From e0feeeaa40db804e2ebca00ca3684dd791b95261 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Wed, 2 Mar 2022 17:42:45 -0800 Subject: [PATCH] Squash w Application changes to support actions --- userspace/falco/application.cpp | 25 +++++++++++++++++++++---- userspace/falco/application.h | 16 +++++++++++++++- 2 files changed, 36 insertions(+), 5 deletions(-) diff --git a/userspace/falco/application.cpp b/userspace/falco/application.cpp index ce585757..d8d2b14d 100644 --- a/userspace/falco/application.cpp +++ b/userspace/falco/application.cpp @@ -28,11 +28,20 @@ limitations under the License. namespace falco { namespace app { +std::string application::s_syscall_source = "syscall"; +std::string application::s_k8s_audit_source = "k8s_audit"; + application::action_state::action_state() : restart(false), terminate(false), - reopen_outputs(false) + reopen_outputs(false), + enabled_sources({application::s_syscall_source, application::s_k8s_audit_source}), + event_source(application::s_syscall_source) { + config = std::make_shared(); + outputs = std::make_shared(); + inspector = std::make_shared(); + engine = std::make_shared(); } application::action_state::~action_state() @@ -76,11 +85,19 @@ bool application::init(int argc, char **argv, std::string &errstr) return false; } - m_action_manager.add(std::shared_ptr(new act_print_help(*this))); - m_action_manager.add(std::shared_ptr(new act_print_version(*this))); m_action_manager.add(std::shared_ptr(new act_create_signal_handlers(*this))); + m_action_manager.add(std::shared_ptr(new act_init_falco_engine(*this))); + m_action_manager.add(std::shared_ptr(new act_init_inspector(*this))); + m_action_manager.add(std::shared_ptr(new act_init_outputs(*this))); + m_action_manager.add(std::shared_ptr(new act_list_plugins(*this))); m_action_manager.add(std::shared_ptr(new act_load_config(*this))); - + m_action_manager.add(std::shared_ptr(new act_load_plugins(*this))); + m_action_manager.add(std::shared_ptr(new act_print_help(*this))); + m_action_manager.add(std::shared_ptr(new act_print_ignored_events(*this))); + m_action_manager.add(std::shared_ptr(new act_print_version(*this))); +#ifndef MINIMAL_BUILD + m_action_manager.add(std::shared_ptr(new act_start_grpc_server(*this))); +#endif m_initialized = true; return true; } diff --git a/userspace/falco/application.h b/userspace/falco/application.h index 0ba5429e..2d61a58c 100644 --- a/userspace/falco/application.h +++ b/userspace/falco/application.h @@ -48,9 +48,23 @@ public: bool terminate; bool reopen_outputs; - falco_configuration config; + std::shared_ptr config; + std::shared_ptr outputs; + std::shared_ptr engine; + std::shared_ptr inspector; + std::set enabled_sources; + + // The event source is syscall by default. If an input + // plugin was found, the source is the source of that + // plugin. + std::string event_source; + + std::list plugin_infos; }; + static std::string s_syscall_source; + static std::string s_k8s_audit_source; + application(); virtual ~application();