github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 23:57:29 +00:00
Code Issues Projects Releases Wiki Activity
2,992 Commits 121 Branches 172 Tags 104 MiB
315b44dc17
Commit Graph

2992 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Grasso
d585343483 docs(CHANGELOG.md): last update 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-31 14:01:48 +01:00
Teryl
9e57b5b4ba docs(changelog.md): update for release 0.31.0 
Signed-off-by: Teryl <terylt@ibm.com>
 2022-01-31 14:01:48 +01:00
Federico Di Pierro
47f38c8ae2 chore(build): dropped centos8 circleci build because it is useless and right now it is causing issues with yum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-31 12:48:48 +01:00
Federico Di Pierro
332d828204 update(userspace/engine): properly value required_version because it is used by caller. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-28 15:33:22 +01:00
Federico Di Pierro
75c6cfb414 update(userpace/engine): properly implement semver check for required plugin versions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-28 15:33:22 +01:00
Leonardo Grasso
a4199814a0 fix(tests/engine): correct unit tests 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-28 15:33:22 +01:00
Leonardo Grasso
24e7e84153 update(rules): updated aws cloudtrail rule bumping plugins version 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-28 15:33:22 +01:00
Federico Di Pierro
70bfb2426c fix(userspace/engine): forcefully set PPME_PLUGINEVENT_E event type for "plugin" source events. 
This workaround an issue in libs, targeting Falco 0.31.0.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-01-28 15:33:22 +01:00
Federico Di Pierro
ce3598f801 update(plugins): updated json plugin to latest v0.2.2. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-27 17:22:09 +01:00
Federico Di Pierro
8e6ffc6fc9 fix(userspace/engine): actually make m_filter_all_event_types useful by properly using it as fallback when no filter event types is provided. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-27 17:22:09 +01:00
Luca Guerra
6a42f4a133 new(build): publish both static and glibc binaries 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-26 17:45:50 +01:00
Federico Di Pierro
8d9dd4440f chore(userspace/engine): cleanup unused alternate-lua-dir option and remove config_falco_engine.h.in, now unused since lua scripts are embedded in Falco. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-26 16:19:50 +01:00
Luca Guerra
c49093005d fix(build): do not include plugins in musl builds 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-26 16:18:50 +01:00
Luca Guerra
69767bb51b fix(build): do not show plugin options in musl optimized builds 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-26 16:18:50 +01:00
Andrea Terzolo
7750b6f209 rule: update Copyright in falco rules 
Signed-off-by: Andrea Terzolo <s276109@studenti.polito.it>
 2022-01-25 18:58:05 +01:00
Andrea Terzolo
8c705448cc rule: add execveat as evt.type for spawned_process macro in falco rules 
Signed-off-by: Andrea Terzolo <s276109@studenti.polito.it>
 2022-01-25 18:58:05 +01:00
Shay Berkovich
6b9fafb75f rule update(Sudo Potential Privilege Escalation): trigger the most common CVE-2021-3156 exploit 
Signed-off-by: Shay Berkovich <sberkovich@blackberry.com>
Co-authored-by: Meera Balsara <mbalsara@blackberry.com>
 2022-01-25 17:54:06 +01:00
Shay Berkovich
fdcd7bffd0 rule update(Detect crypto miners using the Stratum protocol): update protocols 
Signed-off-by: Shay Berkovich <Sberkovich@blackberry.com>
Co-authored-by: Meera Balsara <mbalsara@blackberry.com>
 2022-01-25 17:54:06 +01:00
Shay Berkovich
d989e9c2d5 new(rules): Create Hardlink Over Sensitive Files 
New rule to prevent hardlink bypass and symlink rule set to WARNING for consistency
Signed-off-by: Shay Berkovich <sberkovich@blackberry.com>
Co-authored-by: Meera Balsara <mbalsara@blackberry.com>
 2022-01-25 17:54:06 +01:00
Federico Di Pierro
996ccf555c rule: updated aws_cloudtrail_rules with correct copyright year and required plugin versions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-25 17:50:06 +01:00
Federico Di Pierro
2f82a9baa1 Update userspace/falco/falco.cpp 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
dfb743838e Update userspace/engine/rules.cpp 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
c7609192c7 Update userspace/engine/lua/rule_loader.lua 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
4d3fc354fa update(userspace/engine): updated no evt.type specified lua warning string. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
43bdfce6e5 update(userspace/falco): divide each plugin infos when dumping list of plugin with a newline. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
a3976463d5 update(userspace/engine): fixed lua CMakeLists deps, to let it be gracefully rebuilt when lua files are updated. 
Moreover, added back warning about performance impact for rules without event types.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-24 17:52:31 +01:00
Federico Di Pierro
1a485c3447 update(userspace/engine,userspace/falco): improved some string warnings. 
Always print warnings while loading rules.
Print a single line when warning for ignored events.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-24 17:52:31 +01:00
Leonardo Grasso
96529300f6 fix(script/falco-driver-loader): fix typo 
Co-Authored-By: Thomas Spear <tspear@conquestcyber.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Leonardo Grasso
27922faa27 fix(scripts/falco-driver-loader): missing compression formats for .ko files 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Leonardo Grasso
8a1de131f4 update(scripts/falco-driver-loader): load the latest version first 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Federico Di Pierro
e1e8715a0f build: updated cloudtrail plugin to latest version. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-24 16:12:12 +01:00
Leonardo Grasso
9ae8d281f5 fix(test): falco_hostnetwork_images list is now in k8s_audit_rules.yaml 
Co-Authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 15:03:12 +01:00
Leonardo Di Donato
c705623f9e update(rules): move falco_hostnetwork_images list to k8s audit rules 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2022-01-24 15:03:12 +01:00
Leo Di Donato
3640871725 update(rules): remove falco_hostnetwork_images list (unused) 
The `falco_hostnetwork_images` list is unused.

