dependabot[bot]
14650f49b6
build(deps): Bump submodules/falcosecurity-rules
...
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules ) from `0f60976` to `497e011`.
- [Release notes](https://github.com/falcosecurity/rules/releases )
- [Commits](0f609769ef...497e01189e
)
---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-02-14 19:38:27 +01:00
Andrea Terzolo
26add16d12
cleanup(docker)!: remove unused builder dockerfile
...
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-14 17:10:26 +01:00
Federico Di Pierro
3476555ad1
update(docs): added CHANGELOG entry for 0.37.1
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-02-13 10:37:21 +01:00
Melissa Kilby
3c2bd8d4d8
cleanup: minor adjustments to readme, add new testing section
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-02-13 10:21:22 +01:00
dependabot[bot]
f268f45923
build(deps): Bump submodules/falcosecurity-rules
...
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules ) from `6ed2036` to `0f60976`.
- [Release notes](https://github.com/falcosecurity/rules/releases )
- [Commits](6ed2036d83...0f609769ef
)
---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-02-12 18:46:18 +01:00
Samuel Gaist
8c98ca5e8d
fix(c++): add missing member initialisation to grpc server
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 18:45:18 +01:00
Samuel Gaist
d6b0810657
fix(c++): move trivial initializations to declaration site
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 18:45:18 +01:00
Samuel Gaist
42f90817ad
refactor: make falco_exception a std::runtime_error
...
The implementation provides more or less the same implementation
and thus it makes more sense to base it on std::runtime_error.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 18:45:18 +01:00
Samuel Gaist
f6498cd8bd
fix(c++): refactor member initialization in constructor initialization list
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
# Conflicts:
# userspace/engine/falco_common.h
2024-02-12 18:45:18 +01:00
Tom Müller
8bc32d248e
Added http headers option for driver download in docker images
...
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
2024-02-12 18:03:17 +01:00
Samuel Gaist
08f62200b1
fix(c++): add missing explicit to single argument constructors
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 16:59:17 +01:00
dependabot[bot]
48a7f3bcb4
build(deps): Bump submodules/falcosecurity-rules
...
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules ) from `1053b2d` to `6ed2036`.
- [Release notes](https://github.com/falcosecurity/rules/releases )
- [Commits](1053b2d1b6...6ed2036d83
)
---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-02-12 14:55:16 +01:00
Federico Di Pierro
6c29fdb1e5
update(cmake): bumped falcoctl to v0.7.2.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-02-12 11:13:16 +01:00
Jason Dellaluce
0cc1c5b44f
refactor(userspace/engine): reduce allocations during rules loading
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-09 14:50:05 +01:00
Luca Guerra
d69f329b54
fix(ci): update sync in deb and rpm scripts with acl
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-09 10:33:04 +01:00
Samuel Gaist
a9e1bfef42
fix(c++): add missing overrides
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-09 08:24:03 +01:00
Federico Di Pierro
7879920570
chore(userspace/engine): introduce proper check to avoid future issues throwing an exception.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-02-08 15:13:59 +01:00
Federico Di Pierro
7bcbc08b52
fix(userspace/engine): always consider all rules (even the ones below min_prio) in m_rule_stats_manager.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-08 15:13:59 +01:00
Tom Müller
71f3c77a1a
fixed typo in print usage
...
fixed typo in the print usage description of the docker run command
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
2024-02-08 10:16:59 +01:00
Tom Müller
56a4e31d18
added option for insecure http driver download
...
added option for insecure http driver download to the falco docker entrypoint.
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
2024-02-08 10:16:59 +01:00
Tom Müller
159e3f6ffc
added insecure http driver download
...
added insecure http driver download to the driver-loader-legacy entrypoint.
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
2024-02-08 10:16:59 +01:00
Tom Müller
f62c38e9e8
added option for insecure http download
...
Added option for insecure http driver download in the docker-entrypoint.sh script. By passing --http-insecure to the container via an argument, the flag is forwarded to the falcoctl driver install command.
