From c702713107a6b69b53b6e73541253fd96f0d7f4d Mon Sep 17 00:00:00 2001 From: Henri DF Date: Sun, 1 May 2016 09:14:43 -0700 Subject: [PATCH] Add discarded syscalls to README --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index cf006aad..6fa554a6 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,10 @@ where `macro_name` is a string, and `macro_definition` is any valid Falco condit +#### Ignored system calls +For performance reasons, some system calls are currently discarded before Falco processing. The current list is: +`clock_getres,clock_gettime,clock_nanosleep,clock_settime,close,epoll_create,epoll_create1,epoll_ctl,epoll_pwait,epoll_wait,eventfd,fcntl,fcntl64,fstat,fstat64,getitimer,gettimeofday,nanosleep,poll,ppoll,pread64,preadv,pselect6,pwrite64,pwritev,read,readv,recv,recvfrom,recvmmsg,recvmsg,select,send,sendfile,sendfile64,sendmmsg,sendmsg,sendto,setitimer,settimeofday,shutdown,socket,splice,switch,tee,timer_create,timer_delete,timerfd_create,timerfd_gettime,timerfd_settime,timer_getoverrun,timer_gettime,timer_settime,wait4,write,writev,` @@ -51,6 +54,7 @@ where `macro_name` is a string, and `macro_definition` is any valid Falco condit ### Configuration file Falco is configured via a yaml file. The sample config `falco.yaml` in this repo has comments describing the various options. + ## Running Falco Falco is intended to be run as a service. But for experimentation and designing/testing rulesets, you will likely want to run it manually from the command-line.