github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-03-18 18:58:41 +00:00
Code Issues Projects Releases Wiki Activity

Squash w Application changes to support actions

Browse Source
This commit is contained in:
Mark Stemm
2022-03-02 17:42:45 -08:00
parent 2c1c23830a
commit e0feeeaa40
2 changed files with 36 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
userspace/falco/application.cpp
View File

@@ -28,11 +28,20 @@ limitations under the License.
namespace falco {
namespace app {
std::string application::s_syscall_source = "syscall";
std::string application::s_k8s_audit_source = "k8s_audit";
application::action_state::action_state()
: restart(false),
terminate(false),
reopen_outputs(false)
reopen_outputs(false),
enabled_sources({application::s_syscall_source, application::s_k8s_audit_source}),
event_source(application::s_syscall_source)
{
config = std::make_shared<falco_configuration>();
outputs = std::make_shared<falco_outputs>();
inspector = std::make_shared<sinsp>();
engine = std::make_shared<falco_engine>();
}
application::action_state::~action_state()
@@ -76,11 +85,19 @@ bool application::init(int argc, char **argv, std::string &errstr)
return false;
}
m_action_manager.add(std::shared_ptr<runnable_action>(new act_print_help(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_print_version(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_create_signal_handlers(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_init_falco_engine(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_init_inspector(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_init_outputs(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_list_plugins(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_load_config(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_load_plugins(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_print_help(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_print_ignored_events(*this)));
m_action_manager.add(std::shared_ptr<runnable_action>(new act_print_version(*this)));
#ifndef MINIMAL_BUILD
m_action_manager.add(std::shared_ptr<runnable_action>(new act_start_grpc_server(*this)));
#endif
m_initialized = true;
return true;
}

16
userspace/falco/application.h
View File

@@ -48,9 +48,23 @@ public:
bool terminate;
bool reopen_outputs;
falco_configuration config;
std::shared_ptr<falco_configuration> config;
std::shared_ptr<falco_outputs> outputs;
std::shared_ptr<falco_engine> engine;
std::shared_ptr<sinsp> inspector;
std::set<std::string> enabled_sources;
// The event source is syscall by default. If an input
// plugin was found, the source is the source of that
// plugin.
std::string event_source;
std::list<sinsp_plugin::info> plugin_infos;
};
static std::string s_syscall_source;
static std::string s_k8s_audit_source;
application();
virtual ~application();