github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 09:02:18 +00:00
Code Issues Projects Releases Wiki Activity
1,841 Commits 119 Branches 172 Tags 104 MiB
578ef7f64d
Commit Graph

1841 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Di Donato
5909eac307 fix(.circleci): remove --labels flag from circleci 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 18:30:41 +01:00
Leonardo Di Donato
f69c419940 fix(.circleci): remove github tag rel nots flag (not working) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 17:57:22 +01:00
Leonardo Di Donato
10e4983297 fix(.circleci): to create stable versions bintray secret and user are needed 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 16:45:18 +01:00
Leonardo Di Donato
9e69972ec4 docs: highlight breaking change in the changelog for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
87e8457ce7 docs: bump versions to 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
56ccdf29c8 docs: CHANGELOG for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Mark Stemm
2126616529 Fix image for event generator deployment yaml 
I had a bug in https://github.com/falcosecurity/falco/pull/1088 where
the image name for the event generator was pointing to a temporary tag
instead of latest. This switches the image name back to latest.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 21:32:24 +01:00
Hiroki Suezawa
3067af566e rule(Change thread namespace): fix regression test 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Hiroki Suezawa
742538ac86 rule(Change thread namespace): change condition to detect suspicious container activity 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Mark Stemm
6488ea8456 (WIP) K8s Deployment to run event generator w k8s_audit 
Add a deployment yaml that allows running the event generator in a k8s
cluster:

 - Change the event generator to create/delete objects in a namespace
   "falco-eg-sandbox" instead of "falco-event-generator". That way you
   separate the generator from the resources it modifies (mostly, the
   exception being the rolebinding).
 - Create a serviceaccount, clusterrole, and rolebinding that allows the
   event generator to create/list/delete objects in the falco-eg-sandbox
   namespace. The list of permissions is fairly broad mostly so the
   event generator can delete all resources without explicitly naming
   them. The binding does limit permissions to the falco-eg-sandbox
   namespace, though.

A one-line way to run this would be:

kubectl create namespace falco-event-generator && \
  kubectl create namespace falco-eg-sandbox && \
  kubectl apply -f event-generator-role-rolebinding-serviceaccount.yaml && \
  kubectl apply -f event-generator-k8saudit-deployment.yaml

I haven't actually pushed a new docker image to replace the current
event generator yet--the deployment yaml refers to a placeholder
falcosecurity/falco-event-generator:eg-sandbox image. Once the review is
done I'll rebase this to change the image to latest before merging.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Mark Stemm
3fd67aa5c3 K8s Daemonset to run event generator w/ syscalls 
Add a Daemonset yaml that allows running the falco event generator on
syscalls. It will run on any non-master node.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Vicente Herrera
085009ad93 Fixed use of "tag" instead of "tags" in default rules 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
 2020-03-10 20:51:45 +01:00
Leonardo Di Donato
788d3294bd chore: re-enabling package build, sign, and docker push from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
de5cd1ce6f update(docker): latest or explicit FALCO_VERSION for docker images via docker build argument 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
4d4a2af8b6 chore: temporary test for circleci 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
36501c5f1d new(cmake/modules): provide and parse FALCO_VERSION_PRERELEASE too 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Lorenzo Fontana
123a75062e build: passing driver checksum down to download makefile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-10 18:00:04 +01:00
Lorenzo Fontana
74b0e18253 build: PROBE_VERSION must use the driver version 
The driver version was also setup in the wrong cmake file.

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-10 18:00:04 +01:00
Lorenzo Fontana
aef06f1dda fix(.circleci): fix get falco version for image build 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 20:46:48 +01:00
Lorenzo Fontana
6711abf3d7 fix(.circleci): build args for minimal dockerfile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 11:53:28 +01:00
Lorenzo Fontana
941313b1f1 fix(docker/minimal): untar of downloaded falco package 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 11:53:28 +01:00
Kris Nova
210da83402 docs: updating branding 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-03-05 10:58:43 +01:00
Leonardo Di Donato
8481b94f4c fix(.circleci): docker minimal images need exact FALCO_VERSION 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-04 09:30:13 +01:00
kaizhe
4a8d8a049f add comments 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-04 09:28:43 +01:00
kaizhe
b4f2fdc439 disable cryptomining rule by default; add exception of localhost and rfc1918 ip addresses 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-04 09:28:43 +01:00
Leonardo Di Donato
1c74c68ff3 fix(.circleci): dockerhub authentication during releasing process 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 21:16:26 +01:00
Leonardo Di Donato
e637b1ebbc update(.circleci): build and publish from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
f4c152a216 fix(.circleci): sign RPMs 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
906585d31a new(.circleci): build and publish docker images 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
272bb59df4 update(docker): reorganize docker images with build arguments 
Using the VERSION_BUCKET build arguments at docker build time users can now choose from which Falco version to build them.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
fae4bcf9ae fix(.circleci): expect script needs eof 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
b3117ebcab fix(.circleci): rpmsign needs enter for empty passphrases 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
d694c58e04 new(.circleci): rpm sign for release workflow too 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Lorenzo Fontana
443eb0f08c new(.circleci): sign rpm packages 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
8cf43cd9ae fix(.circleci): bintray auth for version creation 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
eeea37a298 update(.circleci): split run steps for publishing artifacts 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
8e92b588d5 update(.circleci): create version before uploading it 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
76a5976906 new(.circleci): build and publish docker images (skeleton) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
 2020-02-28 17:32:38 +01:00
Lorenzo Fontana
e9b5b815da new(docker/dev): update local dockerfile to use our own repositories 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-02-28 17:32:38 +01:00
Lorenzo Fontana
4e3a279e47 new(docker): update local to use our own repositories 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-02-28 17:32:38 +01:00
Lorenzo Fontana
9d6c714bdf update(docker/stable): use the new debian packages infrastructure 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
d6ed1ca39a fix(docker): falcosecurity sources list 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
5cdca39ae6 update(docker/stable): use the falcosecurity deb repo 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
1ec2f2cea3 update(docker/minimal): download falco binary 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
201ce0ddc6 new(.circleci): publish binary distributions (tar.gz) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
dfdd9693fc update(docker): slim images to use falcosecurity new repo and new GPG key 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
8415576097 update(docker/rhel): using the new falcosecurity repo and falcosecurity GPG key 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
4d99ce1b65 new(.circleci): run the debug build on centos7 on CI (USE_BUNDLED_DEPS=ON, CMAKE_BUILD_TYPE=debug) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
5ee72367a4 new(.circleci): debug build on ubuntu bionic (CI) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
acaa8d75e1 update(.circleci): publish packages only from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00