github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity
4,026 Commits 121 Branches 172 Tags 104 MiB
83db0bb4e2
Commit Graph

4026 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Dellaluce
a9ea18b99a fix(userspace/falco): report plugin deps rules issues in any case 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-29 12:26:24 +02:00
Daniel Wright
498b64b469 feat: add image source OCI label to docker images 
Closes #2591

Signed-off-by: Daniel Wright <danielwright@bitgo.com>
 2023-05-29 11:17:24 +02:00
Melissa Kilby
e9402b7606 cleanup(config): apply reviewers suggestions 
* place falco plugins after falco rules config
* change metadata_download description
* minor formatting

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-29 11:09:24 +02:00
Melissa Kilby
08ac4ea975 cleanup(config): rephrase numerous configs for technical clarity + add more information 
* rephrase descriptions for numerous config options
  without changing the original content, meaning changes
  reflect language improvements and minor extensions
  (such as adding justifications or what it is) only
* add Falco environment variables section
* add Guidance for Kubernetes container engine command-line args settings
* general rewrap formatting w/ IDE
* minor additional re-ordering of configs
* minor general language adjustments

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-29 11:09:24 +02:00
Melissa Kilby
f00b853fd4 cleanup(config): fine tune new configs ordering and organization 
* incorporate reviewers suggestions re ordering and phrasing
* minor additional cleanups

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-29 11:09:24 +02:00
Melissa Kilby
e269057c41 cleanup(config): improve config descriptions for the basic config options 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-29 11:09:24 +02:00
Melissa Kilby
b423754575 cleanup(config): re-arrange falco.yaml configs in logical categories 
* add an index for logical categories
* move configs around without changing description content,
  solely add a uniform header to each config
* indicate "Stable" or "Experimental" for most configs
  to indicate current stability or maturity

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-29 11:09:24 +02:00
Jason Dellaluce
354c06567a update(cmake): bump libs to 0.11.0-rc3 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-25 17:43:11 +02:00
Jason Dellaluce
bc8b987c59 update(cmake): bump libs to latest dev version 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-25 17:43:11 +02:00
Jason Dellaluce
aed64b3076 update(cmake): bump plugins to latest dev versions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-25 17:43:11 +02:00
Jason Dellaluce
b58a373835 chore(userspace/falco): always print invalid syscalls from custom set 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-25 14:14:11 +02:00
Roberto Scolaro
2dadb05af6 fix(userspace/falco/app/actions): hotreload on wrong metrics 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-25 14:09:10 +02:00
Andrea Terzolo
1098b6f7ca cleanup: rename a file 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-05-25 10:23:10 +02:00
Andrea Terzolo
1a359f5806 fix: add a check on online CPUs 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-05-25 10:23:10 +02:00
dependabot[bot]
6713ace5c6 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `b2290ad` to `3471984`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](b2290adef9...3471984e0c)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-05-24 19:53:07 +02:00
Jason Dellaluce
0943456ffe fix(userspace/falco): don't hang on terminating error when multi sourcing 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-24 19:12:06 +02:00
Luca Guerra
cc986b7749 update(build): bump libs to 0.11.0-rc2 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-05-24 15:52:06 +02:00
Luca Guerra
464bc0f4d3 update(build): bump falcoctl version 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-05-24 10:44:37 +02:00
dependabot[bot]
9f6b57f15a build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `3f52480` to `b2290ad`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](3f52480618...b2290adef9)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-05-24 10:14:36 +02:00
Jason Dellaluce
b40a6bc703 fix(userspace/falco): right boundary checks for strncat 
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 16:53:35 +02:00
Jason Dellaluce
75720534d7 fix(userspace/falco): solve escape issues in grpc output 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 16:53:35 +02:00
Jason Dellaluce
00acd17ba1 fix(userspace/faclco): output drop perc metric only if drops are present 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 16:53:35 +02:00
Jason Dellaluce
d550552fc1 fix(userspace/falco): properly format numeric values in metrics 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 16:53:35 +02:00
Federico Di Pierro
8c5ebde6a5 cleanup(ci): cleaned up circleci workflow. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-05-23 10:26:34 +02:00
Luca Guerra
ca891ad9b2 update(ci): use repo instead of master branch for reusable workflows 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-05-23 10:03:34 +02:00
dependabot[bot]
2c291424e9 build(deps): Bump requests from 2.26.0 to 2.31.0 in /test 
Bumps [requests](https://github.com/psf/requests) from 2.26.0 to 2.31.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.26.0...v2.31.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-05-23 10:02:34 +02:00
Melissa Kilby
d4c42814d6 cleanup(config): improve metrics config description for technical clarity 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
eaa4354ddf cleanup(userspace/falco): new consistent metrics output fields classes falco. and scap. 
* Ensure each metric field name more consistently adheres to the grammar used in Falco rules:
  * `falco.`: new field class representing userspace counters, statistics, resource utilization, or necessary information fields
  * `scap.`: new field class represents counters and statistics mostly obtained from Falco's kernel instrumentation before events are sent to userspace, but can include scap userspace stats as well
* minor cleanup

