github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-02 01:22:16 +00:00
Code Issues Projects Releases Wiki Activity
3,855 Commits 119 Branches 173 Tags 104 MiB
4c008d67d2
Commit Graph

3855 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Lorenzo Susini
ecc1853d60 update(rule): improve insmod detection within container using CAP_SYS_MODULE 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-12-01 11:17:50 +01:00
Andrea Terzolo
fbd6628693 new(config): add the simulate_drops config explicitly 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-11-30 19:26:47 +01:00
Jason Dellaluce
ba61706557 update(userspace/falco): enable using zlib with webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-30 19:24:47 +01:00
vin01
234026e14b rule(macro rpm_procs): let salt-call write to rpm database 
Signed-off-by: vin01 <vinc.i@protonmail.ch>
 2022-11-30 19:20:47 +01:00
vin01
d03826379b rule(Read sensitive file untrusted): let salt-call read sensitive files 
Signed-off-by: vin01 <vinc.i@protonmail.ch>
 2022-11-30 19:20:47 +01:00
Alessandro Brucato
3697d1fae2 Fixed typo 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Alessandro Brucato
e76c31b493 Added PTRACE_SEIZE, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS and whitelist macro 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Alessandro Brucato
d95e36b526 Rule: PTRACE attached to process 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Jason Dellaluce
15b57bd972 fix: remove minor string view dependencies 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
68f4d5bb59 fix(userspace/engine): no need to use external deps 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
138e373ace chore(cmake/modlule): cleanup DownloadStringViewLite 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
47fd90bb7f chore: remove not used dependency - string-view-lite 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Luca Guerra
3a56804cff new(CHANGELOG): add entry for 0.33.1 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-29 10:29:41 +01:00
Melissa Kilby
8f188ebe06 update(docs): polish release.md based on community feedback 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Melissa Kilby
7ead21daac update(docs): polish overview and versioning sections of release.md 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Melissa Kilby
d3badeb77e update(docs): add overview and versioning to release.md 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Edvin Norling
588ab01bfd Add Xenit AB to adopters 
Signed-off-by: Edvin Norling <edvin.norling@xenit.se>
 2022-11-23 13:12:57 +01:00
Luca Guerra
f08a5b4067 update(cli): also add cg / kg container-gvisor / kubernetes-gvisor 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
dea02f82e8 update(falco): add container-gvisor and kubernetes-gvisor print options 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
e3dbae3259 fix(engine): fix warning about redundant std::move 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-11 16:19:11 +01:00
Federico Di Pierro
d0ceba83b4 update(cmake, docker, circleci): updated libs and driver to latest master. 
Docker builder image was updated to remove the libelf and libz deps as they are now properly bundled, in BUNDLED_DEPS mode.
Finally, circleci musl job was updated to enforce the use of alpine-provided libelf package, since it is already static,
and building libelf on musl is pretty cumbersome.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-11 14:56:10 +01:00
Aldo Lacuku
161246fe1a fix(output): do not print syscall_buffer_size when gvisor is enabled 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-11-10 10:32:05 +01:00
Jason Dellaluce
240c0b870d fix(userspace/falco): verify engine fields only for syscalls 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-07 15:37:25 +01:00
Federico Di Pierro
136eacc17f chore(scripts): when ENABLE_COMPILE is disabled, exit immediately if target distro could not be fetched. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-02 12:06:29 +01:00
Federico Di Pierro
c0c0246927 fix(scripts): force falco-driver-loader script to try to compile the driver anyway even on unsupported platforms. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-02 12:06:29 +01:00
Mark Stemm
acf5c4ce5f fix(engine): save syscall source only when processing events 
The optimization in https://github.com/falcosecurity/falco/pull/2210
had a bug when the engine uses multiple sources at the same
time--m_syscall_source is a pointer to an entry in the indexed vector
m_sources, but if add_source is called multiple times, the vector is
resized, which copies the structs but invalidates any pointer to the
vector entries.

So instead of caching m_syscall_source in add_source(), cache it in
process_events(). m_sources won't change once processing events starts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-10-27 18:23:25 +02:00
Yarden Shoham
4a4fa2592b fix(plugins): trim whitespace in open_params 
`open_params` is read from the falco YAML configuration file and parsed using Go's URL.

For example:
c349be6e84/plugins/k8saudit/pkg/k8saudit/source.go (L41-L42)

Go's URL parser does not handle whitespace, so if a user defines the `open_params` in the falco configuration file as follows

```yaml
open_params: >
/file/path
```

the parser returns an error. To avoid this, we now trim this parameter so no whitespace will be left for Go's URL parser to error out on.

For reference see #2262.

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
 2022-10-21 19:12:58 +02:00
Federico Di Pierro
d0467de0a7 fix(ci): fixed version bucket for release jobs. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-10-21 11:19:19 +02:00
Jason Dellaluce
c1be1496d3 update(CHANGELOG.md): change release date 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Jason Dellaluce
fa1a5d58e6 update(changelog.md): add entry for Falco 0.33.0 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Andrea Terzolo
62abefddf6 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 15:30:52 +02:00
Andrea Terzolo
784fa8b374 chore: bump plugin version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 14:32:22 +02:00
Jason Dellaluce
10fe9fd84b fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
3d7677ce5b update(userspace/falco): create struct for sync parallel event sources parallelization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
0fd765f7c3 new(userspace/falco): add simple semaphre implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
cca90b2f80 update(userspace/falco): move on from deprecated libs API for printing event list 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 17:00:18 +02:00
Jason Dellaluce
6c873418ce chore(userspace/falco): improve the CLI options helper 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Jason Dellaluce
f12531a153 chore(userspace/falco): log cli options with debug level 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Andrea Terzolo
d5e3085b54 chore: bump to latest libs commit 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 18:47:15 +02:00
Andrea Terzolo
90d6d9080a fix: inject kmod script 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 16:40:21 +02:00
Jason Dellaluce
7d28637f44 fix(test): fix regresstion test 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9d8f130f47 fix(userspace/falco): make sure validation summary is populated even when json output is requested 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9ee0298c4d fix(userspace/engine): avoid macro/list used checks if we encounter an error 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
7da30ca661 chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 13:14:20 +02:00
Andrea Terzolo
12d709b8b1 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 12:36:21 +02:00
Jason Dellaluce
57b26530b6 update(userspace) fix cppcheck warnings 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
3629c4dc4a update(userspace): solve cppcheck performance suggestions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
5e531870a9 fix(userspace/engine): fix unit test segfault 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
c2dc0a7259 test(engine): fix unit tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
f684e144be chore(userspace/falco): polish ignored event warning message 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00