github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 17:16:53 +00:00
Code Issues Projects Releases Wiki Activity

new(userspace/falco): added syscall_drop_failed option to drop failed syscalls exit events.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2023-03-24 16:12:46 +01:00 committed by poiana
parent 804e6fc122
commit bf5e340833
4 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
falco.yaml
View File

@ -170,6 +170,8 @@ syscall_event_drops:
syscall_event_timeouts:
max_consecutives: 1000
syscall_drop_failed: false
# --- [Description]
#
# This is an index that controls the dimension of the syscall buffers.

5
userspace/falco/app/actions/helpers_inspector.cpp
View File

@ -125,5 +125,10 @@ falco::app::run_result falco::app::actions::open_live_inspector(
return run_result::fatal(e.what());
}
if (s.config->m_syscall_drop_failed)
{
falco_logger::log(LOG_DEBUG, "Failed syscalls exit event will be dropped.\n");
inspector->set_dropfailed(true);
}
return run_result::ok();
}

5
userspace/falco/configuration.cpp
View File

@ -57,7 +57,8 @@ falco_configuration::falco_configuration():
m_metadata_download_chunk_wait_us(1000),
m_metadata_download_watch_freq_sec(1),
m_syscall_buf_size_preset(4),
m_cpus_for_each_syscall_buffer(2)
m_cpus_for_each_syscall_buffer(2),
m_syscall_drop_failed(false)
{
}
@ -313,6 +314,8 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
m_cpus_for_each_syscall_buffer = config.get_scalar<uint16_t>("modern_bpf.cpus_for_each_syscall_buffer", 2);
m_syscall_drop_failed = config.get_scalar<bool>("syscall_drop_failed", false);
m_base_syscalls.clear();
config.get_sequence<std::unordered_set<std::string>>(m_base_syscalls, std::string("base_syscalls"));

2
userspace/falco/configuration.h
View File

@ -106,6 +106,8 @@ public:
// Number of CPUs associated with a single ring buffer.
uint16_t m_cpus_for_each_syscall_buffer;
bool m_syscall_drop_failed;
// User supplied base_syscalls, overrides any Falco state engine enforcement.
std::unordered_set<std::string> m_base_syscalls;