From a200d17581dc08519b098b34927614455da64101 Mon Sep 17 00:00:00 2001 From: Leonardo Di Donato Date: Fri, 8 Nov 2019 12:02:49 +0000 Subject: [PATCH] chore: improving naming Signed-off-by: Leonardo Di Donato --- docker/builder/root/usr/bin/entrypoint | 2 +- docker/builder/root/usr/bin/usage | 2 +- docker/rhel/Dockerfile | 6 +++--- docker/rhel/docker-entrypoint.sh | 2 +- docker/tester/root/usr/bin/entrypoint | 2 +- examples/bad-mount-cryptomining/README.md | 2 +- examples/bad-mount-cryptomining/demo.yml | 2 +- examples/mitm-sh-installer/demo.yml | 2 +- examples/nodejs-bad-rest-api/demo.yml | 2 +- integrations/anchore-falco/README.md | 2 +- .../k8s-with-rbac/falco-daemonset-configmap-slim.yaml | 2 +- .../k8s-with-rbac/falco-daemonset-configmap.yaml | 2 +- 12 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docker/builder/root/usr/bin/entrypoint b/docker/builder/root/usr/bin/entrypoint index 636206b8..17ab0509 100755 --- a/docker/builder/root/usr/bin/entrypoint +++ b/docker/builder/root/usr/bin/entrypoint @@ -21,7 +21,7 @@ esac case "$CMD" in "cmake") - # Check that source directory contains Falco and Sysdig + # Check that source directory contains Falco and sysdig if [ ! -d "$SOURCE_DIR/sysdig" ]; then echo "Missing sysdig source." >&2 exit 1 diff --git a/docker/builder/root/usr/bin/usage b/docker/builder/root/usr/bin/usage index 8e28df51..487b2c44 100755 --- a/docker/builder/root/usr/bin/usage +++ b/docker/builder/root/usr/bin/usage @@ -17,7 +17,7 @@ How to use. * docker run -ti falcosecurity/falco-builder bash To build Falco it needs: - - a bind-mount on the source directory (ie., the directory containing falco and sysdig source as siblings) + - a bind-mount on the source directory (ie., the directory containing Falco and sysdig source as siblings) Optionally, you can also bind-mount the build directory. So, you can execute it from the Falco root directory as follows. diff --git a/docker/rhel/Dockerfile b/docker/rhel/Dockerfile index df70c976..06c154c7 100644 --- a/docker/rhel/Dockerfile +++ b/docker/rhel/Dockerfile @@ -1,12 +1,12 @@ FROM registry.access.redhat.com/rhel7 -MAINTAINER Sysdig Support Team +LABEL maintainer="opensource@sysdig.com" ### Atomic/OpenShift Labels - https://github.com/projectatomic/ContainerApplicationGenericLabels LABEL name="falco" \ - vendor="Sysdig" \ + vendor="falcosecurity" \ url="http://falco.org/" \ - summary="Container Native runtime security" \ + summary="Container native runtime security" \ description="Falco is an open source project for intrusion and abnormality detection for Cloud Native platforms." \ run='docker run -d --name falco --restart always --privileged --net host --pid host -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --shm-size=350m registry.connect.redhat.com/sysdig/falco' diff --git a/docker/rhel/docker-entrypoint.sh b/docker/rhel/docker-entrypoint.sh index b28ddf2b..082abc00 100755 --- a/docker/rhel/docker-entrypoint.sh +++ b/docker/rhel/docker-entrypoint.sh @@ -18,7 +18,7 @@ # set -e -# Set the SKIP_MODULE_LOAD variable to skip loading the sysdig kernel module +# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module if [[ -z "${SKIP_MODULE_LOAD}" ]]; then echo "* Setting up /usr/src links from host" diff --git a/docker/tester/root/usr/bin/entrypoint b/docker/tester/root/usr/bin/entrypoint index 96878bb5..daab479c 100755 --- a/docker/tester/root/usr/bin/entrypoint +++ b/docker/tester/root/usr/bin/entrypoint @@ -38,7 +38,7 @@ case "$CMD" in cd $BUILD_DIR/$BUILD_TYPE/docker/local docker build --build-arg FALCO_VERSION="$FALCO_VERSION" -t "$DOCKER_IMAGE_NAME" . - # Check that source directory contains Falco and Sysdig + # Check that source directory contains Falco and sysdig if [ ! -d "$SOURCE_DIR/falco/test" ]; then echo "Missing $SOURCE_DIR/falco/test directory." >&2 exit 1 diff --git a/examples/bad-mount-cryptomining/README.md b/examples/bad-mount-cryptomining/README.md index d0d8a1b5..dad179ba 100644 --- a/examples/bad-mount-cryptomining/README.md +++ b/examples/bad-mount-cryptomining/README.md @@ -2,7 +2,7 @@ ## Introduction -Based on a [blog post](https://sysdig.com/blog/detecting-cryptojacking/) we wrote, this example shows how an overly permissive container environment can be exploited to install cryptomining software and how use of the exploit can be detected using Sysdig Falco. +Based on a [blog post](https://sysdig.com/blog/detecting-cryptojacking/) we wrote, this example shows how an overly permissive container environment can be exploited to install cryptomining software and how use of the exploit can be detected using Falco. Although the exploit in the blog post involved modifying the cron configuration on the host filesystem, in this example we keep the host filesystem untouched. Instead, we have a container play the role of the "host", and set up everything using [docker-compose](https://docs.docker.com/compose/) and [docker-in-docker](https://hub.docker.com/_/docker/). diff --git a/examples/bad-mount-cryptomining/demo.yml b/examples/bad-mount-cryptomining/demo.yml index d155c288..e845f830 100644 --- a/examples/bad-mount-cryptomining/demo.yml +++ b/examples/bad-mount-cryptomining/demo.yml @@ -29,7 +29,7 @@ services: - "falco" falco: - image: sysdig/falco:latest + image: falcosecurity/falco:latest privileged: true volumes: - docker-socket:/host/var/run diff --git a/examples/mitm-sh-installer/demo.yml b/examples/mitm-sh-installer/demo.yml index 095af948..1c2eef8b 100644 --- a/examples/mitm-sh-installer/demo.yml +++ b/examples/mitm-sh-installer/demo.yml @@ -38,7 +38,7 @@ attacker_botnet_master: # Owned by client, detects attack by attacker falco: container_name: falco - image: sysdig/falco:latest + image: falcosecurity/falco:latest privileged: true volumes: - /var/run/docker.sock:/host/var/run/docker.sock diff --git a/examples/nodejs-bad-rest-api/demo.yml b/examples/nodejs-bad-rest-api/demo.yml index dcd9468f..3db1e47b 100644 --- a/examples/nodejs-bad-rest-api/demo.yml +++ b/examples/nodejs-bad-rest-api/demo.yml @@ -9,7 +9,7 @@ express_server: falco: container_name: falco - image: sysdig/falco:latest + image: falcosecurity/falco:latest privileged: true volumes: - /var/run/docker.sock:/host/var/run/docker.sock diff --git a/integrations/anchore-falco/README.md b/integrations/anchore-falco/README.md index 2ce23129..f42e0c8a 100644 --- a/integrations/anchore-falco/README.md +++ b/integrations/anchore-falco/README.md @@ -1,6 +1,6 @@ # Create Falco rule from Anchore policy result -This integration creates a rule for Sysdig Falco based on Anchore policy result. +This integration creates a rule for Falco based on Anchore policy result. So that when we will try to run an image which has a ```stop``` final action result in Anchore, Falco will alert us. diff --git a/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml b/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml index be2378ff..93db046e 100644 --- a/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml +++ b/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml @@ -39,7 +39,7 @@ spec: # Leave blank for the default probe location, or set to the path # of a precompiled probe. # env: -# - name: SYSDIG_BPF_PROBE +# - name: BPF_PROBE # value: "" args: [ "/usr/bin/falco", "--cri", "/host/run/containerd/containerd.sock", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://$(KUBERNETES_SERVICE_HOST)", "-pk"] volumeMounts: diff --git a/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml b/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml index e54531a6..9b17c815 100644 --- a/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml +++ b/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml @@ -23,7 +23,7 @@ spec: # Leave blank for the default probe location, or set to the path # of a precompiled probe. # env: -# - name: SYSDIG_BPF_PROBE +# - name: BPF_PROBE # value: "" args: [ "/usr/bin/falco", "--cri", "/host/run/containerd/containerd.sock", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://$(KUBERNETES_SERVICE_HOST)", "-pk"] volumeMounts: