github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 07:07:23 +00:00
Code Issues Projects Releases Wiki Activity
2,992 Commits 121 Branches 172 Tags 104 MiB
315b44dc17
Commit Graph

2992 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Dellaluce
3af8d1c0d2 refactor(userspace/engine): adapt existing ruleset implementation to new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
bbbdb311e0 refactor(userspace/engine): introduce interface for rulesets and their factory 
This interface will allow us to use different ruleset implementations inside the same engine.
The goal is to define API boundaries that will allow swapping the current evttype-index
ruleset implementation more easily. Key benefits include: smaller component with less responsibilities,
easier substituibility, more testable design, opportunity to adopt different index strategies
depending on the ruleset implementation.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Andrea Terzolo
d860472987 update(userspace/falco): improve falco termination 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 18:35:18 +02:00
Andrea Terzolo
3a3d5dfdcd Update userspace/falco/app_actions/load_rules_files.cpp 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
46159b8de9 update(userspace/engine): introduce new check_plugin_requirements API 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
e751bf79c3 fix(userspace/engine): improve rule loader source checks for macros and lists 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:54:17 +02:00
Federico Di Pierro
d9d8dedc32 update(test): fixed tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
39f55f4b5c update(userspace): split filterchecks list for each source idx. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
5f00cea3c9 fix(userspace/falco): do not start webserver in capture mode. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
f6dba24b81 update(build): updated libs to latest master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Brad Clark
9d41b0a151 use endswith ash_history to catch both bash and ash 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
b9bcf79035 rule(macro truncate_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
3cca4c23cc rule(macro modify_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Federico Di Pierro
a7ebfbf137 update(ci): add workflow_dispatch to be able to manually trigger ci. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
fbc7ede75a Update .github/workflows/ci.yml 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
7b45520f37 fix(ci): fetch all history from git to correctly populate FALCO_VERSION. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
2b6c0f3f9e fix(ci): fixed ubuntu kernel headers install. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
f5f836ca8b fix(ci): fixed centos debug job. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
3b73433c48 update(ci): dropped circleCI jobs that are now provided by gh actions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
1a3556affc update(ci): ported all no-output jobs to github actions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
b3aec1967b fix(ci): use sudo. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
004e93f19f new(ci): initial build minimal action ported to gh action. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Jason Dellaluce
96e2864c16 test(falco_k8s_audit): fix k8s audit tests to used plugin ruleset 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
e2b7b1208a build(cmake/modules): add plugins rules and bump plugins versions 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
d4f76f1f93 update!: moving out plugins ruleset files 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
65de03aa29 update(rules): remove plugins ruleset files 
Plugins' rules files now lives in their repositories. See https://github.com/falcosecurity/plugins/pull/98

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
298913471c wip: bump libs version to ff0b1f8d4612d197368b3f7feff28178f3bd3ad184f3707942ab52219e98f461 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Stefano
3e603188d4 Changed field in thread.cap_effective 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
c3bcf604a5 Changed Rule focus to be broader then just a specific CVE 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
2e2b13236b Fixed CVE number 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
24bd1abc43 Added new rule for CVE-2022-4092 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Federico Di Pierro
acbbcf7481 Update userspace/falco/app_cmdline_options.h 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
3ba64d8a49 new(userspace/falco): new inotify watcher is now able to properly watch rules folders, when specified. 
This means that when starting Falco passing to it a folder for its rules, it will properly manage
changes to any file inside the folders, plus any created/deleted file inside it.

Unified list of rules parsing, instead of having it done twice inside cmdline_options and configuration.
Instead, it is done only once, inside load_rules_files.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
293a6c2b40 update(userspace/falco): moved to a config option. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
a9fe979071 chore(userspace/falco): small cleanup. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
e32f5a66c5 new(userspace/falco): added an option to listen to changes on the config file and rules files, and trigger a Falco reload. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Milkshak3s
8c6cfae18f Include origin host in output json 
Signed-off-by: Milkshak3s <justchris.vantine@gmail.com>
 2022-05-09 12:16:50 +02:00
Leonardo Grasso
eae193ade0 build(userspace/engine): cleanup unused include dir 
`CURL_INCLUDE_DIR` is a leftover since now the correct include path is injected via libs.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-04 16:12:30 +02:00
Sebastien Le Digabel
2bc4fec33c rule(Anonymous Request Allowed): exclude {/livez, /readyz} 
Fixes #1794.

/livez and /readyz don't require authentication and can generate a lot
of noise if the cluster is checked by an anonymous external
system.

Some k8s systems have those endpoints required to be anonymous, as per this
[link to an OpenShift
setup](http://static.open-scap.org/ssg-guides/ssg-ocp4-guide-cis.html#xccdf_org.ssgproject.content_rule_api_server_anonymous_auth).

Signed-off-by: Sebastien Le Digabel <sledigabel@gmail.com>
 2022-05-04 13:04:29 +02:00
Jason Dellaluce
dbbc93f69d fix(userspace/falco): listen to proper host in webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
de754fb4e7 chore(falco.yaml): comment-out k8s plugin default config values 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
63b7aabc81 chore: solve compilation issues and polish code 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
69db6adf9d refactor(test): use SKIP_PLUGINS_TESTS to skip k8s audit regression tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
67d2fe45a5 refactor: add k8saudit plugin and adapt config, tests, and rulesets 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
b91ff34b97 refactor: drop civetweb dependency and implement healtz using cpp-httplib 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
42fcc7291f refactor(userspace/falco): remove k8s audit references from falco 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Andrea Terzolo
21b127ef65 docs(falco_scripts): update Copyright 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
9937565416 docs(falco_scripts): add some punctuation marks in comments 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
b94226569f update(falco_scripts): delete all versions of the module from dkms 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
f8b97bfbce docs(falco_scripts): update comments in falco-driver-loader. 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00