github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-01-15 23:19:04 +00:00
Code Issues Projects Releases Wiki Activity
2,945 Commits 121 Branches 180 Tags
6d56571e236b525982778ebcc45f74c0ba5f4dbf
Commit Graph

120 Commits

Author SHA1 Message Date
Jeremi Piotrowski
6d56571e23 update(docker,falco_scripts): fix kernel module build on Flatcar 
Relocate necessary tools from the kernel module build system to run using host
dynlinker and libraries, so that compiling falco module on Flatcar works.

Since Flatcar v2983.0.0, Flatcar ships with glibc-2.33, but the
falco-driver-loader container is based on debian:buster and so has a much older
glibc. This prevents some necessary tools within /lib/modules/*/build from
working which causes the falco module to fail to compile using dkms.

To make the tools work, we need to relocate them so we add patchelf to the
falco and local dockerfiles. The relocation is based on the approach done by
the sysdig agent-kmodule build system, but I'm unable to find the source code
for it. The host linker and libs will be found at /host/usr/lib64, so we change
the interpreter and rpath on the tools. The relocation happens on a copy of the
tools which are then bind mounted at the right location. The result allows the
module build to work.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
 2022-06-13 10:34:43 +02:00
Federico Di Pierro
4097661ba8 fix(scripts): fixed path in publish-deb script. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-11 00:11:09 +02:00
Federico Di Pierro
fccd3fa7b6 new(scripts): support InRelease file creation for publish-deb script. 
Newest Debian/Ubuntu versions look for this file instead of Release + Release.asc, hitting lots of 404 (and a retry on the old format).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-10 17:50:12 +02:00
Federico Di Pierro
1327c796d0 fix(scripts): fixed falco-driver-loader driver download url. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-10 16:49:42 +02:00
Federico Di Pierro
b059e83dd2 fix(scripts): fixed publish-deb script with manual arch filter. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 17:52:40 +02:00
Federico Di Pierro
6a034c17e0 fix(scripts): forcefully create packages dir for debian packages. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-09 17:52:40 +02:00
Federico Di Pierro
3f29660258 update(scripts): ported publish-deb and publish-rpm scripts to be multi arch. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
984b94f734 new(docker,scripts): port all docker images to be multiarch ready. 
They can be pushed with `docker buildx` for various architectures.

Moreover, updated falco-driver-loader to support multiple architectures.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Andrea Terzolo
9392c0295a fix(falco-scripts): remove driver versions with dkms-3.0.3 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-30 13:08:40 +02:00
Andrea Terzolo
21b127ef65 docs(falco_scripts): update Copyright 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
9937565416 docs(falco_scripts): add some punctuation marks in comments 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
b94226569f update(falco_scripts): delete all versions of the module from dkms 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
f8b97bfbce docs(falco_scripts): update comments in falco-driver-loader. 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
1ebdb5648f update(falco_scripts): remove only the current version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Andrea Terzolo
a11d513bff chore(falco_scripts): Update falco-driver-loader cleaning phase 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-04-29 13:46:58 +02:00
Leonardo Grasso
b4d9261ce2 build: define "falco" component 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-22 09:41:56 +02:00
Jason Dellaluce
0a132f453a update(cmake): remove lpeg dependency 
The Lua PEG parser is not longer needed, since we now use the new filter parser implemented
in libsinsp.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Leonardo Grasso
204f9ff875 fix(scripts): correct typo in falco-driver-loader help message 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-02-14 10:06:41 +01:00
Federico Di Pierro
ff21544186 update(build)!: replaced various PROBE with DRIVER where necessary. 
Follow-up of https://github.com/falcosecurity/libs/pull/197.
Updated libs too to master version, as needed.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-02-08 09:50:39 +01:00
Leonardo Grasso
96529300f6 fix(script/falco-driver-loader): fix typo 
Co-Authored-By: Thomas Spear <tspear@conquestcyber.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Leonardo Grasso
27922faa27 fix(scripts/falco-driver-loader): missing compression formats for .ko files 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Leonardo Grasso
8a1de131f4 update(scripts/falco-driver-loader): load the latest version first 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 17:49:34 +01:00
Jason Dellaluce
697d4427a7 chore(scripts): refine removal output messages 
Signed-off-by: Jason Dellaluce jasondellaluce@gmail.com
Co-authored-by: Leonardo Grasso me@leonardograsso.com
 2021-12-06 19:09:14 +01:00
Jason Dellaluce
bf04fed71c fix(scripts): correctly remove loaded drivers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2021-12-06 19:09:14 +01:00
Manuel Gauto
2312afe9cd Set digest-algo for gpg to use SHA256 for linux packages. 
Signed-off-by: Manuel Gauto <mgauto@mgenterprises.org>
 2021-11-12 17:17:27 +01:00
David Windsor
8448d02980 falco-driver-loader: don't fail if chcon is missing in load_kernel_module() 
Signed-off-by: David Windsor <dwindsor@secureworks.com>
 2021-11-02 16:49:55 +01:00
David Windsor
74661a7d8f Apply suggestions from code review 
Don't fail if chcon is not present

