github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-21 19:44:57 +00:00
Code Issues Projects Releases Wiki Activity
4,142 Commits 123 Branches 176 Tags
2778b12344cb38f48ee6582d3879dc74915fe905
Commit Graph

1320 Commits

Author SHA1 Message Date
Andrea Terzolo
2778b12344 fix: always initialize the engine configs 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Federico Di Pierro
7056cb9035 chore(userspace): properly let old config keys override new ones when set to a non-default value. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Andrea Terzolo
1f27f3b7f0 cleanup: move some initializations and add helpers 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Andrea Terzolo
1ee6569a5d fix: use only new config instead of old command line options 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Andrea Terzolo
f3f56db5ca cleanup: some renaming from bpf to ebpf 
the idea is to use only the word `ebpf` in Falco

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Federico Di Pierro
4127764129 chore(userspace): renamed driver. config to engine.; renamed engine.replay.scap_file to engine.replay.trace_file. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-11-27 15:01:00 +01:00
Federico Di Pierro
4f1b950e0d chore(userspace,falco.yaml): rename new config key to driver.kind. 
Moreover, renamed driver kinds to use better naming, and move driver's related
config keys under `driver.$kind`.

Added DEPRECTATION notices on CLI options, and in falco.yaml.

DEPRECATED options (both CLI and config ones) will have priority over the new ones,
to retain compatibility with existing configs.

DEPRECATED options will be dropped in Falco 0.38.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-27 15:01:00 +01:00
Roberto Scolaro
626e609e4b new(userspace/falco): select driver from config 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-27 15:01:00 +01:00
Roberto Scolaro
fb4ac046b0 refacotr(configuration): enhance readability of get_driver_mode 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-27 15:01:00 +01:00
Roberto Scolaro
d53fa930c2 wip: driver selection in falco.yaml 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-27 15:01:00 +01:00
Andrea Terzolo
a1d5bb7009 cleanup: remove init in the configuration constructor 
This `init({});` in the falco_configuration constructor is unnecessary
since when we call the action `load_config`, if we don't have a config
file, we will call the same `init` we have just removed. This cleanup
avoids calling `falco_configuration::init` 2 times.

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-11-21 15:44:39 +01:00
Jason Dellaluce
66a122d4ce update(userspace/engine): bump engine version 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-16 09:26:19 +01:00
Jason Dellaluce
04e2f19915 refactor: solve compilation issues with latest libs changes 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-16 09:26:19 +01:00
Jason Dellaluce
359bd6e593 cleanup(userspace/engine): remove legacy k8saudit implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-15 16:05:15 +01:00
Luca Guerra
8bf40cdf88 update(engine): port decode_uri in falco engine 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-11-14 20:36:15 +01:00
Roberto Scolaro
92b42c9474 fix(userspace/falco): fix create_dir behaviour 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
fde8da0e5c fix(userspace/falco): split init_ticker for different oses 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
be90768b0a fix(userspace/falco): rename get_sysinfo 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
b9d7eb7ab3 refactor(cmake): selectively remove sources on win32 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
1b8525bf80 refactor(cmake): move compiler flags in another file 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
6d4006a1ec feat(ci): create win32 and macos installer 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
f0d2f17c8d fix(userspace/falco): include windows.h in print actions 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
907ced9f50 refactor(userspace/falco): add log level enum 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
df4e91476f chore(userspace/falco/app/actions): refactor sysinfo function 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
0ca5251128 fix(userspace/falco): enable --support on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
89e45ced87 fix(userspace/falco): disable sys/select.h on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
5ee9ff8c8f fix(userspace/falco): disable program_output on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
f7575292c6 fix(userspace/falco): disable sys/time.h+inotify on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
af70b4e770 fix(userspace/falco): remove syslog on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
00a87234ce fix(userpsace/falco): print page size on windows 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
325701ce4f fix(userspace/falco): use std::filesystem 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
5b3cb654ff fix(userspace/falco): add PATH_MAX for windows build 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
e5e5416ade fix(userspace/falco): substitute syscall_evt_drop_action::IGNORE with DISREGARD 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
fb0d757bfe fix(userspace/falco): use io.h instead of unistd.h on win32 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Roberto Scolaro
e0f7c597be fix(build): various fixes for macos build 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-11-13 10:59:47 +01:00
Lorenzo Susini
7319b93d9b update(userspace/falco): introduce new engine_version_semver key in versions endpoint 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2023-11-08 16:30:25 +01:00
Samuel Gaist
d074728994 feat(userspace/falco): add configuration support for IPV6 webserver listen address 
The IPV6 capabilities is provided through cpp-httplib.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2023-11-03 09:09:08 +01:00
Samuel Gaist
91a9717779 feat(userspace/falco): implement configuration of webserver listening 
address

Currently the webserver is listening on the hard coded 0.0.0.0. This
patch keeps this default but allows the administrator to change it.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2023-11-03 09:09:08 +01:00
Jason Dellaluce
f5985720f1 fix(userspace/engine): cache latest rules compilation output 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-02 20:32:07 +01:00
Jason Dellaluce
2e7cacb4e0 fix(userspace/engine): solve description of macro-only rules 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-02 16:16:06 +01:00
Luca Guerra
3ff2bb5c2b cleanup(engine): strncpy -> strlcpy 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-10-19 17:41:22 +02:00
Luca Guerra
1e38967b18 update(engine): remove banned.h 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-10-19 17:41:22 +02:00
Roberto Scolaro
b7cef5bab2 fix(userspace/engine): fix memory leak 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-10-17 21:20:15 +02:00
Melissa Kilby
dd807b19c8 feat(userspace): remove experimental outputs queue recovery strategies 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-12 13:03:46 +02:00
Melissa Kilby
32b7ccd8dc cleanup(userspace/falco): reset s_timerid_exists at stats_writer teardown 
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-06 15:32:05 +02:00
Melissa Kilby
d28f43cd98 chore: apply codespell fixes 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-06 15:32:05 +02:00
Melissa Kilby
943446ba97 cleanup(userspace/falco): add more comments around timer_delete workaround 
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-06 15:32:05 +02:00
Melissa Kilby
d4a4de9055 fix(userspace/falco): timer_delete() workaround due to bug in older GLIBC 
Workaround for older GLIBC versions (< 2.35), where calling timer_delete()
with an invalid timer ID not returned by timer_create() causes a segfault because of
a bug in GLIBC (https://sourceware.org/bugzilla/show_bug.cgi?id=28257).

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-10-06 15:32:05 +02:00
Andrea Terzolo
29d2406414 cleanup(falco)!: remove outputs.rate and outputs.max_burst 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-09-29 01:47:21 +02:00
Lorenzo Susini
09b1f92267 update(userspace/engine): update falco engine checksum 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2023-09-28 20:05:21 +02:00