Federico Di Pierro
3ddabc3b95
docs(readme): added arm64 mention + packages + badge.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-07-05 17:46:00 +02:00
Federico Di Pierro
a8b9ec18b0
fix(circleci): properly set BUILD_DIR and SOURCE_DIR to /build and /source respectively.
...
Inside job "build-arm64" these are the locations used inside the container.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-07-05 17:45:01 +02:00
Federico Di Pierro
34404141e4
fix(circleci): share docker socket with docker container.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-07-05 17:45:01 +02:00
Federico Di Pierro
315b44dc17
new(circleci): enable integration tests for arm64.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-07-05 17:45:01 +02:00
Luca Guerra
161fe6fb3c
update(falco): upgrade drivers to 2.0.0, libs to latest rc
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-05 11:02:38 +02:00
Luca Guerra
3cde70eda8
fix(falco): parameter ordering in initialization
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
982e8663be
update(gvisor): make gvisor_enable depend on config
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-07-01 14:17:38 +02:00
Luca Guerra
993516f430
new(falco): add compile-time option to enable or disable gvisor support
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
60b149709d
fix(gvisor): formatting
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-07-01 14:17:38 +02:00
Luca Guerra
698eda8680
new(gvisor): add option to generate gVisor configuration
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
0b75433cee
update(gvisor): update to the latest sinsp interface
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
0ba492c280
new(falco): do not alert on syscall frequency when gvisor is enabled
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
927c1c4126
new(falco): enable gVisor event collection
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 14:17:38 +02:00
Luca Guerra
1966fa1f91
update(falco): update libs to 0.7.0-rc2, 2.0.0-rc1+driver
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-07-01 12:53:23 +02:00
Andrea Terzolo
e4fe6a3353
chore(cmake): bump plugins versions
...
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
2022-06-29 16:41:29 +02:00
Federico Di Pierro
610b67838b
fix(docker): fixed deb tester sub image.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-06-29 11:52:31 +02:00
Jason Dellaluce
effabf533d
test(plugins): drop macro source warning test
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-28 11:33:08 +02:00
Jason Dellaluce
3c2effb498
refactor(userspace/engine): remove source field from macros in rule loader
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-28 11:33:08 +02:00
Jason Dellaluce
555bf9971c
fix(test): update expected test result for docker-compose scap file
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Luca Guerra <luca@guerra.sh>
2022-06-23 18:12:24 +02:00
Leonardo Grasso
c309107949
fix(test): correct "incompat_plugin_api" expectation
...
See https://github.com/falcosecurity/libs/pull/389
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 18:12:24 +02:00
Leonardo Grasso
b6245d77c7
update(rules): lower priority to noisy rule (after the dup improvement)
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 18:12:24 +02:00
Leonardo Grasso
2f208b52fc
fix(userspace/falco/app_actions/print_version.cpp): correct getter call for schema version
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
f3bc178e40
fix(userspace/falco/app_actions/print_version.cpp): ensure destructor gets invoked
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
308f001b87
chore(cmake/modules): remove leftover
...
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
fda9fb36de
update(userspace/falco): add more info to --version
output
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
92fdbbcc52
update(userspace/falco): do not print driver version by default
...
Since now each Falco version is compatible with a range of driver version and not just one.
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
4b694896a4
build: temporarily bump libs and driver
...
Note that another bump is required before releasing Falco, since this commit uses alpha versions.
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
d589ec2144
build(cmake/modules): dedicated cmake module for the driver
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
6c08fa2a20
build(cmake/modules): divorce driver from falcosecurity-libs module
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
9af20a000d
chore(cmake/modules): duplicate git history (part 2)
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
7e1e7c2e42
chore(cmake/modules): duplicate git history (part 1)
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Leonardo Grasso
1f2e6d4629
chore(cmake/modules): indentation
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2022-06-23 12:47:03 +02:00
Mark Stemm
85ca1eb3dd
fix(app_actions): perform validate_rules before load_rules action
...
Perform the validate_rules action before the load_rules action. This
ensures that *only* the rules files named with -V arguments are
validated.
This fixes https://github.com/falcosecurity/falco/issues/2087 .