Co-authored-by: Leo Di Donato <leodidonato@gmail.com>
Signed-off-by: David Windsor <dwindsor@secureworks.com>
 2021-11-02 16:49:55 +01:00
David Windsor
e7b320b00c Fix falco-driver-loader SELinux insmod denials 
Signed-off-by: David Windsor <dwindsor@secureworks.com>
 2021-11-02 16:49:55 +01:00
Domenico Chirabino
d033868ab9 falso.service: set StandardOutput to null 
Signed-off-by: Domenico Chirabino <chirabino@protonmail.com>
 2021-09-23 08:46:47 +02:00
spartan
7c9ec9fc17 fix bugs 
Signed-off-by: Spartan-65 <liuyanchong@outlook.com>
 2021-09-21 18:54:09 +02:00
Leonardo Grasso
e616f79bac build: switch to falcosecurity-libs external project 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-05-21 10:24:08 +02:00
Leonardo Di Donato
04110b0f4c chore(scripts): restore mount of debugfs (notes below) 
This is needed in systems where raw tracepoints are not available.

Anyways, since this is needed when the inspector open (and actually
loads) the eBPF probe, ideally the mount should not be done by this
script but rather from Falco, or from Falco libs.

Otherwise, users building the eBPF probe theirseleves and not using this script (and having a kernel without raw
tracepoints) may need to mount this fs theirselves.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Leonardo Di Donato
17ee409ac6 chore(scripts): better default values in the help message of falco-driver-loader 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Leonardo Di Donato
71b2b5adde chore(scripts): remove banner about BPF JIT kernel config option 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Leonardo Di Donato
75261d4518 update(scripts): look for a prebuilt Falco eBPF probe before trying to compile one 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Leonardo Di Donato
2a7b32e279 update(scripts): look for a prebuilt Falco module before trying to compile it on-the-fly 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Leonardo Grasso
c587fadbce chore(scripts): typos 
Applying suggestions from
https://github.com/falcosecurity/falco/pull/1577

Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-07 16:45:50 +02:00
Leonardo Grasso
9e50e87ebc chore: remove "cleanup" script and job 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-07 16:45:50 +02:00
Leonardo Grasso
ef75c63e63 chore(scripts): print versions at the beginning 
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 14:54:53 +01:00
Leonardo Grasso
fb126cb730 feat(scripts): --clean option for falco-driver-loader 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
645f51b296 new(scripts): falco-driver-loader know the Falco version it has been 
built for

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
d912cf0d94 docs(scripts): falco-driver-loader outputs the Falco version it has been built for, also the driver version in use 
Both in the help/usage message and at running time.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
3f75f27410 docs(scripts): improve help of falco-driver-loader script 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
1504e77f4e update(scripts): falco-driver-loader can now start with a custom driver name 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Grasso
3936740390 build(scripts): add cloudfront invalidation for publishing scripts 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
9bc04fd02d build(scripts): publishing script for DEBs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
b6ac6de227 build(scripts): publishing script for RPMs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
5ebb653977 build(scripts): publishing script for bin packages 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
JenTing Hsiao
b1801c28c7 Bump year to 2021 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
JenTing Hsiao
e1d3e68a84 Modprobe/rmmod at systemd service start/stop 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00