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
9b341b2c49 new(unit_tests): tests for prometheus compliant time durations 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
8e0c89d3b4 cleanup(userspace/engine): prometheus compliant regex parsing for metrics interval 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
698ff25f1e cleanup(config): improve config for new metrics 
Co-authored-by: Stanley Chan <pocketgamer5000@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
fcecde845d cleanup(userspace): move parse_prometheus_interval to falco_utils 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
f2318a9ac5 cleanup(userspace/falco): address reviewers comments + cleanup 
* prefix counters and stats belonging to kernel space w/ `k.` else `u.` for userspace
* add n_drops_perc from old stats writer schema
* revert one change: file output shall reflect exact same "output_fields" key as rule output, note that src is already part of the "output_fields" schema.

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Jason Dellaluce
5d35cda8dc update(userspace): minor polishing 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 09:58:34 +02:00
Jason Dellaluce
f117d5273c update(userspace): refactor metrics data flow and fix bugs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
f0ac327f98 cleanup(userspace/falco): add more fields to metrics 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
e37027a1d0 cleanup(userspace/falco): address reviewers comments 
* renaming to `metrics` for technical clarity
* adopt Prometheus like metrics interval settings

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
134d2630e9 new(userspace/falco): stats v2 config option to convert memory metrics to MB 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
010e45a4af new(userspace/falco): extend stats v2 configs w/ relevant env variables 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
78dbfab48f feat(userspace/falco)!: use new resource_utilization metrics / stats v2 schema for stats file ouput logs 
These changes break the old stats file output schema and consolidates
them with the new schema.

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
4d24bcdd2f new(userspace/falco)!: introduce native support for resource_utilization metrics / stats v2 
Intended to phase out previous stats writer settings and log schema.

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Melissa Kilby
44d9f99c72 new(userspace/falco)!: new stats v2 configs 
Intended to phase out previous stats writer settings and log schema.

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-05-23 09:58:34 +02:00
Jason Dellaluce
7248284b12 chore(userspace/falco/app): print all supported plugin caps 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-22 15:23:32 +02:00
Luca Guerra
f72489e431 fix(ci): get the manifest for the correct tag 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-05-22 10:57:31 +02:00
dependabot[bot]
2863ab3756 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `3f52480` to `6da15ae`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](3f52480618...6da15ae98c)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-05-22 10:11:15 +02:00
Federico Di Pierro
8268c47160 fix(ci): properly use docker save to store images. 
No buildx-docker does not support direct storing to tar.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-05-19 22:10:06 +02:00
Federico Di Pierro
e16cf2661e fix(ci): docker arg is named TARGETARCH. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-05-19 18:17:05 +02:00
Federico Di Pierro
a28347d150 fix(ci): properly pass TARGET_ARCH as build-arg to docker. 
It gets automatically defined in buildx.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-05-19 16:48:05 +02:00
Lorenzo Susini
e47ece4de9 update(userspace/engine): address jasondellaluce comments 
- avoiding inspector to be allocated for each rule
- use two boolean values for expecting macros and lists
- move items of lists alongside name, under info
- use snake case for json output, like we do for e.g alerts
- correctly retrieve evt names
- consider two levels of lists for exception operators

Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2023-05-19 15:56:05 +02:00
Lorenzo Susini
a269866976 test(unit_tests/engine): test filter_details_resolver class 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2023-05-19 15:56:05 +02:00