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2022-06-23 12:24:03 +02:00
Luca Guerra
5dce4d2025
fix(tests): make tests run locally (take 2)
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2022-06-23 12:22:03 +02:00
Aldo Lacuku
d90421387f
update(rules): add macro for dup syscalls
...
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
2022-06-23 10:06:13 +02:00
Aldo Lacuku
07b4d5a47a
fix(rules): use exit event in reverse shell detection rule
...
In some cases the rule is not triggered when a reverse shell is spawned.
That's because in the rule we are checking that the file descriptor passed
as argument to the dup functions is of type socket and its fd number is "0, 1, or 2"
and the event direction is "enter".
The following event does not trigger the rule: dup2(socket_fd, STDIN_FILENO);
But using the exit event the rule is triggered.
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
2022-06-23 10:06:13 +02:00
Kaizhe Huang
8a1f43f284
remove kaizhe from falco rule owner
...
Signed-off-by: Kaizhe Huang <khuang@aurora.tech>
2022-06-22 22:16:21 -05:00
Federico Di Pierro
fcac635780
update(OWNERS): add Federico Di Pierro to owners.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-06-22 19:06:20 +02:00
Vicente J. Jiménez Miras
5d10e54ad4
fix(ci): fix sign script - avoid interpreting {*}$argv
...
Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
2022-06-20 13:54:29 +02:00
Vicente JJ. Miras
5f17b7bd41
fix(ci): creates ~/sign instead of ./sign
...
Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
2022-06-20 10:19:11 +02:00
Federico Di Pierro
9231fe3c1f
chore(ci): improved rpm command to check for SHA256 sign.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
2022-06-17 14:52:53 +02:00
Federico Di Pierro
99784874eb
chore(ci): small refactor.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
2022-06-17 14:52:53 +02:00
Federico Di Pierro
a3c8fa85d4
fix(ci): sign arm64 rpm packages.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2022-06-17 14:52:53 +02:00
Jeremi Piotrowski
bcda81f700
update(falco_scripts): Change Flatcar dynlinker path
...
The Flatcar kernel module build needs to relocate binaries in /host/lib/modules
to run with the host's ld and glibc. While testing with glibc 2.34 that we plan
to introduce soon, we found that the previous dynlinker symlink (ld-xxx.so)
doesn't exist any longer. Update the hostld variable to use a path that is
present in all versions of glibc.
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2022-06-17 13:41:52 +02:00
Jason Dellaluce
1e5ef912de
chore: improve falco.yaml comments
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-14 22:13:37 +02:00
Jason Dellaluce
50039316ce
update(userspace/falco): make plugin configuration more robust
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-14 22:13:37 +02:00
Jason Dellaluce
eb365f1a3e
new(userspace/falco): add action and option to print detailed plugin info
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2022-06-14 22:13:37 +02:00
joon
625201f9f6
Add Java compatibility note
...
Signed-off-by: joon <pirxthepilot@users.noreply.github.com>
2022-06-14 17:01:12 +02:00
joon
583ac4192c
rule(Java Process Class Download): detect potential successful log4shell exploitation
...
Signed-off-by: joon <pirxthepilot@users.noreply.github.com>
2022-06-14 17:01:12 +02:00
Jeremi Piotrowski
85f91a3ec4
update(falco_scripts): support pre-built module/probe on Flatcar
...
Pre-built kernel modules/eBPF probes for Flatcar use the value of the OS
VERSION_ID field as KERNEL_RELEASE in the filename. A specific kernel release
version does not uniquely identify a Flatcar configuration, because Flatcar is
image-based instead of package-based. Here's a more specific example: the same
kernel version can be part of various Flatcar releases (across channels
alpha/beta/stable) with differences in configuration. This is why we use the
VERSION_ID value during offline builds with driverkit. Flatcar version numbers
are all higher than 1500.0.0, so there is no risk of collision with kernel
version numbers.
When locally building the kernel module on the system, we have access to the
correct kernel build directory at /lib/modules/$(uname -r)/build with the right
configuration and so for that branch, we need to reset KERNEL_RELEASE=$(uname -r).
See also the driverkit PR that introduces a builder for Flatcar:
https://github.com/falcosecurity/driverkit/pull/131
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2022-06-13 10:34:43 +02:00