github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-18 22:27:52 +00:00
Code Issues Projects Releases Wiki Activity
4,957 Commits 117 Branches 173 Tags 105 MiB
master
Commit Graph

4957 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
poiana
782a833795 update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-08-18 17:32:18 +02:00
poiana
6adc54c92f update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-08-12 11:49:42 +02:00
Leonardo Grasso
1d3ac2871e docs(falco.yaml): update config index 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
fda1430afb fix(userspace/falco): smart pointer for sinsp_dumper 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
7cb23e0191 feat(unit_tests): add test for capture feature 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
97d88d12f1 chore(userspace/engine): initialize bool member for falco_rule 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
3af03998eb fix(userspace/falco): correct typo in type 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
aa501437a4 fix(userspace/engine): adding capture members to to the rule equility operator 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
504d52e694 fix(userspace/falco): address init ordering warning for falco_configuration 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
8dbd04816d fix(userspace/falco): add "capture" in config schema 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
63d27fbe1b chore: fix formatting 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
81f26b7e5d chore(userspace/falco): fix codespell 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
15e8a746cb new(userspace/falco): capture feature impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
a818d48806 new(userspace/falco): add file name generator helper for capture 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
1da5514012 new(userspapace/engine): add capture and capture_duration to the engine 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
21350a282c new(userspapace/engine): add capture and capture_duration to rules loader 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
e6cd74995c new(userspace/falco): config parsing 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Leonardo Grasso
5ebfa1b05b new: add config options and docs for capture feature 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
José Carlos Chávez
bff2f619df fix: indentation 
Co-authored-by: Samuel Gaist <samuel.gaist@idiap.ch>
Signed-off-by: José Carlos Chávez <jcchavezs@gmail.com>
 2025-08-11 10:46:35 +02:00
José Carlos Chávez
845e998ab4 fix: moves falco version up as it is duplicated 
Signed-off-by: José Carlos Chávez <jcchavezs@gmail.com>
 2025-08-11 10:46:35 +02:00
José Carlos Chávez
801e8bdbff chore: adds labels to falco-debian, driver-loader and driver-loader-buster 
Signed-off-by: José Carlos Chávez <jcchavezs@gmail.com>
 2025-08-11 10:46:35 +02:00
José Carlos Chávez
1fb0c85b19 feat: includes sha on the image labels 
Signed-off-by: José Carlos Chávez <jcchavezs@gmail.com>
 2025-08-11 10:46:35 +02:00
Federico Di Pierro
539294595e update(userspace/engine): bump engine version and checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-08-04 17:12:50 +02:00
Federico Di Pierro
154cde354f fix(userspace/falco): use proper API to fetch event param[0] as uint32_t. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-08-04 17:12:50 +02:00
poiana
ce8a67a5f4 update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-08-04 17:12:50 +02:00
Federico Di Pierro
ec24062b71 chore(userspace/falco): print plugin version info too at plugin loading. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-08-01 18:27:30 +02:00
Federico Di Pierro
08b9e0f065 chore(ci): disable mimalloc for master builds. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-28 11:31:05 +02:00
Federico Di Pierro
3dce2f030d fix(cmake,userspace): fix usage and build of mimalloc. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-25 16:58:43 +02:00
Federico Di Pierro
687c3e147d update(cmake): bump mimalloc to 3.1.5. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-25 16:58:43 +02:00
Federico Di Pierro
e13e384d37 new(ci): add optional input to reusable_build_packages workflow to enable jemalloc or mimalloc. 
Enable mimalloc in all CIs but release CI (keep it with jemalloc for now).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-25 16:58:43 +02:00
Federico Di Pierro
6a4fa5dfce new(cmake,userspace/falco): add mimalloc allocator library support. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-25 16:58:43 +02:00
dependabot[bot]
cf792a0700 chore(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `1208816` to `be38001`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](120881647a...be3800132f)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-version: be3800132f0b9e4467d849c7b99e9b06f84211ad
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-07-25 10:56:44 +02:00
Leonardo Grasso
8dee7a075e docs(falco.yaml): avoid out-of-sync config options for container plugin 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-07-24 17:00:41 +02:00
Mariell Hoversholm
c3fc9e0d0f fix(restart_handler): disable if there is no work 
When there is no work to do, i.e. when all config watching is disabled,
there is no need to keep the restart_handler running. Disable it in this
case.

This is helpful to do on nodes where there is little to no headroom in
terms of open inotify watches (as per the inotify/max_user_instances
configuration), as can happen on nodes populated with other software
that also watch the filesystem for changes. If Falco is run on such a
node, it may fail to start due to functionality the app does not even
intend on using.

This has one change in terms of behaviour, however: the dry-run restarts
will no longer occur. As there is still never going to happen a real
restart, I understand it as unlikely for there to be a proper need for
dry-run restarts.

Signed-off-by: Mariell Hoversholm <mariell@grafana.com>
 2025-07-24 12:56:39 +02:00
Federico Di Pierro
5e2925bc95 update(cmake): bumped cpp-httplib dep to v0.23.1 (latest release). 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-07-22 14:32:28 +02:00
Leonardo Di Giovanna
ca291b0eaf update(userspace/engine): update falco engine version and checksum 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-07-22 14:30:29 +02:00
poiana
4deb2bdf31 update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-07-22 11:40:29 +02:00
Leonardo Di Giovanna
8956279d47 build: fix debian:buster apt debian repo URL in driver-loader-buster 
As buster reached its EOL, the official debian repo URL doesn't
host anymore buster packages info. For this reason, change the URLs
to point to the `20250630T203427Z` snapshot, which still contains
them.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-07-18 12:02:10 +02:00
poiana
0c12b44bc6 update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-07-02 17:22:29 +02:00
Leonardo Di Giovanna
33e6e1ef61 update(CHANGELOG.md): release 0.41.3 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-07-02 16:29:30 +02:00
dependabot[bot]
25be186548 chore(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `4d51b18` to `1208816`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](4d51b1813f...120881647a)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-version: 120881647a359084f1a99439b33b7effadf62f45
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-07-02 12:22:28 +02:00
Federico Di Pierro
ea9e86d9e0 update(userspace): bump engine version and checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-06-30 14:25:18 +02:00
Federico Di Pierro
b2c76769cf fix(userspace/falco): enforce filtercheck overlap check for static fields too against plugin fields. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2025-06-30 14:25:18 +02:00
Federico Di Pierro
07266e1247 new(userspace/falco): append static filterchecks with static fields. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-06-30 14:25:18 +02:00
Federico Di Pierro
8d8ba5ba5c new(userspace/falco): add new static_fields config key + update schema. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-06-30 14:25:18 +02:00
Leonardo Di Giovanna
2ed1f0ffec docs(RELEASE.md): remove some unneeded old activities 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-06-18 15:38:05 +02:00
Leonardo Di Giovanna
f146204623 docs(RELEASE.md): fix falcosecurity/community repo link 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-06-18 15:38:05 +02:00
Leonardo Di Giovanna
56bf4933e7 docs(RELEASE.md): fix rn2md command documentation 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-06-18 15:38:05 +02:00
Leonardo Di Giovanna
d4e69e8c5a docs(RELEASE.md): fix release note checking procedure documentation 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2025-06-18 15:38:05 +02:00
poiana
a9386b37f2 update(cmake): update libs and driver to latest master. 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-06-17 16:22:45 +02:00