idx codes to consolidated event names.
|
||||
* Those are the exact event type (evt.type) names from the rules and hence also contain non syscall names, e.g. "container".
|
||||
*/
|
||||
rules_evttypes_names = inspector->get_events_names(ppme_events_codes);
|
||||
* PPME events in libsinsp are needed to map each event type into it's enter
|
||||
* and exit event if applicable (e.g. for syscall events). */
|
||||
std::set<uint16_t> tmp;
|
||||
libsinsp::events::set<ppm_event_code> events;
|
||||
auto source = falco_common::syscall_source;
|
||||
s.engine->evttypes_for_ruleset(source, tmp);
|
||||
for (const auto &ev : tmp)
|
||||
{
|
||||
events.insert((ppm_event_code) ev);
|
||||
}
|
||||
return events;
|
||||
}
|
||||
|
||||
void falco::app::actions::check_for_unsupported_events(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names)
|
||||
static void check_for_rules_unsupported_events(falco::app::state& s, const libsinsp::events::set<ppm_event_code>& rules_event_set)
|
||||
{
|
||||
std::unordered_set<std::string> intersection = unordered_set_intersection(inspector->get_events_names(s.ppm_event_info_of_interest), rules_evttypes_names);
|
||||
if(intersection.empty())
|
||||
/* Unsupported events are those events that are used in the rules
|
||||
* but that are not part of the selected event set. For now, this
|
||||
* is expected to happen only for high volume I/O syscalls for
|
||||
* performance reasons. */
|
||||
auto unsupported_event_set = rules_event_set.diff(s.selected_event_set);
|
||||
if (unsupported_event_set.empty())
|
||||
{
|
||||
return;
|
||||
}
|
||||
std::unordered_set<std::string> unsupported = unordered_set_difference(rules_evttypes_names, inspector->get_events_names(s.ppm_event_info_of_interest));
|
||||
|
||||
/* Get the names of the events (syscall and non syscall events) that were not activated and print them. */
|
||||
std::cerr << "Loaded rules match event types that are not activated or unsupported with current configuration: warning (unsupported-evttype): " + concat_set_in_order(unsupported) << std::endl;
|
||||
auto names = libsinsp::events::event_set_to_names(unsupported_event_set);
|
||||
std::cerr << "Loaded rules match event types that are not activated or unsupported with current configuration: warning (unsupported-evttype): " + concat_set_in_order(names) << std::endl;
|
||||
std::cerr << "If syscalls in rules include high volume I/O syscalls (-> activate via `-A` flag), else (2) syscalls might be associated with syscalls undefined on your architecture (https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html)" << std::endl;
|
||||
}
|
||||
|
||||
void falco::app::actions::activate_interesting_events(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names)
|
||||
static void select_event_set(falco::app::state& s, const libsinsp::events::set<ppm_event_code>& rules_event_set)
|
||||
{
|
||||
std::unordered_set<uint32_t> ppm_event_info_of_interest = inspector->get_event_set_from_ppm_sc_set(s.ppm_sc_of_interest);
|
||||
s.ppm_event_info_of_interest = enforce_sinsp_state_ppme(ppm_event_info_of_interest);
|
||||
check_for_unsupported_events(s, inspector, rules_evttypes_names);
|
||||
}
|
||||
|
||||
void falco::app::actions::activate_interesting_syscalls(falco::app::state& s, std::unique_ptr<sinsp>& inspector, const std::unordered_set<std::string>& rules_evttypes_names)
|
||||
{
|
||||
|
||||
/* Translate PPME event names to PPM syscall idx codes.
|
||||
* PPM syscall idx codes can be viewed as condensed libsinsp lookup table to map a system call name to it's actual system syscall id (as defined by the Linux kernel).
|
||||
* Hence here we don't need syscall enter and exit distinction.
