github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-03-18 18:58:41 +00:00
Code Issues Projects Releases Wiki Activity
2,142 Commits 122 Branches 184 Tags
new/inspect-per-cpu
Commit Graph

119 Commits

Author SHA1 Message Date
Leonardo Di Donato
d469681bb1 wip 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-11-13 09:23:35 +00:00
Lorenzo Fontana
55a93bce8b build: bump sinsp, scap and the drivers to 5c0b863ddade7a45568c0ac97d037422c9efb750 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
e0175b1e06 build: cmake modules fixes and split 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
8be299939a build: update sinsp, scap and the drivers to c4f096099bf81966803d26c40c6c2cb2b8d08033 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
9828c6aeb6 build: bump gRPC to 1.32.0 
Besides all the other improvements, we are really interested
in getting the Make options for other ISAs than x86_64 when it
comes to compiling abseil [0].

This is what happens on aarch64

```
make[4]: *** [Makefile:2968: /root/falco/build-musl/grpc-prefix/src/grpc/objs/opt/third_party/abseil-cpp/absl/base/internal/thread_identity.o] Error 1
c++: error: unrecognized command line option '-maes'
c++: error: unrecognized command line option '-msse4'
c++: error: unrecognized command line option '-msse4'
c++: error: unrecognized command line option '-maes'
```

[0] bf87ec9e44

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
7ee0eb7e9c update: cpack specify architecture for debian packages 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
0f155c3a1f build: switch Falco back to luajit 
moonjit is unmaintaned [0], and lujit recently [1] added support
for the aarch64 architecture.

[0] https://twitter.com/siddhesh_p/status/1308594269502885889?s=20
[1] e9af1abec5

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
3258bdd990 update: syscall table zero definition for arm64 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
9f41a390a7 update: bump sinsp and scap to fntlnz-aarch64 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
7aa6fa9897 build: use fields_info from libsinsp 
Related-to: https://github.com/draios/sysdig/pull/1693
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
8dd9ebbdf9 build: moonjit replacement for luajit 
This is needed because Luajit does not support many architectures
such as aarch64 and ppcle64.

Note: some operating systems, such as Alpine, already use moonjit as a dropin
replacement for luajit.

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-11-10 04:09:10 -05:00
Lorenzo Fontana
a51c4fc903 build: static code analysis structure and cppcheck 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Leonardo Grasso
558b18ea67 build: update the driver version to 2aa88dc 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Leonardo Grasso
bbfb27777b build: remove macrodefs about time (musl build) 
See https://github.com/draios/sysdig/pull/1684

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Leonardo Di Donato
f02a998526 build: update the driver version to 73554b9 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
5316e39379 chore(cmake/modules): correct logging for string-view-lite (always) bundled header dependency 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
7e28e305a6 deps: update driver version 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
ec2ccf4d1c build: fix cares include 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
be7ba9fea4 build: fix cares include path 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
2141580a10 update(userspace/engine): bump driver version to 9c7755ae7aaa221a3d17c1d98911c4c2cbdbd21317559d744e53bf63a2677a4b 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
f2bc92ac58 build: allow configurable cpack targets 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
d5f752de7a build: add MUSL_OPTIMIZED_BUILD option 
This option is now decoupled from `MINIMAL_BUILD`

Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
109efc2799 chore(cmake/modules): refine sysdig cmake for minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
c46dbc7f11 build: remove gRPC, openssl, curl from minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
a87913c822 build: update sysdig version to ae104eb20ff0198a5dcb0c91cc36c86e7c3f25c7 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-08-24 20:32:24 +02:00
Leonardo Di Donato
fbac5b77ff build(cmake/modules): change driver version to 37aab8 
This driver version brings into the following features:
- fix for https://github.com/draios/sysdig/issues/1659 (correct handling
  of the pathnames args for *at syscalls)
- update JQ + builtin oniguruma

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
fc39c92048 build: update sysdig shasum 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
32374e9d95 build(cmake/modules/jq): explaination for jq mirroring link 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
220274601c build(cmake/jq): mirror jq 1.6 in Falco bintray 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
d6279bd474 build: bump gRPC to 1.31.1 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
a20e3267cd build: make sure lyaml is linked with the bundled libyaml 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
0324e8b610 build: update gRPC to 0.27.0 
This change was needed because gRPC was using some internal classes
to do vector operations in 0.25.0

Those operations were leading to sigsegv under certain operating
systems, like Ubuntu 18.04

In 0.27.0 they swapped their internal libraries with abseil-cpp.

I tested this and our gRPC server works very well with this new version
as well the CRI api.

I didn't go to 0.31.0 yet because it's very different now and it will
require more iterations to get there, specifically on the CRI api code.

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
feb39010bb build: include openssl libraries in falco 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
59b2bdac9d build: avoid autoreconf -fi in jq 
In their readme, jq claims that you don't have
to do autoreconf -fi when downloading a released tarball.

However, they forgot to push the released makefiles
into their release tarbal.

For this reason, we have to mirror their release after
doing the configuration ourselves.

This is needed because many distros do not ship the right
version of autoreconf, making virtually impossible to build
Falco on them.

Here is how it was created:

git clone https://github.com/stedolan/jq.git
cd jq
git checkout tags/jq-1.6
git submodule update --init
autoreconf -fi

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
f388d95591 build: gRPC link to bundled OpenSSL 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
8bfd6eaef7 build: fix JQ compilation issues and link oniguruma 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
4db3cc1f72 build: fix cURL ssl compilation issues 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Lorenzo Fontana
4c25135bf9 update: bump sysdig to 0.27.0 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-17 18:21:45 +02:00
Lorenzo Fontana
38009f23b4 build: remove libyaml from cpack rpm 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Lorenzo Fontana
324a3b88e7 build: remove libyaml-0-2 as dependency in packages and dockerfiles 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Lorenzo Fontana
c03f563450 build: libyaml in bundled deps 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Leonardo Di Donato
2848eceb03 build(cmake/modules): update driver version to 85c889 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 21:19:08 +02:00
Leonardo Di Donato
5fd3c38422 build(cmake/modules): update driver version to 33c00f 
This driver version, among other things (like userspace instrumentation
support) includes a fix for building the eBPF driver on CentOS 8
machines too.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 18:41:01 +02:00
Leonardo Di Donato
727755e276 build: fetch openssl, curl, njson dependencies from github not draios 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-02 06:01:12 +02:00
Omer Azaria
70b9bfe1d6 rule(Container Drift Detected): detect new exec created in a container 
Signed-off-by: Omer Azaria <omer.azaria@sysdig.com>
 2020-06-22 12:24:59 +02:00
Leonardo Di Donato
ade64b0ce8 update(userspace/falco): make log level a configuration member 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
3386671452 build(cmake/modules): cmake module for string-view-lite 
The CMake module downloads `string-view-lite` from
https://github.com/martinmoene/string-view-lite

It is a single-file header-only version of C++17-like `string_view` for
C++98, C++03, C++11, and later.

Notices it also provides C++20 extensions like:

- empty()
- starts_with()
- ends_with()
- etc.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
3991552553 update(cmake/modules): bump driver version to 96bd9bc560f67742738eb7255aeb4d03046b8045 
This driver version contains a fix for kernels < 3.17

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-06 20:35:31 +02:00
Leonardo Di Donato
03670680ed fix(cmake/modules): update driver to support kernels 5.6.y 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-30 20:11:57 +02:00
Lorenzo Fontana
0d34394817 fix: grpc compilation with splitted gpr library 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-04-30 08:31:02 -07:00