github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-09 10:07:57 +00:00
Code Issues Projects Releases Wiki Activity
4,220 Commits 118 Branches 173 Tags 105 MiB
fix_CI_4
Commit Graph

75 Commits

Author SHA1 Message Date
Melissa Kilby
d28f43cd98 chore: apply codespell fixes 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-06 15:32:05 +02:00
Leonardo Grasso
25d23168f4 docs(proposals): roadamap mgt non-goals 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Co-authored-by: Massimiliano Giovagnoli <me@maxgio.it>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-05-30 15:51:30 +02:00
Leonardo Grasso
2f6f098b07 docs(proposals): apply suggestions from review 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-05-30 15:51:30 +02:00
Leonardo Grasso
daa53fb69b docs(proposals): scope of the WG for Falco roadmap 
Co-authored-by: Luca Guerra <luca@guerra.sh>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-05-30 15:51:30 +02:00
Leonardo Grasso
403ad1f5e2 docs(proposals): Falco roadmap management 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-05-30 15:51:30 +02:00
Leonardo Grasso
9c04622bd6 chore(proposals): fix typo found by FedeDP 
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-12-14 17:32:14 +01:00
Leonardo Grasso
0200ec288e chore(proposals): fix typo found by codespell 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-12-14 17:32:14 +01:00
Leonardo Grasso
50c169987e docs(proposal): new artifacts distribution proposal 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-12-14 17:32:14 +01:00
Mateusz Gozdek
cb4cec6f57 Fix typos 
Found by running the following command:
codespell -f -H -L aks,creat,chage -S .git

Signed-off-by: Mateusz Gozdek <mgozdek@microsoft.com>
 2022-04-06 14:40:31 +02:00
Josh Soref
2f2c5c4a9b spelling: whether 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
4ecb907223 spelling: unambiguously 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
e4e8dcf06b spelling: third 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
73f98de005 spelling: that 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d8cfaee242 spelling: syntactic 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
f12149dc87 spelling: superseded 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d55cd79ebd spelling: parentheses 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
5e7346ccb0 spelling: official 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d685e0967a spelling: minikube 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
be35c45590 spelling: manageable 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
f5dab2eb5a spelling: implicit 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
ed11b8833f spelling: extractor 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
88a5404d1c spelling: defining 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
3806e62c3a spelling: constitute 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
bda7d7bb11 spelling: comparisons 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
cc30fcc0cf spelling: command 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
676fc9efa8 spelling: between 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
72725a7f87 spelling: archiving 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Leo Di Donato
3414ca5361 update(proposal): clarify that old drivers are not removed anymore 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-09-29 16:51:25 +02:00
Loris Degioanni
5e027c7fe2 Proposal for a libs plugin system 
Description of changes to falcosecurity/libs and /falco to support
plugins to provide events and extract fields from events.

Signed-off-by: Loris Degioanni <loris@sysdig.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Mark Stemm <mark.stemm@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2021-08-24 17:52:19 +02:00
Leonardo Di Donato
24f64cab33 docs(proposals): fix libs contribution name 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-05-17 16:24:53 +02:00
Leonardo Di Donato
19fe7240e2 new(proposals): libraries donation 
Donate:
- libsinsp
- libscap
- the kernel module driver
- the eBPF driver sources

by moving them to the Falco project.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-02-04 17:29:42 +01:00
Leonardo Grasso
581d67fa08 docs(proposals/20200828-structured-exception-handling): indentation 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-01-08 17:53:08 +01:00
Leonardo Grasso
b7bda6d892 docs(proposals/20200828-structured-exception-handling): highlight syntax 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
5eec26976d Add notes on single-field exceptions 
If an exception item has a single value for fields, all the values are
combined together into a single set to build an expression field
cmp (val1, val2, ...)

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
1916314583 Use well-defined object keys 
Instead of oveloading the exception item name as the key of the object,
just have a flat array of object with a name property.

A bit more verbose, but makes it easier to understand what the schema is.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
8831c7f3c7 Add notion of exception operators 
A rule exception can now have a comps property that allows fields to be
matched against items using an operator of =. If not defined, equality
is implied.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
2cebe052a1 Address feedback 
- Clean up npm examples so they are valid.
- Small punctuation changes.
- Emphasize that the strings related to field values are arbitrary.
- Emphasize that exceptions only use equality matching.
- Emphasize that you'll need to upgrade falco to use these new features.
- Capitalize Falco everywhere.
- Change language related to backwards compatibility.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
05282f3976 Proposal on better exception handling 
This proposes adding exceptions as a first class object to falco rules
files.

It adds a new key "exceptions" to rule objects that allows a rule
writer to define tuples of field names that comprise an exception, and a
new top level object "exception" that contains lists of tuples of field
values that define exceptions to rules.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Leonardo Di Donato
a575625043 docs(proposals): new drivers storage obsolate part of existing artifacts storage proposals 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-28 14:11:39 +01:00
Lorenzo Fontana
61bfd5a158 update(proposals): proposal for moving the drivers to S3 
Reviewed-by: Spencer Krum <nibz@spencerkrum.com>
Reviewed-by: Leonardo Grasso <me@leonardograsso.com>
Reviewed-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-10-26 14:07:31 +01:00
Leo Di Donato
d25e07381e update(proposals): clarify that prebuilding drivers is on a best-effort basis 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
481eedb80e update(proposals): artifacts cleanup (prebuilt drivers part) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
f077f2887f new(proposals): artifacts cleanup (packages part) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
d80ffeae5b update(proposals): artifacts storage proposal 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
2d24df1ce2 new(proposals): initial document about SoA of artifacts storage 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
b88767f558 bc(userspace/falco): the Falco gRPC Outputs API are now "falco.outputs.service/get" and "falco.outputs.service/sub" 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-29 20:42:50 +02:00
Leonardo Di Donato
4e2f3e2c71 update(proposals): keep Falco gRPC Outputs proposal in sync 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-29 20:42:50 +02:00
Leonardo Grasso
a520a9b666 update(proposals/20200506-artifacts-scope-part-2.md): resolution about image naming 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
9393ae9e03 fix(proposals/20200506-artifacts-scope): typos 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
fcd2849a5d update(proposals/20200506-artifacts-scope): refinements 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

As per https://github.com/falcosecurity/falco/pull/1184/files#r420856406
 2020-05-12 18:53:46 +02:00