|
||||
*/
|
||||
std::unordered_set<uint32_t> rules_ppm_sc_set = get_ppm_sc_set_from_syscalls(rules_evttypes_names);
|
||||
std::unordered_set<std::string> rules_syscalls_names = inspector->get_syscalls_names(rules_ppm_sc_set);
|
||||
if (rules_syscalls_names.size() > 0)
|
||||
/* PPM syscall codes (sc) can be viewed as condensed libsinsp lookup table
|
||||
* to map a system call name to it's actual system syscall id (as defined
|
||||
* by the Linux kernel). Hence here we don't need syscall enter and exit distinction. */
|
||||
auto rules_names = libsinsp::events::event_set_to_names(rules_event_set);
|
||||
if (!rules_event_set.empty())
|
||||
{
|
||||
falco_logger::log(LOG_DEBUG, "(" + std::to_string(rules_syscalls_names.size()) + ") syscalls activated in rules: " + concat_set_in_order(rules_syscalls_names) + "\n");
|
||||
falco_logger::log(LOG_DEBUG, "(" + std::to_string(rules_names.size())
|
||||
+ ") syscalls activated in rules: " + concat_set_in_order(rules_names) + "\n");
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
* DEFAULT OPTION:
|
||||
*
|
||||
* Current enforce_simple_ppm_sc_set approach includes multiple steps:
|
||||
* (1) Enforce all positive syscalls from each Falco rule
|
||||
* (2) Enforce a static set of syscalls in addition to the syscalls defined in Falco's rules
|
||||
* (3) Enforce `libsinsp` state set (non-adaptive, not conditioned by rules, but based on PPME event table flags indicating generic sinsp state modifications)
|
||||
* -> Final set is union of (1), (2) and (3)
|
||||
*
|
||||
*/
|
||||
/* DEFAULT OPTION:
|
||||
* Current sinsp_state_sc_set() approach includes multiple steps:
|
||||
* (1) Enforce all positive syscalls from each Falco rule
|
||||
* (2) Enforce `libsinsp` state set (non-adaptive, not conditioned by rules,
|
||||
but based on PPME event table flags indicating generic sinsp state modifications)
|
||||
* -> Final set is union of (1) and (2) */
|
||||
auto base_event_set = libsinsp::events::sinsp_state_event_set();
|
||||
s.selected_event_set = rules_event_set.merge(base_event_set);
|
||||
|
||||
// TODO change to enforce_sinsp_state_ppm_sc
|
||||
s.ppm_sc_of_interest = inspector->enforce_simple_ppm_sc_set(rules_ppm_sc_set);
|
||||
|
||||
/* Derive the diff between the additional syscalls added via libsinsp state enforcement and the syscalls from each Falco rule. */
|
||||
std::unordered_set<std::string> non_rules_syscalls_names = unordered_set_difference(inspector->get_syscalls_names(s.ppm_sc_of_interest), rules_syscalls_names);
|
||||
|
||||
if (non_rules_syscalls_names.size() > 0)
|
||||
/* Derive the diff between the additional syscalls added via libsinsp state
|
||||
enforcement and the syscalls from each Falco rule. */
|
||||
auto non_rules_event_set = s.selected_event_set.diff(rules_event_set);
|
||||
if (!non_rules_event_set.empty())
|
||||
{
|
||||
falco_logger::log(LOG_DEBUG, "+(" + std::to_string(non_rules_syscalls_names.size()) + ") syscalls activated (Falco's set of additional syscalls including syscalls needed for state engine): " + concat_set_in_order(non_rules_syscalls_names) + "\n");
|
||||
falco_logger::log(LOG_DEBUG, "+(" + std::to_string(non_rules_event_set.size())
|
||||
+ ") syscalls activated (Falco's set of additional syscalls including syscalls needed for state engine): "
|
||||
+ concat_set_in_order(libsinsp::events::event_set_to_names(non_rules_event_set)) + "\n");
|
||||
}
|
||||
|
||||
/* -A flag behavior:
|
||||
* default: all syscalls in rules included, sinsp state enforcement without high volume I/O syscalls
|
||||
* -A flag set: all syscalls in rules included, sinsp state enforcement and allowing high volume I/O syscalls
|
||||
*/
|
||||
|
||||
* (1) default: all syscalls in rules included, sinsp state enforcement
|
||||
without high volume I/O syscalls
|
||||
* (2) -A flag set: all syscalls in rules included, sinsp state enforcement
|
||||
and allowing high volume I/O syscalls */
|
||||
if(!s.options.all_events)
|
||||
{
|
||||
std::unordered_set<uint32_t> io_ppm_sc_set = enforce_io_ppm_sc_set();
|
||||
std::unordered_set<std::string> erased_io_syscalls_names = inspector->get_syscalls_names(unordered_set_intersection(s.ppm_sc_of_interest, io_ppm_sc_set));
|
||||
s.ppm_sc_of_interest = unordered_set_difference(s.ppm_sc_of_interest, io_ppm_sc_set);
|
||||
|
||||
if (erased_io_syscalls_names.size() > 0)
|
||||
auto ignored_event_set = libsinsp::events::sc_set_to_event_set(libsinsp::events::io_sc_set());
|
||||
auto erased_event_set = s.selected_event_set.intersect(ignored_event_set);
|
||||
s.selected_event_set = s.selected_event_set.diff(ignored_event_set);
|
||||
if (!erased_event_set.empty())
|
||||
{
|
||||
falco_logger::log(LOG_DEBUG, "-(" + std::to_string(erased_io_syscalls_names.size()) + ") high volume I/O syscalls (`-A` flag not set): " + concat_set_in_order(erased_io_syscalls_names) + "\n");
|
||||
falco_logger::log(LOG_DEBUG, "-(" + std::to_string(erased_event_set.size())
|
||||
+ ") ignored high volume I/O syscalls (`-A` flag not set): "
|
||||
+ concat_set_in_order(libsinsp::events::event_set_to_names(erased_event_set)) + "\n");
|
||||
}
|
||||
}
|
||||
|
||||
std::unordered_set<std::string> final_syscalls_names = inspector->get_syscalls_names(s.ppm_sc_of_interest);
|
||||
|
||||
if (final_syscalls_names.size() > 0)
|
||||
if (!s.selected_event_set.empty())
|
||||
{
|
||||
falco_logger::log(LOG_DEBUG, "(" + std::to_string(final_syscalls_names.size()) + ") syscalls in total activated (final set): " + concat_set_in_order(final_syscalls_names) + "\n");
|
||||
falco_logger::log(LOG_DEBUG, "(" + std::to_string(s.selected_event_set.size())
|
||||
+ ") syscalls in total activated (final set): "
|
||||
+ concat_set_in_order(libsinsp::events::event_set_to_names(s.selected_event_set)) + "\n");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
void falco::app::actions::activate_interesting_kernel_tracepoints(falco::app::state& s, std::unique_ptr<sinsp>& inspector)
|
||||
static void select_syscall_set(falco::app::state& s, const libsinsp::events::set<ppm_event_code>& rules_event_set)
|
||||
{
|
||||
s.selected_sc_set = libsinsp::events::event_set_to_sc_set(s.selected_event_set);
|
||||
}
|
||||
|
||||
static void select_kernel_tracepoint_set(falco::app::state& s)
|
||||
{
|
||||
/* Kernel tracepoints activation
|
||||
*
|
||||
* Activate all tracepoints except `sched_switch` tracepoint since it is highly noisy and not so useful
|
||||
* for our state/events enrichment.
