github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-06 03:16:46 +00:00
Code Issues Projects Releases Wiki Activity
4,026 Commits 117 Branches 173 Tags 104 MiB
83db0bb4e2
Commit Graph

4026 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
odidev
4aa0fe1b95 ARM64 build 
Signed-off-by: odidev <odidev@puresoftware.com>
 2022-06-09 08:35:39 +02:00
odidev
0ebc7cd969 ARM64 build 
Signed-off-by: odidev <odidev@puresoftware.com>
 2022-06-09 08:35:39 +02:00
Federico Di Pierro
4f759b6b2b fix(build): use apt instead of apk when installing deps for aws ecr publish. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 15:40:18 +02:00
Federico Di Pierro
ca677db651 update(build): avoid double build of docker images when pushing to aws ecr. 
Moreover, fixed subtle whitespace-bug in various buildx lines.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 12:58:17 +02:00
Federico Di Pierro
0a98e11428 fix(build): try to use root user for cimg/base. 
Moreover, fixed buildx usage.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-08 11:11:55 +02:00
Andrea Terzolo
7068e9958f tests(k8s_audit_plugin): fix a k8s_audit_plugin test 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-06-07 16:07:53 +02:00
Andrea Terzolo
e5af3899f9 chore(k8s_audit_plugin): bump k8s_audit_plugin version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-06-07 16:07:53 +02:00
Federico Di Pierro
3f29660258 update(scripts): ported publish-deb and publish-rpm scripts to be multi arch. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
62794966b1 update(build): updated circle ci to properly use docker buildx to build multiplatform images. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
984b94f734 new(docker,scripts): port all docker images to be multiarch ready. 
They can be pushed with `docker buildx` for various architectures.

Moreover, updated falco-driver-loader to support multiple architectures.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-07 11:02:54 +02:00
Federico Di Pierro
f9b0568187 update(changelog): added 0.32.0 release notes. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-03 10:29:43 +02:00
Federico Di Pierro
13eb8d2d48 update(build): updated plugins to latest versions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-06-01 14:50:38 +02:00
Aldo Lacuku
7a774f6b2e chore(userpace/falco): do not print error code in process_events.cpp 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-01 13:35:38 +02:00
Federico Di Pierro
3fef329d11 update(build): updated libs to 39ae7d40496793cf3d3e7890c9bbdc202263836b for Falco 0.32.0. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-31 18:12:09 +02:00
Andrea Terzolo
9392c0295a fix(falco-scripts): remove driver versions with dkms-3.0.3 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-30 13:08:40 +02:00
Aldo Lacuku
765ef5daaf chore(userspace/falco): fix punctuation typo in output message when loading plugins 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-05-30 10:46:40 +02:00
Matan Monitz
9f163f3fe0 Update rules/falco_rules.yaml 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Matan Monitz <mmonitz@gmail.com>
 2022-05-28 10:13:30 +02:00
Matan Monitz
4c95c717d2 known_shell_spawn_cmdlines - lighttpd 
Signed-off-by: Matan Monitz <mmonitz@gmail.com>
 2022-05-28 10:13:30 +02:00
beryxz
54a2f7bdaa rule(macro net_miner_pool): additional syscall for detection 
Signed-off-by: beryxz <coppi.lore@gmail.com>
 2022-05-28 09:29:30 +02:00
Federico Di Pierro
eb9a9c6e7d update(build): updated libs to 1be924900a09cf2e4db4b4ae13d03d838959f350 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 18:19:26 +02:00
Federico Di Pierro
75712caa9a fix(test): dropped file:// from k8s audit log tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
db5f1bec3d update(cmake): updated plugins. 
Moreover, add support for aarch64 plugins, even if Falco 0.32 won't be distributed with official arm64 support.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
1d343c93f3 update(build): updated libs version for Falco 0.32.0 release. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 11:07:27 +02:00
Jason Dellaluce
3b462af58e fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
09eae35f3a refactor(userspace/falco): create action for initializing k8s and mesos clients (step 2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
383b8f9660 refactor(userspace/falco): create action for initializing k8s and mesos clients 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
13d70b65ae update(userspace/engine): rename ruleset.h in filter_ruleset.h 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
9fd10220a5 update(userspace/falco): sync falco with new engine definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
0abd7eaa28 refactor(userspace/engine): refactor engine interface and internals 
This updates the engine to comply and work properly with the newly-introduced
interface design.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
5ddc8e20f4 test(userspace/engine): adapt test_rulesets to new definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
a1bdf95a0f refactor(userspace/engine): improve ruleset interface definitions 
The filter_ruleset interface its implementation evt_type_index_ruleset
have been modified as follows:
- Only keep track of ruleset ids and not names. The falco engine will take
care of mapping easy-to-remember ruleset names to ruleset ids.
To emphasize this, use ruleset_id everywhere and not ruleset.
Also, make it non-optional.
- Have explicit separate functions to enable/disable rules, instead of a single enable() method combined with a boolean flag.
This does *not* change the falco_engine interface, which has
similar methods, to avoid breaking API changes.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Mark Stemm <mark.stemm@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
833fec8537 refactor(userspace/engine): leverage falco_rule def in stats manager 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
50c2aa9c81 refactor(userspace/engine): update rule loader to use new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
f41f51f736 refactor(userspace/engine): update falco engine to use new ruleset interface and have one ruleset for each source 
This also fixes a couple of bugs. With the current implementation, the multi-ruleset feature is broken with multiple sources.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
3af8d1c0d2 refactor(userspace/engine): adapt existing ruleset implementation to new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
bbbdb311e0 refactor(userspace/engine): introduce interface for rulesets and their factory 
This interface will allow us to use different ruleset implementations inside the same engine.
The goal is to define API boundaries that will allow swapping the current evttype-index
ruleset implementation more easily. Key benefits include: smaller component with less responsibilities,
easier substituibility, more testable design, opportunity to adopt different index strategies
depending on the ruleset implementation.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Andrea Terzolo
d860472987 update(userspace/falco): improve falco termination 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 18:35:18 +02:00
Andrea Terzolo
3a3d5dfdcd Update userspace/falco/app_actions/load_rules_files.cpp 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
46159b8de9 update(userspace/engine): introduce new check_plugin_requirements API 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
e751bf79c3 fix(userspace/engine): improve rule loader source checks for macros and lists 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:54:17 +02:00
Federico Di Pierro
d9d8dedc32 update(test): fixed tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
39f55f4b5c update(userspace): split filterchecks list for each source idx. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
5f00cea3c9 fix(userspace/falco): do not start webserver in capture mode. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
f6dba24b81 update(build): updated libs to latest master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Brad Clark
9d41b0a151 use endswith ash_history to catch both bash and ash 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
b9bcf79035 rule(macro truncate_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
3cca4c23cc rule(macro modify_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Federico Di Pierro
a7ebfbf137 update(ci): add workflow_dispatch to be able to manually trigger ci. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
fbc7ede75a Update .github/workflows/ci.yml 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
7b45520f37 fix(ci): fetch all history from git to correctly populate FALCO_VERSION. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00