This PR removes it to avoid the warning.

```console
When reading rules content: 1 warnings:
list falco_hostnetwork_images not refered to by any rule/macro/list
```

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2022-01-24 15:03:12 +01:00
Federico Di Pierro
6d507b054c update(build): update libs version for 0.31 release. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-20 14:43:49 +01:00
Federico Di Pierro
f19a1d81c6 update(build): updated plugins to latest versions adding platform name to artifact url. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-20 14:43:49 +01:00
Andrea Terzolo
18c7b6500d refactor: remove apt-config from debian_packages monitoring 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: karthikc911 <ckinnovative@gmail.com>
 2022-01-20 11:07:47 +01:00
Andrea Terzolo
8239fa41f4 docs: fix priority level "info" to "informational" 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-01-18 18:49:18 +01:00
yoshi314
a9e7512936 fix setting the variable of User-Agent, it was missing the prefix. Switched to dedicated curl's method to do this 
Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>
 2022-01-18 09:49:34 +01:00
Marcin Kowalski
f67e8bdad7 fix indentation in outputs_http.cpp 
add sample config entry for user-agent variable

Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>
 2022-01-18 09:49:34 +01:00
Marcin Kowalski
a94e6de458 add useragent string to output 
Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>
 2022-01-18 09:49:34 +01:00
Leonardo Grasso
3e9f8c1ef1 chore(userpsace/engine): update fields checksum 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-17 18:15:43 +01:00
Mark Stemm
d20a326e09 Skip EPF_TABLE_ONLY fields with --list -N 
When listing fields with -N (names only), also skip fields with the
EPF_TABLE_ONLY flag. (Skipping fields without -N is handled in libs,
in the as_string() method).

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-01-17 18:15:43 +01:00
Federico Di Pierro
0c290d98f8 fix(tests): avoid hardcoding plugin version 0.1.0 in plugin tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-17 17:20:33 +01:00
Federico Di Pierro
1befb053d0 update(gitignore): drop 2 useless lines from gitignore that are now installed in the build folder. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-17 17:20:33 +01:00
Federico Di Pierro
ae57718bda update(build): updated libs to latest master version. Updated plugins versions. Updated falco engine version. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-17 17:20:33 +01:00
Luca Guerra
55ce38cf3a use debian 11 slim as nodriver image 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-17 16:26:07 +01:00
Luca Guerra
18571eb20d ci: build stripped tgz 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-17 16:26:07 +01:00
Luca Guerra
9c449901f3 cmake: do not strip tar gz builds 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-01-17 16:26:07 +01:00
Jason Dellaluce
4ab8d6db98 refactor(configuration): remove plugin config loading from file feature 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-01-17 14:55:11 +01:00