github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-13 11:55:50 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(config): adjust description for base_syscalls option

Browse Source 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2023-03-29 05:10:45 +00:00 committed by poiana
parent 78daafb56c
commit dad382edd6
1 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
falco.yaml
View File

@ -489,13 +489,14 @@ metadata_download:
# very useful to lower CPU utilization and allowing you to tailor Falco to specific environments
# according to your organization's threat model and cost budget.
#
# !!! When NOT using this option, Falco defaults to adding a static set of syscalls in addition
# to the rules system calls Falco needs for its state engine build-up and life-cycle management.
# !!! When NOT using this option, Falco defaults to adding a static (more verbose) set of syscalls
# in addition to the rules system calls Falco needs for its state engine build-up and life-cycle management.
#
# If you like the recommendations below you can automate them via setting `base_syscalls.repair`
# to true. `base_syscalls.repair` is an experimental alternative to Falco's default state engine
# enforcement. `base_syscalls.repair` is designed to be the most resourceful option to ensure
# Falco runs correctly while activating a most minimal set of additional syscalls.
# `base_syscalls.repair` is an experimental alternative to Falco's default state engine enforcement.
# `base_syscalls.repair` is designed to be the most resourceful option to ensure Falco runs correctly
# while activating a most minimal set of additional syscalls. The recommendations listed in the suggestions
# section is effectively what `base_syscalls.repair` is doing in an automated manner. `base_syscalls.repair`
# can be used with an empty custom set.
#
# --- [Usage]
#
@ -508,7 +509,7 @@ metadata_download:
# --- [Suggestions]
#
# Here are a few recommendations that may help you.
# Setting `base_syscalls.repair: true` automates the recommendations.
# Setting `base_syscalls.repair: true` automates these recommendations for you.
#
# Consider to at minimum add the following syscalls regardless of the syscalls used in the rules.
#
@ -525,16 +526,16 @@ metadata_download:
#
# [clone, clone3, fork, vfork, execve, execveat, close, socket, bind, getsockopt]
#
# It turns out that while you can log `connect` or `accept*` syscalls without the socket
# system call, the log however would not contain the ip tuples.
# For listen and accept* system calls you also need the `bind` system call.
#`
# Lastly, if you care about the correct `uid`, `gid` or `sid`, `pgid of a process when the
# It turns out that while you can log `connect` or `accept*` syscalls without the
# socket system call, the log however would not contain the ip tuples.
# For `listen` and `accept*` system calls you also need the `bind` system call.
#
# Lastly, if you care about the correct `uid`, `gid` or `sid`, `pgid` of a process when the
# running process opens a file or makes a network connection, consider adding the following syscalls:
#
# setresuid, setsid, setuid, setgid, setpgid, setresgid, setsid, capset, chdir, chroot, fchdir
#
# We recommend to exclude syscalls, e.g. "!mprotect" only if you need a fast deployment update
# We recommend to only exclude syscalls, e.g. "!mprotect" if you need a fast deployment update
# (overriding rules), else remove unwanted syscalls from the Falco rules.
#
# Passing `-o "log_level=debug"` to Falco's cmd args during a dry-run will print the