github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-15 04:43:52 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(config): adjust description for base_syscalls option

Browse Source 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2023-03-29 05:10:45 +00:00 committed by poiana
parent 78daafb56c
commit dad382edd6
1 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
falco.yaml
View File

@ -489,13 +489,14 @@ metadata_download:
# very useful to lower CPU utilization and allowing you to tailor Falco to specific environments # very useful to lower CPU utilization and allowing you to tailor Falco to specific environments
# according to your organization's threat model and cost budget. # according to your organization's threat model and cost budget.
# #
# !!! When NOT using this option, Falco defaults to adding a static set of syscalls in addition # !!! When NOT using this option, Falco defaults to adding a static (more verbose) set of syscalls
# to the rules system calls Falco needs for its state engine build-up and life-cycle management. # in addition to the rules system calls Falco needs for its state engine build-up and life-cycle management.
# #
# If you like the recommendations below you can automate them via setting `base_syscalls.repair` # `base_syscalls.repair` is an experimental alternative to Falco's default state engine enforcement.
# to true. `base_syscalls.repair` is an experimental alternative to Falco's default state engine # `base_syscalls.repair` is designed to be the most resourceful option to ensure Falco runs correctly
# enforcement. `base_syscalls.repair` is designed to be the most resourceful option to ensure # while activating a most minimal set of additional syscalls. The recommendations listed in the suggestions
# Falco runs correctly while activating a most minimal set of additional syscalls. # section is effectively what `base_syscalls.repair` is doing in an automated manner. `base_syscalls.repair`
# can be used with an empty custom set.
# #
# --- [Usage] # --- [Usage]
# #
@ -508,7 +509,7 @@ metadata_download:
# --- [Suggestions] # --- [Suggestions]
# #
# Here are a few recommendations that may help you. # Here are a few recommendations that may help you.
# Setting `base_syscalls.repair: true` automates the recommendations. # Setting `base_syscalls.repair: true` automates these recommendations for you.
# #
# Consider to at minimum add the following syscalls regardless of the syscalls used in the rules. # Consider to at minimum add the following syscalls regardless of the syscalls used in the rules.
# #
@ -525,16 +526,16 @@ metadata_download:
# #
# [clone, clone3, fork, vfork, execve, execveat, close, socket, bind, getsockopt] # [clone, clone3, fork, vfork, execve, execveat, close, socket, bind, getsockopt]
# #
# It turns out that while you can log `connect` or `accept*` syscalls without the socket # It turns out that while you can log `connect` or `accept*` syscalls without the
# system call, the log however would not contain the ip tuples. # socket system call, the log however would not contain the ip tuples.
# For listen and accept* system calls you also need the `bind` system call. # For `listen` and `accept*` system calls you also need the `bind` system call.
#` #
# Lastly, if you care about the correct `uid`, `gid` or `sid`, `pgid of a process when the # Lastly, if you care about the correct `uid`, `gid` or `sid`, `pgid` of a process when the
# running process opens a file or makes a network connection, consider adding the following syscalls: # running process opens a file or makes a network connection, consider adding the following syscalls:
# #
# setresuid, setsid, setuid, setgid, setpgid, setresgid, setsid, capset, chdir, chroot, fchdir # setresuid, setsid, setuid, setgid, setpgid, setresgid, setsid, capset, chdir, chroot, fchdir
# #
# We recommend to exclude syscalls, e.g. "!mprotect" only if you need a fast deployment update # We recommend to only exclude syscalls, e.g. "!mprotect" if you need a fast deployment update
# (overriding rules), else remove unwanted syscalls from the Falco rules. # (overriding rules), else remove unwanted syscalls from the Falco rules.
# #
# Passing `-o "log_level=debug"` to Falco's cmd args during a dry-run will print the # Passing `-o "log_level=debug"` to Falco's cmd args during a dry-run will print the