github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 07:37:32 +00:00
Code Issues Projects Releases Wiki Activity
2,948 Commits 121 Branches 172 Tags 104 MiB
625201f9f6
Commit Graph

2948 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
joon
625201f9f6 Add Java compatibility note 
Signed-off-by: joon <pirxthepilot@users.noreply.github.com>
 2022-06-14 17:01:12 +02:00
joon
583ac4192c rule(Java Process Class Download): detect potential successful log4shell exploitation 
Signed-off-by: joon <pirxthepilot@users.noreply.github.com>
 2022-06-14 17:01:12 +02:00
Jeremi Piotrowski
85f91a3ec4 update(falco_scripts): support pre-built module/probe on Flatcar 
Pre-built kernel modules/eBPF probes for Flatcar use the value of the OS
VERSION_ID field as KERNEL_RELEASE in the filename. A specific kernel release
version does not uniquely identify a Flatcar configuration, because Flatcar is
image-based instead of package-based. Here's a more specific example: the same
kernel version can be part of various Flatcar releases (across channels
alpha/beta/stable) with differences in configuration. This is why we use the
VERSION_ID value during offline builds with driverkit. Flatcar version numbers
are all higher than 1500.0.0, so there is no risk of collision with kernel
version numbers.

When locally building the kernel module on the system, we have access to the
correct kernel build directory at /lib/modules/$(uname -r)/build with the right
configuration and so for that branch, we need to reset KERNEL_RELEASE=$(uname -r).

See also the driverkit PR that introduces a builder for Flatcar:
https://github.com/falcosecurity/driverkit/pull/131

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
 2022-06-13 10:34:43 +02:00
Jeremi Piotrowski
6d56571e23 update(docker,falco_scripts): fix kernel module build on Flatcar 
Relocate necessary tools from the kernel module build system to run using host
dynlinker and libraries, so that compiling falco module on Flatcar works.

Since Flatcar v2983.0.0, Flatcar ships with glibc-2.33, but the
falco-driver-loader container is based on debian:buster and so has a much older
glibc. This prevents some necessary tools within /lib/modules/*/build from
working which causes the falco module to fail to compile using dkms.

To make the tools work, we need to relocate them so we add patchelf to the
falco and local dockerfiles. The relocation is based on the approach done by
the sysdig agent-kmodule build system, but I'm unable to find the source code
for it. The host linker and libs will be found at /host/usr/lib64, so we change
the interpreter and rpath on the tools. The relocation happens on a copy of the
tools which are then bind mounted at the right location. The result allows the
module build to work.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
 2022-06-13 10:34:43 +02:00
Luca Guerra
9d7153e119 fix(tests): make run_regression_tests.sh work locally 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-06-13 09:38:44 +02:00
Federico Di Pierro
4097661ba8 fix(scripts): fixed path in publish-deb script. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-11 00:11:09 +02:00
Vicente J. Jiménez Miras
83700d6d6a update(build): Switch from RSA/SHA1 to RSA/SHA256 signature in the RPM packages 
Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
 2022-06-10 17:51:12 +02:00
Federico Di Pierro
fccd3fa7b6 new(scripts): support InRelease file creation for publish-deb script. 
Newest Debian/Ubuntu versions look for this file instead of Release + Release.asc, hitting lots of 404 (and a retry on the old format).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-10 17:50:12 +02:00
Federico Di Pierro
1327c796d0 fix(scripts): fixed falco-driver-loader driver download url. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-10 16:49:42 +02:00
stephanmiehe
c782655a53 Fix rule linting 
Signed-off-by: Stephan Miehe <stephanmiehe@github.com>
 2022-06-10 13:58:42 +02:00
Federico Di Pierro
ba6c86696f fix(build): docker-container buildx engine does not support retagging images. Tag all images together. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-10 12:54:43 +02:00
Federico Di Pierro
9d2aba240d fix(build): fixed publish-docker-dev job context. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-10 09:33:42 +02:00
Federico Di Pierro
b059e83dd2 fix(scripts): fixed publish-deb script with manual arch filter. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 17:52:40 +02:00
Federico Di Pierro
6a034c17e0 fix(scripts): forcefully create packages dir for debian packages. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 17:52:40 +02:00
Aldo Lacuku
e6f99a61c9 chore(falco): fix indentation 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
7b83943059 fix(falco): compilation issues with new libs version 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
2111699a96 chore(engine): bump falco engine version number to 13 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
b6d0607716 chore(cmake): bump falco-security libs version to 075da069af359954122ed7b8a9fc98bc7bcf3116 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Federico Di Pierro
1c83a449bc fix(build): removed leftover line in circleci config. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 12:11:39 +02:00
Federico Di Pierro
534f66e601 fix(build): fixed circleCI artifacts publish for arm64. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 10:51:39 +02:00
Federico Di Pierro
a98bf52345 update(docker): updated falco-builder to fix multiarch support. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-06-09 09:33:39 +02:00
Leonardo Grasso
aad70f3de2 fix(.circleci): correct command for build-arm64 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-06-09 08:35:39 +02:00
odidev
4aa0fe1b95 ARM64 build 
Signed-off-by: odidev <odidev@puresoftware.com>
 2022-06-09 08:35:39 +02:00
odidev
0ebc7cd969 ARM64 build 
Signed-off-by: odidev <odidev@puresoftware.com>
 2022-06-09 08:35:39 +02:00
Federico Di Pierro
4f759b6b2b fix(build): use apt instead of apk when installing deps for aws ecr publish. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 15:40:18 +02:00
Federico Di Pierro
ca677db651 update(build): avoid double build of docker images when pushing to aws ecr. 
Moreover, fixed subtle whitespace-bug in various buildx lines.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 12:58:17 +02:00
Federico Di Pierro
0a98e11428 fix(build): try to use root user for cimg/base. 
Moreover, fixed buildx usage.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 11:11:55 +02:00
Andrea Terzolo
7068e9958f tests(k8s_audit_plugin): fix a k8s_audit_plugin test 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-06-07 16:07:53 +02:00
Andrea Terzolo
e5af3899f9 chore(k8s_audit_plugin): bump k8s_audit_plugin version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-06-07 16:07:53 +02:00
Federico Di Pierro
3f29660258 update(scripts): ported publish-deb and publish-rpm scripts to be multi arch. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
62794966b1 update(build): updated circle ci to properly use docker buildx to build multiplatform images. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
984b94f734 new(docker,scripts): port all docker images to be multiarch ready. 
They can be pushed with `docker buildx` for various architectures.

