github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-26 06:42:08 +00:00
Code Issues Projects Releases Wiki Activity
2,086 Commits 121 Branches 172 Tags 104 MiB
2f3669b962
Commit Graph

2086 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Grasso
2f3669b962 chore: clean up lua from dot files 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
1bcac6f251 chore(userspace/falco): prefix abstract class with "abstract_" 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
57c62ba6a7 chore(userspace/falco): move output config struct one level up 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
6451a55d82 chore(userspace/falco): simplify files naming 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
0ff220de1e chore(userspace/engine): clean up unused code 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
78fa43708b refactor(userspace/falco): falco_outputs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
99d4a7d5c5 new(userspace/falco): syslog output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
7f4d5396c2 new(userspace/falco): program output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
aa8edadf68 new(userspace/falco): http output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
6ecc691c68 new(userspace/falco): gRPC output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
4d61f1c739 new(userspace/falco): file output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
7b70f3c2ef new(userspace/falco): stdout output C++ impl 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
8371d1955a chore(userspace/falco): refine falco_output interface 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
270c3fa910 new(userspace/falco): base class for Falco outputs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
0a2eab3f19 chore(userspace/falco): clean up lua deps from logger 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
ac2a9a35cb chore(userspace/falco): remove lua code for outputs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
85aa337b63 update(userspace/engine): refactor falco_formats to accept non-lua callers 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Kris Nóva
d1211ecca8 feat(docs): Adding meeting notes step to RELASE.md 
Signed-off-by: Kris Nóva <kris@nivenly.com>
 2020-10-12 11:03:13 -04:00
Leonardo Grasso
f567f2f7f7 chore(test): update copyright year 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
ab615c36ad update(test): check all fields for gRPC output 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
60c322a73d new(test): strict json output 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
f12210325f chore(test): correct file name 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
682e53f5b5 update(test): strict output tests 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
6e8352e847 chore(test): cleanup tmp file 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
c512784503 new(test): stdout output strict 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
b0942f8774 new(test): add "output_strictly_contains" option 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Christian Zunker
8b56360f8c rule(list falco_sensitive_mount_images): add images docker.io/falcosecurity/falco and falcosecurity/falco 
Fixes #1428

Signed-off-by: Christian Zunker <christian.zunker@codecentric.cloud>
 2020-10-06 17:26:29 +02:00
Leonardo Di Donato
0a449afc3e docs: fix release notes for 0.26.0 (previous) 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-01 14:19:48 +02:00
Leonardo Di Donato
e06e89b3d0 docs: CHANGELOG for 0.26.1 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-01 14:19:48 +02:00
Leo Di Donato
1500e74844 docs: release candency 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-01 13:41:55 +02:00
Leonardo Di Donato
db9fe762a4 docs: notify the community the Falco releases happen every two months starting from today 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-01 13:41:55 +02:00
Leo Di Donato
2fd9ad1433 docs: add download/images table to release corpus template 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-01 13:41:55 +02:00
Mark Stemm
879bf37ffd rule(Write below root): require proc.name 
Like other rules that rely on a process name for exceptions, don't
trigger an event if the process name is missing e.g. "<NA>".

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-10-01 11:33:45 +02:00
Mark Stemm
fc4355dd15 rule(Delete....shell history): Skip docker progs 
Also ignore docker programs which would prevent cases where the path is
expressed within the container filesystem (/.bash_history) vs host
filesystem (/var/lib/docker/overlay/.../.bash_history).

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-10-01 11:33:45 +02:00
Mark Stemm
1c7fca95e4 rule(Delete or rename shell history):fix warning 
Move the "and not" checks to the end of the rule so all event type
checks are at the front.

Also break into 3 macros to make the rule easier to read.

This fixes https://github.com/falcosecurity/falco/issues/1418.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-10-01 11:33:45 +02:00
Radu Andries
bc1aeaceb2 feat(falco): Provide a parameter for loading lua files from an alternate path 
This will be used by the static build to load lua files from
alternate directories that are not tied to the compile flags

Signed-off-by: Radu Andries <radu.andries@sysdig.com>
 2020-09-29 18:05:10 +02:00
Lorenzo Fontana
6bcc11aa47 build: standalone static analysis step 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
bbf044060a build: quality, install ca-certificates and attach only after that 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
4f86e3e68b build: static code analysis CI reports 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
a51c4fc903 build: static code analysis structure and cppcheck 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Leo Di Donato
271e23ce97 docs(brand): documenting Falco color scheme 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-28 15:15:36 +02:00
Kris Nóva
404762bd34 feat(release): Updating notes according to PR 
Signed-off-by: Kris Nóva <kris@nivenly.com>
 2020-09-25 08:18:48 -07:00
Kris Nóva
20f5e5d35a feat(release): Release 0.26 
Cutting release for 0.26.0 and starting 0.27.0

Signed-off-by: Kris Nóva <kris@nivenly.com>
 2020-09-25 08:18:48 -07:00
Mark Stemm
33793d233b Rule(Disallowed K8s User): quote colons 
It turns out if you read this rules file with falco versions 0.24.0 and
earlier, it can't parse the bare string containing colons:

(Ignore the misleading error context, that's a different problem):

```
Thu Sep 10 10:31:23 2020: Falco initialized with configuration file
/etc/falco/falco.yaml
Thu Sep 10 10:31:23 2020: Loading rules from file
/tmp/k8s_audit_rules.yaml:
Thu Sep 10 10:31:23 2020: Runtime error: found unexpected ':'
---
  source: k8s_audit
    tags: [k8s]
    # In a local/user rules file, you could override this macro to
```

I think the change in 0.25.0 to use a bundled libyaml fixed the problem,
as it also upgraded libyaml to a version that fixed
https://github.com/yaml/libyaml/pull/104.

Work around the problem with earlier falco releases by quoting the colon.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-09-23 17:48:36 +02:00
Mark Stemm
331b2971be rule(Delete or rename shell history):skip dockerfs 
In some cases, when removing a container, dockerd will itself remove the
entire overlay filesystem, including a shell history file:

---
Shell history had been deleted or renamed (user=root type=unlinkat
command=dockerd -H fd://
... name=/var/lib/docker/overlay2/.../root/.bash_history ..
---

To avoid these FPs, skip paths starting with /var/lib/docker.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-09-23 17:48:36 +02:00
Leonardo Grasso
558b18ea67 build: update the driver version to 2aa88dc 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Leonardo Grasso
bbfb27777b build: remove macrodefs about time (musl build) 
See https://github.com/draios/sysdig/pull/1684

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Hiroki Suezawa
5b926386a8 rule(macro consider_packet_socket_communication): change a value to always_true 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-09-18 09:47:10 +02:00
Lorenzo Fontana
1efa4d3af0 update(scripts): driver loader cycle available gcc versions 
The falco-driver-loader script calls dkms to compile the kernel
module using the default gcc.
In some systems, and in the falcosecurity/falco container image,
the defult gcc is not the right one to compile it.

The script will try to compile the module by cycling trough all the available GCCs
starting from the default one until the module is compiled the first
time.

The default gcc is the highest priority while trying.
Newer GCCs have the priority over older GCCs.

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-16 18:09:09 +02:00
Leonardo Di Donato
8611af4373 chore(.circleci): re-enable cleanup of falco development packages only when on the master branch 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-14 11:09:09 +02:00