github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity
1,839 Commits 119 Branches 172 Tags 104 MiB
74ca02d199
Commit Graph

1839 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Grasso
74ca02d199 rule(macro bin_dir_mkdir): correct condition to catch mkdirat case 
Since the dir's path is found:
-  in `evt.arg[1]` for `mkdir`
-  but in `evt.arg[2]` for `mkdirat`
switch to `evt.arg.path` to catch both.
That ensures `Mkdir binary dirs` works properly.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-10 12:21:36 +02:00
Leonardo Di Donato
3bfd94fefd docs(test): run locally handling python deps with venv 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-26 15:01:48 +02:00
Leonardo Di Donato
6eb9b1add1 build(test): requirements.txt 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-26 15:01:48 +02:00
Nicolas Marier
81e29c55ec rule(macro user_known_set_setuid_or_setgid_bit_conditions): create macro 
This macro will be useful because it will make it possible to filter out
events with a higher degree of granularity than is currently possible
for the `Set Setuid or Setgid bit` rule.

For example, if some application is expected to set the setuid or the
setgid bit under a specific condition, like if it's started with a
specific command, then the `user_known_chmod_applications` list is not
enough because we don't want to filter out _all_ events by this
application, only specific ones. This macro allows that.

Signed-off-by: Nicolas Marier <nmarier@coveo.com>
 2020-05-26 10:23:31 +02:00
Leonardo Di Donato
f186e5f41f fix(userspace/falco): set gpr log verbosity accordingly to the Falco one 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
ade64b0ce8 update(userspace/falco): make log level a configuration member 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
d808c0aeaf update(tests/engine): test is_unix_scheme 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
65e069a020 update(userspace/engine): url_is_unix_scheme() util is now is_unix_scheme(string_view) 
Also no more custom `starts_with` utility function.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
75c2275dac build(userspace): falco and falco_engine depend on string-view-lite header 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
258f73ede2 build: download string-view-lite 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Leonardo Di Donato
3386671452 build(cmake/modules): cmake module for string-view-lite 
The CMake module downloads `string-view-lite` from
https://github.com/martinmoene/string-view-lite

It is a single-file header-only version of C++17-like `string_view` for
C++98, C++03, C++11, and later.

Notices it also provides C++20 extensions like:

- empty()
- starts_with()
- ends_with()
- etc.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
2680a459ec new(tests/engine): update socket path 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
da9278f061 docs: add grpc notice in falco.yaml 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
dc0670c718 update(userspace/falco): wrap gpr logs into falco logs 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
05ce5b7f0b new(tests): cases for falco::utils::starts_with 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
de8bade2bf update(userspace/engine): move utils inside engine 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
e245fe460f docs: update falco.yaml to explain how to use the unix socket feature 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
d7de45acb2 new(userspace/falco): gRPC server unix socket support 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Lorenzo Fontana
86b473e224 update(userspace/falco): utilities to detect unix socket prefix in string 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-21 18:15:46 +02:00
Mark Stemm
d1c9aae881 rule(list allowed_k8s_users): Add vertical pod autoscaler as known k8s users 
https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

Example alert:
---
K8s Operation performed by user not in allowed list of
users (user=vpa-recommender target=vpa-recommender/endpoints verb=update
uri=core/v1/namespaces/kube-system/endpoints/vpa-recommender resp=200)

K8s Operation performed by user not in allowed list of
users (user=vpa-updater target=vpa-updater/endpoints verb=update
uri=core/v1/namespaces/kube-system/endpoints/vpa-updater resp=200)
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-21 10:57:42 +02:00
Mark Stemm
986ea28279 rule(macro user_known_k8s_client_container): Allow hcp-tunnelfront torun kubectl in containers 
https://stackoverflow.com/questions/50349586/what-is-hcp-tunnelfront

Example alert:

---
Docker or kubernetes client executed in container (user=root
parent=run-tunnel-fron cmdline=kubectl
--kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig get secret
tunnelfront --namespace=kube-system --output json --ignore-not-found
image=mcr.microsoft.com/aks/hcp/hcp-tunnel-front)
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-21 10:57:42 +02:00
Mark Stemm
5266618689 rule(macro lvprogs_writing_conf): Add lvs as a lvm program 
Example event. I'm pretty sure the full file in this case is /etc/lvm/cache:

---
File below /etc opened for writing (user=root command=lvs --noheadings
--readonly --separator=";" -a -o
lv_tags,lv_path,lv_name,vg_name,lv_uuid,lv_size parent=ceph-volume
pcmdline=ceph-volume /usr/sbin/ceph-volume inventory --format json file=/etc/lvm/c...
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-21 10:57:42 +02:00
Mark Stemm
fa3d2eb473 rule(macro trusted_logging_images): Let azure-npm image write to /var/log 
"The Azure's NPM is a a daemonset that supports network policies as
defined by the Kubernetes policy specification."

