github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 09:02:18 +00:00
Code Issues Projects Releases Wiki Activity

chore: renaming comment references

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Jason Dellaluce 2021-11-16 17:41:17 +00:00 committed by poiana
parent 23706da75e
commit 85db078dc4
4 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docker/builder/root/usr/bin/usage
View File

@ -18,7 +18,7 @@ How to use.
* docker run -ti falcosecurity/falco-builder bash * docker run -ti falcosecurity/falco-builder bash
To build Falco it needs: To build Falco it needs:
- a bind-mount on the source directory (ie., the directory containing Falco and sysdig source as siblings) - a bind-mount on the source directory (ie., the directory containing the Falco source as sibling)
Optionally, you can also bind-mount the build directory. Optionally, you can also bind-mount the build directory.
So, you can execute it from the Falco root directory as follows. So, you can execute it from the Falco root directory as follows.

6
rules/falco_rules.yaml
View File

@ -220,7 +220,7 @@
] ]
# The truncated dpkg-preconfigu is intentional, process names are # The truncated dpkg-preconfigu is intentional, process names are
# truncated at the sysdig level. # truncated at the falcosecurity-libs level.
- list: package_mgmt_binaries - list: package_mgmt_binaries
items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd] items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]
@ -1905,7 +1905,7 @@
# For now, only considering a full mount of /etc as # For now, only considering a full mount of /etc as
# sensitive. Ideally, this would also consider all subdirectories # sensitive. Ideally, this would also consider all subdirectories
# below /etc as well, but the globbing mechanism used by sysdig # below /etc as well, but the globbing mechanism
# doesn't allow exclusions of a full pattern, only single characters. # doesn't allow exclusions of a full pattern, only single characters.
- macro: sensitive_mount - macro: sensitive_mount
condition: (container.mount.dest[/proc*] != "N/A" or condition: (container.mount.dest[/proc*] != "N/A" or
@ -2953,7 +2953,7 @@
# The two Container Drift rules below will fire when a new executable is created in a container. # The two Container Drift rules below will fire when a new executable is created in a container.
# There are two ways to create executables - file is created with execution permissions or permissions change of existing file. # There are two ways to create executables - file is created with execution permissions or permissions change of existing file.
# We will use a new sysdig filter, is_open_exec, to find all files creations with execution permission, and will trace all chmods in a container. # We will use a new filter, is_open_exec, to find all files creations with execution permission, and will trace all chmods in a container.
# The use case we are targeting here is an attempt to execute code that was not shipped as part of a container (drift) - # The use case we are targeting here is an attempt to execute code that was not shipped as part of a container (drift) -
# an activity that might be malicious or non-compliant. # an activity that might be malicious or non-compliant.
# Two things to pay attention to: # Two things to pay attention to:

2
userspace/engine/lua/parser.lua
View File

@ -18,7 +18,7 @@
Much of the scaffolding and helpers was derived from Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser). Much of the scaffolding and helpers was derived from Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser).
While this is based on the sysdig filtering syntax (*), the Falco syntax is extended to support "macro" terms, which are just identifiers. While this is based on the falcosecurity-libs filtering syntax (*), the Falco syntax is extended to support "macro" terms, which are just identifiers.
(*) There is currently one known difference with the syntax implemented in libsinsp: In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can. (*) There is currently one known difference with the syntax implemented in libsinsp: In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can.

2
userspace/falco/falco.cpp
View File

@ -1327,7 +1327,7 @@ int falco_init(int argc, char **argv)
if(trace_filename.size()) if(trace_filename.size())
{ {
// Try to open the trace file as a sysdig // Try to open the trace file as a
// capture file first. // capture file first.
try { try {
inspector->open(trace_filename); inspector->open(trace_filename);