github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-26 22:57:24 +00:00
Code Issues Projects Releases Wiki Activity
2,050 Commits 121 Branches 172 Tags 104 MiB
6bcc11aa47
Commit Graph

2050 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Lorenzo Fontana
6bcc11aa47 build: standalone static analysis step 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
bbf044060a build: quality, install ca-certificates and attach only after that 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
4f86e3e68b build: static code analysis CI reports 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Lorenzo Fontana
a51c4fc903 build: static code analysis structure and cppcheck 
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-29 14:44:28 +02:00
Leo Di Donato
271e23ce97 docs(brand): documenting Falco color scheme 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-28 15:15:36 +02:00
Kris Nóva
404762bd34 feat(release): Updating notes according to PR 
Signed-off-by: Kris Nóva <kris@nivenly.com>
 2020-09-25 08:18:48 -07:00
Kris Nóva
20f5e5d35a feat(release): Release 0.26 
Cutting release for 0.26.0 and starting 0.27.0

Signed-off-by: Kris Nóva <kris@nivenly.com>
 2020-09-25 08:18:48 -07:00
Mark Stemm
33793d233b Rule(Disallowed K8s User): quote colons 
It turns out if you read this rules file with falco versions 0.24.0 and
earlier, it can't parse the bare string containing colons:

(Ignore the misleading error context, that's a different problem):

```
Thu Sep 10 10:31:23 2020: Falco initialized with configuration file
/etc/falco/falco.yaml
Thu Sep 10 10:31:23 2020: Loading rules from file
/tmp/k8s_audit_rules.yaml:
Thu Sep 10 10:31:23 2020: Runtime error: found unexpected ':'
---
  source: k8s_audit
    tags: [k8s]
    # In a local/user rules file, you could override this macro to
```

I think the change in 0.25.0 to use a bundled libyaml fixed the problem,
as it also upgraded libyaml to a version that fixed
https://github.com/yaml/libyaml/pull/104.

Work around the problem with earlier falco releases by quoting the colon.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-09-23 17:48:36 +02:00
Mark Stemm
331b2971be rule(Delete or rename shell history):skip dockerfs 
In some cases, when removing a container, dockerd will itself remove the
entire overlay filesystem, including a shell history file:

---
Shell history had been deleted or renamed (user=root type=unlinkat
command=dockerd -H fd://
... name=/var/lib/docker/overlay2/.../root/.bash_history ..
---

To avoid these FPs, skip paths starting with /var/lib/docker.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-09-23 17:48:36 +02:00
Leonardo Grasso
558b18ea67 build: update the driver version to 2aa88dc 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Leonardo Grasso
bbfb27777b build: remove macrodefs about time (musl build) 
See https://github.com/draios/sysdig/pull/1684

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-18 17:27:45 +02:00
Hiroki Suezawa
5b926386a8 rule(macro consider_packet_socket_communication): change a value to always_true 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-09-18 09:47:10 +02:00
Lorenzo Fontana
1efa4d3af0 update(scripts): driver loader cycle available gcc versions 
The falco-driver-loader script calls dkms to compile the kernel
module using the default gcc.
In some systems, and in the falcosecurity/falco container image,
the defult gcc is not the right one to compile it.

The script will try to compile the module by cycling trough all the available GCCs
starting from the default one until the module is compiled the first
time.

The default gcc is the highest priority while trying.
Newer GCCs have the priority over older GCCs.

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-16 18:09:09 +02:00
Leonardo Di Donato
8611af4373 chore(.circleci): re-enable cleanup of falco development packages only when on the master branch 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-14 11:09:09 +02:00
Leonardo Di Donato
b6fd43f4db update(.circleci): update CI references to cleanup script 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-14 11:09:09 +02:00
Leonardo Di Donato
2971d0de7f fix(scripts): move cleanup (falco development packages) into scripts dir 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-14 11:09:09 +02:00
Leonardo Grasso
d2dbe64723 update: bump Falco engine version to 7 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-13 22:54:00 +02:00
Leonardo Grasso
66309e3a1f build(.circleci): fix static build path 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-11 14:52:30 +02:00
bgeesaman
cb2439d757 Append Slash to Sensitive Mount Path startswith 
Make L#1932 equivalent to L#1898

Signed-off-by: Brad Geesaman <bradgeesaman+github@gmail.com>
 2020-09-11 14:50:28 +02:00
Leonardo Di Donato
f02a998526 build: update the driver version to 73554b9 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
d1ee7d3d79 chore(.circleci): re-enable the usual falco-tester docker image for CI 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
0586a7d33c update(docker/no-driver): use the statically linked falco tarball 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
e0f0db96d3 build(rules): fix rules etc dir 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
045cb4a45d build(.circleci): specify falco etc directory for musl build 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
4319f16fa6 build: publish musl artifacts 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
c2603c0130 new(.circleci): test the minimal build 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
5316e39379 chore(cmake/modules): correct logging for string-view-lite (always) bundled header dependency 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
9a29203a4d build: engine fields checksum only when not building the minimal Falco 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Di Donato
7e28e305a6 deps: update driver version 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
ec2ccf4d1c build: fix cares include 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
d2ecc52253 build(.circleci): fix build/musl when releasing 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
be7ba9fea4 build: fix cares include path 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
2141580a10 update(userspace/engine): bump driver version to 9c7755ae7aaa221a3d17c1d98911c4c2cbdbd21317559d744e53bf63a2677a4b 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
1e64f0a5c9 build(.circleci): publish static tgz on release 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
7e9ca5c540 build: run_regression_tests.sh skip packages tests if asked 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
98a5813bd7 build: allow the tester command to retrieve the source and build env 
variables

Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
492fe0c372 build: circleci musl build 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
00d930199f build: strip userspace/falco/falco in release when building with musl 
optimizations

Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Lorenzo Fontana
f2bc92ac58 build: allow configurable cpack targets 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
d5f752de7a build: add MUSL_OPTIMIZED_BUILD option 
This option is now decoupled from `MINIMAL_BUILD`

Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
109efc2799 chore(cmake/modules): refine sysdig cmake for minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
c46dbc7f11 build: remove gRPC, openssl, curl from minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
b7e75095e6 build(userspace): avoid openssl dep for engine fields verification 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
68f937f5e8 build: disallow k8s audit trace file when minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
0c1ed551ca build: remove civetweb when minimal build 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
bdd14604d4 build: remove webserver from minimal build 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leonardo Grasso
9d88bfd0d4 build: add MINIMAL_BUILD option 
Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-10 15:01:07 +02:00
Leo Di Donato
361fec452e chore(.circleci): typos 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-08 11:07:48 +02:00
Leonardo Di Donato
cd449cb89b update(.circleci): cleanup/packages-dev job 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-08 11:07:48 +02:00
Leonardo Di Donato
2880bb1f23 build(.circleci): script for automatic cleanup of Falco development releases 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-08 11:07:48 +02:00