Commit Graph

9 Commits

Author SHA1 Message Date
Carl Sverre
858a69bb2c Added envvar SYSDIG_SKIP_LOAD to Dockerfile to skip kernel module manipulation
This helps when running on a system which has the module loaded, but getting
access to the module file is hard for some reason.  Since I know that the right
version of the module is loaded I just want falco to connect.

I tested this with this run command:

docker run -e SYSDIG_SKIP_LOAD=1 -it -v /dev:/host/dev -v /proc:/host/proc --privileged falco

And it successfully connected to Sysdig and started printing out warnings for my
system.

falco-CLA-1.0-signed-off-by: Carl Sverre accounts@carlsverre.com
2016-12-22 12:55:36 -08:00
Mark Stemm
c66b6402d8 Add jq to docker images.
Add jq to the docker image containing falco. jq is very handy for
transforming json, which comes into play if you want to post to
slack (or other) webhooks.
2016-10-24 15:56:45 -07:00
Mark Stemm
2e5ed34357 Add exfiltration action, env-specified actions.
Add an exfiltration action that reads /etc/shadow and sends the contents
to a arbitrary ip address and port via a udp datagram.

Add the ability to specify actions via the environment instead of the
command line. If actions are specified via the environment, they replace
any actions specified on the command line.
2016-10-24 15:56:45 -07:00
Mark Stemm
3e1117d746 Add license comments to all source code.
Add comment blocks to all source code w/ our gpl copyright notice.
2016-10-24 15:56:45 -07:00
Mark Stemm
7fddaf2499 Install gcc-4.9 from Debian Jessie repositories
As luca did for the agent, install gcc 4.9 from the debian jesse
repository, as it has been removed from unstable.
2016-10-24 15:56:45 -07:00
Mark Stemm
f64148999a Program/docker image that performs bad activities.
C++ program that performs bad activities related to the current falco
ruleset. There are configurable actions for almost all of the current
ruleset, via the --action argument.

By default runs in a loop forever. Can be overridden via --once.

Also add a Dockerfile that compiles event_generator.cpp within an alpine
linux image and copies it to /usr/local/bin. This image has been pushed
to docker hub as "sysdig/falco-event-generator:latest".

Add a Makefile that runs the right docker build command.
2016-10-24 15:56:45 -07:00
Mark Stemm
0c44711e76 Fix docker builds.
gnupg2 is missing on latest debian:unstable.
2016-10-24 15:56:45 -07:00
Mark Stemm
0e40ad26c4 Run falco by default in containers.
Instead of running bash as the sysdig container does, run falco. This
makes sense as falco doesn't have a general purpose use like sysdig
does.

To make it easier to run both in docker and as a daemon using the
default command line, enable both syslog and stdout/stderr output by
default. Now that falco dups stdout/stderr to /dev/null when
daemonizing, the stdout/stderr is just thrown away. And when running in
docker, the syslog output will just be discarded unless someone plumbs
the container's syslog output.

Update README.md to reflect that specifying the falco command is not
necessary.
2016-05-11 17:35:02 -07:00
Mark Stemm
c2ee87976c Add docker files to create images using apt-get.
Based on the Dockerfiles from the sysdig repository. The only change
from the sysdig versions is to use environment variable FALCO_REPOSITORY
and to install falco instead of sysdig.

Note that the entrypoint still uses sysdig-probe-loader and
SYSDIG_HOST_ROOT, as it's building the kernel module for sysdig.

I verified I could create and run an image using the dev version using
"docker build ." from docker/dev, and run it using:

docker run -i -t --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:r\o sysdig/falco falco -r /etc/falco_rules.conf

I still need to update jenkins to create a release build.
2016-05-03 17:10:55 -07:00