diff --git a/CMakeLists.txt b/CMakeLists.txt index cd80f904..40f52f3b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -19,6 +19,14 @@ option(BUILD_WARNINGS_AS_ERRORS "Enable building with -Wextra -Werror flags" OFF option(MINIMAL_BUILD "Build a minimal version of Falco, containing only the engine and basic input/output (EXPERIMENTAL)" OFF) option(MUSL_OPTIMIZED_BUILD "Enable if you want a musl optimized build" OFF) +# gVisor is currently only supported on Linux x86_64 +if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD) + option(BUILD_FALCO_GVISOR "Build gVisor support for Falco" ON) + if (BUILD_FALCO_GVISOR) + add_definitions(-DHAS_GVISOR) + endif() +endif() + # We shouldn't need to set this, see https://gitlab.kitware.com/cmake/cmake/-/issues/16419 option(EP_UPDATE_DISCONNECTED "ExternalProject update disconnected" OFF) if (${EP_UPDATE_DISCONNECTED}) diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake index c6790d53..3b53e2d6 100644 --- a/cmake/modules/falcosecurity-libs.cmake +++ b/cmake/modules/falcosecurity-libs.cmake @@ -58,6 +58,9 @@ endif() set(LIBSINSP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}") +# configure gVisor support +set(BUILD_LIBSCAP_GVISOR ${BUILD_FALCO_GVISOR} CACHE BOOL "") + # explicitly disable the tests/examples of this dependency set(CREATE_TEST_TARGETS OFF CACHE BOOL "") set(BUILD_LIBSCAP_EXAMPLES OFF CACHE BOOL "") diff --git a/userspace/falco/app_cmdline_options.cpp b/userspace/falco/app_cmdline_options.cpp index 0cb3564d..cb95cf83 100644 --- a/userspace/falco/app_cmdline_options.cpp +++ b/userspace/falco/app_cmdline_options.cpp @@ -162,9 +162,11 @@ void cmdline_options::define() ("disable-source", "Disable a specific event source. Available event sources are: syscall or any source from a configured plugin with event sourcing capability. It can be passed multiple times. Can not disable all event sources.", cxxopts::value(disable_sources), "") ("D", "Disable any rules with names having the substring . Can be specified multiple times. Can not be specified with -t.", cxxopts::value(disabled_rule_substrings), "") ("e", "Read the events from in .scap format instead of tapping into live.", cxxopts::value(trace_filename), "") +#ifdef HAS_GVISOR ("g,gvisor-config", "Parse events from gVisor using the specified configuration file. A falco-compatible configuration file can be generated with --gvisor-generate-config and can be used for both runsc and Falco.", cxxopts::value(gvisor_config), "") ("gvisor-generate-config", "Generate a configuration file that can be used for gVisor.", cxxopts::value(gvisor_generate_config_with_socket)->implicit_value("/tmp/gvisor.sock"), "") ("gvisor-root", "gVisor root directory for storage of container state. Equivalent to runsc --root flag.", cxxopts::value(gvisor_root), "") +#endif ("i", "Print all events that are ignored by default (i.e. without the -A flag) and exit.", cxxopts::value(print_ignored_events)->default_value("false")) #ifndef MINIMAL_BUILD ("k,k8s-api", "Enable Kubernetes support by connecting to the API server specified as argument. E.g. \"http://admin:password@127.0.0.1:8080\". The API server can also be specified via the environment variable FALCO_K8S_API.", cxxopts::value(k8s_api), "")