github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-31 14:20:04 +00:00
Code Issues Projects Releases Wiki Activity

cleanup: move ebpf default value logic

Browse Source 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
This commit is contained in:
Andrea Terzolo
2024-02-14 13:11:25 +01:00
committed by poiana
parent 76ab28ff59
commit d49b21ab22
2 changed files with 15 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
userspace/falco/app/actions/helpers_inspector.cpp
View File

@@ -106,21 +106,8 @@ falco::app::run_result falco::app::actions::open_live_inspector(
}
else if(s.is_ebpf()) /* BPF engine. */
{
const char *bpf_probe_path = s.config->m_ebpf.m_probe_path.c_str();
char full_path[PATH_MAX];
/* If the path is empty try to load the probe from the default path. */
if(strncmp(bpf_probe_path, "", 1) == 0)
{
const char *home = std::getenv("HOME");
if(!home)
{
return run_result::fatal("Cannot get the env variable 'HOME'");
}
snprintf(full_path, PATH_MAX, "%s/%s", home, FALCO_PROBE_BPF_FILEPATH);
bpf_probe_path = full_path;
}
falco_logger::log(falco_logger::level::INFO, "Opening '" + source + "' source with BPF probe. BPF probe path: " + std::string(bpf_probe_path));
inspector->open_bpf(bpf_probe_path, s.syscall_buffer_bytes_size, s.selected_sc_set);
falco_logger::log(falco_logger::level::INFO, "Opening '" + source + "' source with BPF probe. BPF probe path: " + s.config->m_ebpf.m_probe_path);
inspector->open_bpf(s.config->m_ebpf.m_probe_path.c_str(), s.syscall_buffer_bytes_size, s.selected_sc_set);
}
else /* Kernel module (default). */
{

19
userspace/falco/configuration.cpp
View File

@@ -133,12 +133,19 @@ void falco_configuration::load_engine_config(const std::string& config_name, con
m_kmod.m_drop_failed_exit = config.get_scalar<bool>("engine.kmod.drop_failed_exit", DEFAULT_DROP_FAILED_EXIT);
break;
case engine_kind_t::EBPF:
// TODO: default value for `probe` should be $HOME/FALCO_PROBE_BPF_FILEPATH,
// to be done once we drop the CLI option otherwise we would need to make the check twice,
// once here, and once when we merge the CLI options in the config file.
m_ebpf.m_probe_path = config.get_scalar<std::string>("engine.ebpf.probe", "");
m_ebpf.m_buf_size_preset = config.get_scalar<int16_t>("engine.ebpf.buf_size_preset", DEFAULT_BUF_SIZE_PRESET);
m_ebpf.m_drop_failed_exit = config.get_scalar<bool>("engine.ebpf.drop_failed_exit", DEFAULT_DROP_FAILED_EXIT);
{
// default value for `m_probe_path` should be `$HOME/FALCO_PROBE_BPF_FILEPATH`
char full_path[PATH_MAX];
const char *home = std::getenv("HOME");
if(!home)
{
throw std::logic_error("Cannot get the env variable 'HOME'");
}
snprintf(full_path, PATH_MAX, "%s/%s", home, FALCO_PROBE_BPF_FILEPATH);
m_ebpf.m_probe_path = config.get_scalar<std::string>("engine.ebpf.probe", std::string(full_path));
m_ebpf.m_buf_size_preset = config.get_scalar<int16_t>("engine.ebpf.buf_size_preset", DEFAULT_BUF_SIZE_PRESET);
m_ebpf.m_drop_failed_exit = config.get_scalar<bool>("engine.ebpf.drop_failed_exit", DEFAULT_DROP_FAILED_EXIT);
}
break;
case engine_kind_t::MODERN_EBPF:
m_modern_ebpf.m_cpus_for_each_buffer = config.get_scalar<uint16_t>("engine.modern_ebpf.cpus_for_each_buffer", DEFAULT_CPUS_FOR_EACH_SYSCALL_BUFFER);