github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 23:27:20 +00:00
Code Issues Projects Releases Wiki Activity
2,752 Commits 121 Branches 172 Tags 104 MiB
06b6565fa6
Commit Graph

2752 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Dellaluce
06b6565fa6 refactor(userspace): sync falco codebase to new falco_common definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 22:21:20 +02:00
Jason Dellaluce
55ec8c0e1b refactor(userspace/engine): polish falco_common and improve priority parsing/formatting 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 22:21:20 +02:00
Lorenzo Susini
4343fe8a8b new(rules/k8s_audit): add rules to detect pods sharing host pid and IPC namespaces 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-04-11 18:29:19 +02:00
Jason Dellaluce
2934ef29b9 chore(userspace/engine): fix indentations and use improve indexed_vector 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
47426fbe0d update(userspace/engine): minor improvements and bug fixes on engine and rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
e50d22f013 fix(userspace/engine): solve integration test errors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
c0f8171d89 test: adapt integration tests to new rule loader error messages 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
43020d8a7d refactor(userspace/engine): re-implement the rule loader in C++ 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
d483b897e7 new(userspace/engine): create stats_manager inside falco engine 
This is a porting of what we had inside the Lua codebase. This now handles the single responsibility
of gathering stats about rule-event matching, and of formatting them to print them to the user.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
9e93b7cd52 new(userspace/engine): add falco_rule struct to represent rule definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
6c9e6c5918 new(userspace/engine): add new indexed_vector class to achieve string-based O(1) access in vectors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
c2cac5af92 refactor(userspace/engine): add run() overload in filter_macro_resolver to support shared_ptrs 
This change allows working with safety with AST nodes wrapped into shared pointers.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
cf83a91d4e refactor(userspace/engine): re-implement wrap_text() function in falco_utils 
The function implementation was removed, however it was still defined in the .h header. Moreover,
this will now be required in order to replace its lua equivalent.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
3201479392 refactor(userspace/engine): turn falco_common into a namespace containing common static utilities 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
b74dcbd851 cleanup(userspace/engine): remove lua files and lua-related code sections 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
7db9dd66ff refactor(build): drop dependencies to chisels, luajit, lyaml, and libyaml 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Angelo Puglisi
e8cb96a57b perf: change falco_engine::process_event to lookup sources by index 
falco_engine::process_event gets called for every inspector event.
Profiling showed that std::map::find takes about 10% of
falco_engine::process_event, and that can easily improved by accessing
the source by index.

Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
 2022-04-06 14:46:31 +02:00
Mateusz Gozdek
cb4cec6f57 Fix typos 
Found by running the following command:
codespell -f -H -L aks,creat,chage -S .git

Signed-off-by: Mateusz Gozdek <mgozdek@microsoft.com>
 2022-04-06 14:40:31 +02:00
Stefano
36bd07d82d Fix spaces 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
 2022-04-01 19:38:40 +02:00
Stefano
bcff88922a Added eks_allowed_k8s_users list to whitelist EKS users 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Alberto Pellitteri <alberto.pellitteri@sysdig.com>
 2022-04-01 19:38:40 +02:00
Stefano
1988f3b0be Disabled by default noisy rules 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
 2022-03-29 17:39:25 +02:00
schie
64f0cefab0 Update rules/okta_rules.yaml 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Thomas Labarussias <issif+github@gadz.org>
 2022-03-29 17:39:25 +02:00
schie
48041a517b Update rules/okta_rules.yaml 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Thomas Labarussias <issif+github@gadz.org>
 2022-03-29 17:39:25 +02:00
Stefano
6a1492a828 Added okta_rules.yaml 
Signed-off-by: darryk10<stefano.chierici@sysdig.com>
 2022-03-29 17:39:25 +02:00
Leonardo Grasso
5023851000 chore(rules): remove leftover 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-25 13:02:28 +01:00
Jason Dellaluce
ecf13762b8 test(userspace/engine): add unit test cases for filter_macro_resolver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
a0a87e443f update(userspace/engine): support undefining macros 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
20c59970f5 update(engine): rename and improve sinsp filter macro resolvers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
c801c09e7d update(test): adapt integration test error messages to comply to new parser errors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
b7db0f9b14 refactor(engine/lua): update lua rule loader to use new sinsp parser 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
2ee95122df refactor(engine): remove unused lua modules 
Both the parser.lua and compiler.lua modules are not necessary anymore, because all the logic related
to filter parsing and compilation is handled inside libsinsp now. Accordingly, they have been removed from
the lua-to-cpp.sh scripts. README.md and parse-smoke.sh have been removed since they are not needed anymore:
lpeg is not used by the project, and the smoke tests are implemented in libsisnsp unit test suite.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
911bd16556 update(engine): create a lua helper for rule filter manipulation 
The lua_filter_helper class is a simple Lua wrapper that can be used in the Lua rule loader to
parse/compile rule filters, and manipulate them to resolve/replace list and macro references.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
3879a283bf refactor(engine): remove dependency from lua parser 
The Lua parser grabbed from libs chisels is not used anymore, as the compilation logic happen inside the new
filter parser of libsinsp.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
c5818e6273 new(engine): add rule filter macro-resolver 
This is a first step towards porting the rule filter building logic that is currently implemented in Lua.
filter_macro_resolver uses the newly introduced AST constructs from libsinsp, and
allow manipulating filter ASTs to resolve/replace macro references. This is meant to be used
at boot time by the rule loader (which we still want to maintain implemented in Lua for now).

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
0a132f453a update(cmake): remove lpeg dependency 
The Lua PEG parser is not longer needed, since we now use the new filter parser implemented
in libsinsp.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Frederico Araujo
26a3b7a01e refator(image): commented and moved symlinks inside SKIP_DRIVER_LOADER check 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
55700f80e4 refactor(image): remove -x flag in ubi docker entrypoint 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
54a817bf3c feat(image): set default value for UBI_VERSION build arg 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
04cadee6fa fix(image): update package cache cleanup command 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
4f5fb12a13 docs(docker/readme): updated table to include experimental UBI-based image for Falco 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
5b99c0d481 refactor(build): moved Dockerfile and entrypoint script for UBI-based image to its own directory 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
7c85349674 fix(docker/readme): fix grammatically incorrect split of infinitive 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
9aa9ad9ee0 build(image): added label for ubi version and updated description labels 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
b18f2084c0 build(image): fixed handling of default falco version 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
TPT
dc5b332cd1 build(image): simplified untarring command to install falco binary and scripts in ubi 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
TPT
5b7260f706 build(image): updated UBI image to build dkms, and use falco binaries rather than rpm. This reduces dependencies. 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
TPT
dc40f82318 build(image): added falco ubi Dockerfile to provide a falco ubi image 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
Jason Dellaluce
9607cbc2c7 update(build): temporarely bump cloudtrail and json plugin version to dev builds 
This is required due to the plugin API version being bumped to 1.0.0 in the framework after
the recent breaking changes. cloudtrail and json will be switched back to a stable build
once they get released to require the plugin API version with the newest major.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Jason Dellaluce
481e32cab9 update(build): bump libs version to caa0e4d0044fdaaebab086592a97f0c7f32aeaa9 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Mark Stemm
df219b5e1d New tests for rule + exception, macro with unknown source 
Add new test cases for a rule with an unknown source *and* an
exception, and a macro with an unknown source.

The first results in a rule warning (and no error), and the second
prints an error and skips.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00