|
||||
*/
|
||||
* Activate all tracepoints except `sched_switch` tracepoint since it
|
||||
* is highly noisy and not so useful
|
||||
* for our state/events enrichment. */
|
||||
s.selected_tp_set = libsinsp::events::sinsp_state_tp_set();
|
||||
s.selected_tp_set.remove(ppm_tp_code::SCHED_SWITCH);
|
||||
}
|
||||
|
||||
falco::app::run_result falco::app::actions::configure_interesting_sets(falco::app::state& s)
|
||||
{
|
||||
|
||||
std::unique_ptr<sinsp> inspector(new sinsp());
|
||||
std::unordered_set<std::string> rules_evttypes_names;
|
||||
|
||||
falco::app::actions::extract_rules_event_names(s, inspector, rules_evttypes_names); // when reaching this code all evttypes are valid
|
||||
falco::app::actions::activate_interesting_syscalls(s, inspector, rules_evttypes_names);
|
||||
falco::app::actions::activate_interesting_events(s, inspector, rules_evttypes_names);
|
||||
falco::app::actions::activate_interesting_kernel_tracepoints(s, inspector);
|
||||
|
||||
s.selected_event_set.clear();
|
||||
s.selected_sc_set.clear();
|
||||
s.selected_tp_set.clear();
|
||||
|
||||
/* note: the set of events is the richest source of truth about
|
||||
* the events generable by an inspector, because they also carry information
|
||||
* about events that are old, unused, internal, and so on. As such, the
|
||||
* strategy is to first craft the actual set of selected events, and
|
||||
* then use it to obtain a set of enabled kernel tracepoints and a set
|
||||
* of syscall codes. Those last two sets will be passed down to the
|
||||
* inspector to instruct the kernel drivers on which kernel event should
|
||||
* be collected at runtime. */
|
||||
auto rules_event_set = extract_rules_event_set(s);
|
||||
select_event_set(s, rules_event_set);
|
||||
check_for_rules_unsupported_events(s, rules_event_set);
|
||||
select_syscall_set(s, rules_event_set);
|
||||
select_kernel_tracepoint_set(s);
|
||||
return run_result::ok();
|
||||
}
|
||||
|
||||
@@ -25,17 +25,13 @@ using namespace falco::utils;
|
||||
|
||||
falco::app::run_result falco::app::actions::print_ignored_events(falco::app::state& s)
|
||||
{
|
||||
|
||||
if(!s.options.print_ignored_events)
|
||||
{
|
||||
return run_result::ok();
|
||||
}
|
||||
|
||||
std::unique_ptr<sinsp> inspector(new sinsp());
|
||||
std::unordered_set<uint32_t> io_ppm_sc_set = enforce_io_ppm_sc_set();
|
||||
|
||||
std::cout << "Ignored I/O syscall(s):" << std::endl;
|
||||
for(const auto& it : inspector->get_syscalls_names(io_ppm_sc_set))
|
||||
for(const auto& it : libsinsp::events::sc_set_to_names(libsinsp::events::io_sc_set()))
|
||||
{
|
||||
std::cout << "- " << it.c_str() << std::endl;
|
||||
}
|
||||
|
||||
@@ -76,7 +76,7 @@ falco::app::run_result falco::app::actions::print_syscall_events(falco::app::sta
|
||||
{
|
||||
if(s.options.list_syscall_events)
|
||||
{
|
||||
const auto events = get_event_entries(true, s.ppm_event_info_of_interest);
|
||||
const auto events = get_event_entries(true, libsinsp::events::all_event_set());
|
||||
|
||||
if(s.options.markdown)
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user