Moreover, updated falco-driver-loader to support multiple architectures.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
f9b0568187 update(changelog): added 0.32.0 release notes. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-03 10:29:43 +02:00
Federico Di Pierro
13eb8d2d48 update(build): updated plugins to latest versions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-01 14:50:38 +02:00
Aldo Lacuku
7a774f6b2e chore(userpace/falco): do not print error code in process_events.cpp 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-01 13:35:38 +02:00
Federico Di Pierro
3fef329d11 update(build): updated libs to 39ae7d40496793cf3d3e7890c9bbdc202263836b for Falco 0.32.0. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-31 18:12:09 +02:00
Andrea Terzolo
9392c0295a fix(falco-scripts): remove driver versions with dkms-3.0.3 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-30 13:08:40 +02:00
Aldo Lacuku
765ef5daaf chore(userspace/falco): fix punctuation typo in output message when loading plugins 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-05-30 10:46:40 +02:00
Matan Monitz
9f163f3fe0 Update rules/falco_rules.yaml 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Matan Monitz <mmonitz@gmail.com>
 2022-05-28 10:13:30 +02:00
Matan Monitz
4c95c717d2 known_shell_spawn_cmdlines - lighttpd 
Signed-off-by: Matan Monitz <mmonitz@gmail.com>
 2022-05-28 10:13:30 +02:00
beryxz
54a2f7bdaa rule(macro net_miner_pool): additional syscall for detection 
Signed-off-by: beryxz <coppi.lore@gmail.com>
 2022-05-28 09:29:30 +02:00
Federico Di Pierro
eb9a9c6e7d update(build): updated libs to 1be924900a09cf2e4db4b4ae13d03d838959f350 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 18:19:26 +02:00
Federico Di Pierro
75712caa9a fix(test): dropped file:// from k8s audit log tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
db5f1bec3d update(cmake): updated plugins. 
Moreover, add support for aarch64 plugins, even if Falco 0.32 won't be distributed with official arm64 support.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
1d343c93f3 update(build): updated libs version for Falco 0.32.0 release. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 11:07:27 +02:00
Jason Dellaluce
3b462af58e fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
09eae35f3a refactor(userspace/falco): create action for initializing k8s and mesos clients (step 2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
383b8f9660 refactor(userspace/falco): create action for initializing k8s and mesos clients 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
13d70b65ae update(userspace/engine): rename ruleset.h in filter_ruleset.h 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
9fd10220a5 update(userspace/falco): sync falco with new engine definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00