Example event:

---
Log files were tampered (user=root command=azure-npm
file=/var/log/iptables.conf CID1 image=mcr.microsoft.com/containernetworking/azure-npm)
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-21 10:57:42 +02:00
Mark Stemm
acb3f94786 rule(macro trusted_logging_images): Add addl fluentd image 
Openshift specific variant, example alert:

---
Log files were tampered (user=root command=fluentd /usr/bin/fluentd
--no-supervisor file=/var/log/journal.pos CID1 image=registry.redhat.io/openshift3/ose-logging-fluentd)
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-21 10:57:42 +02:00
kaizhe
d1af7e139f rule update: fix macro reference 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-05-21 10:55:53 +02:00
Leonardo Grasso
434a5abc8b docs(CONTRIBUTING.md): update slack channel URL 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-20 18:07:51 +02:00
Lorenzo Fontana
fd97f99b9f build: focal builder generic kernel headers 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-19 16:34:58 +02:00
Lorenzo Fontana
555bf1f10d build: use ubuntu focal instead of bionic during the ubuntu CI step 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-19 16:34:58 +02:00
Leonardo Grasso
f3f512c6dd fix(.circleci): correct publishing command 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 18:16:53 +02:00
Leonardo Grasso
8d79c11953 fix(CHANGELOG.md): correct typo 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Co-authored-by: Leo Di Donato <leodidonato@gmail.com>
 2020-05-18 16:56:21 +02:00
Leonardo Grasso
439152c8d8 docs: changelog for 0.23.0 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 16:56:21 +02:00
Leonardo Grasso
3d3d537d85 update(docker/falco-driver-loader): propagate all args 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 15:16:59 +02:00
Leonardo Grasso
88dbc78a44 fix(scripts/falco-driver-loader): exit when bpf download fails 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 15:16:59 +02:00
Leonardo Grasso
59c2e6b421 update(scripts/falco-driver-loader): break apart logic 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 15:16:59 +02:00
Leonardo Grasso
33c93e6c29 chore(scripts/falco-driver-loader): improve messages 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 15:16:59 +02:00
Leonardo Grasso
46483339a3 fix(test): correct kernel module name 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 14:08:25 +02:00
Leonardo Grasso
762ef015b8 fix(scripts): correct kernel module name 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 14:08:25 +02:00
Leonardo Grasso
b887c92c91 docs(RELEASE.md): correct typo 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 11:41:05 +02:00
Reshad Patuck
efd0bf1967 fix(falco-driver-loader): target for ubuntu is ubuntu-generic 
The upstream files for the generic Ubuntu kernel are all called ubuntu-generic
see: https://dl.bintray.com/falcosecurity/driver/96bd9bc560f67742738eb7255aeb4d03046b8045/

Signed-off-by: Reshad Patuck <reshad@patuck.net>
 2020-05-15 19:20:29 +02:00
Leo Di Donato
5c69639a69 update(.github): remove examples and integrations from PR template 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-15 11:27:18 +02:00
Leonardo Grasso
b8875df48f fix(.circleci): correct no-driver image aliasing 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:20:56 +02:00
Leonardo Grasso
368817a95d fix(docker/no-driver): correct config value substitution 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:20:56 +02:00
Leonardo Grasso
622a6c1e44 fix(test/driver-loader): source script to get env vars populated 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:19:31 +02:00
Leonardo Grasso
95e7242d13 test: add driver-loader integration tests 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:19:31 +02:00
Leonardo Grasso
c42cb1858c update(docker/falco): rename folder for naminig consistency 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Leonardo Grasso
935d9f5378 fix(docker/no-driver): enable time_format_iso_8601 by default 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Leonardo Grasso
2345ea2770 new(docker): add falco-no-driver image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Leonardo Grasso
901239c3c8 docs(docker): add falcosecurity/falco-no-driver image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Lorenzo Fontana
d0f4f7cbb5 docs(tests): fix typo 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00
Lorenzo Fontana
d67b3f5577 docs(CONTRIBUTING): mention the unit test page on CONTRIBUTING 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00