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
2024-02-08 10:16:59 +01:00
Luca Guerra
b091522398
new(build): prune deb-dev and rpm-dev directories
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-07 16:46:57 +01:00
RohithRaju
195116fa09
update(scripts): address review requests
...
Signed-off-by: RohithRaju <rohithraju488@gmail.com>
2024-02-07 14:31:57 +01:00
RohithRaju
1b9c2da601
update(CI): publish wasm package as dev-wasm
...
Signed-off-by: RohithRaju <rohithraju488@gmail.com>
2024-02-07 14:31:57 +01:00
Jason Dellaluce
039069d0e1
update(engine): bump engine version and checksum
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Jason Dellaluce
58f8f14a1b
fix(tests): solve last few compilation issues
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Jason Dellaluce
aca08ff744
update(cmake): bump libs and driver to 8df8817
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Jason Dellaluce
4cffcedba1
refactor: remove refs to gen_event class family
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Luca Guerra
0613f11980
fix(build): install libstdc++ in the Wolfi image
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-05 14:55:49 +01:00
Luca Guerra
ea67e47023
update(build): install libelf in the nodriver image
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
7d0001269c
update(build): include libelf in the distroless image
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
30df5738a5
update(build): disable musl builds
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
e3a3271c7a
update(ci): add libelf to build containers
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
b414b01aab
update(ci): allow version/static checks to work even if libelf is not installed
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
7d9cfd02e3
chore(falco): update engine checksum
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
8309d88595
new(build): build with dynamic libelf by default
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
Luca Guerra
871597f1fa
chore(build): update libs and drivers to 9cd289c
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-02 19:57:40 +01:00
dependabot[bot]
8acbbde600
build(deps): Bump submodules/falcosecurity-rules
...
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules ) from `3cac61c` to `1053b2d`.
- [Release notes](https://github.com/falcosecurity/rules/releases )
- [Commits](3cac61cfa9...1053b2d1b6
)
---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-02-01 10:28:37 +01:00
Roberto Scolaro
40f4ce008a
chore(engine): bump engine version
...
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2024-01-31 11:53:35 +01:00
Roberto Scolaro
3d06b77de5
chore(engine): update falco engine checksum
...
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2024-01-31 11:53:35 +01:00
Roberto Scolaro
fa6d380940
update: bump libs+driver to bfbc007
...
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2024-01-31 11:53:35 +01:00
Roberto Scolaro
9557b74501
fix: adopt new libsinsp logger
...
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2024-01-31 11:53:35 +01:00
Roberto Scolaro
ce87f2a014
refactor(userspace): remove libs relative imports
...
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2024-01-31 11:51:37 +01:00
Federico Di Pierro
41ee64e006
chore(ci): bumped rn2md to latest master.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-01-31 11:39:35 +01:00
dependabot[bot]
eccb5a6baa
build(deps): Bump submodules/falcosecurity-rules
...
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules ) from `3f668d0` to `3cac61c`.
- [Release notes](https://github.com/falcosecurity/rules/releases )
- [Commits](3f668d0568...3cac61cfa9
)
---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-01-31 09:52:34 +01:00
Mark Stemm
e1fb55e046
Add unit test for alternate rules loader
...
Add a unit test for providing an alternate rules loader that also
demonstrates how users can define sub-classes that may want to extend
the falco rules syntax.
This test creates a test rules reader/collector/compiler that supports
top-level objects "test_object". The reader reads them and saves them
in the collector. The compiler iterates over all test_objects and puts
the property values into a single set<string>.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-30 20:24:33 +01:00
Mark Stemm
1e0430dff9
Make compile_condition() a protected method for use in subclasses
...
Move the part of compile_rule_infos that actually compiled a condition
string into a sinsp_filter into a standalone method
compile_condition(). That way it can be used by classes that derive
from rule_loader::compiler() and want to compile condition strings.
This implementation also saves the compiled filter as a part of the
falco_rule object so it does not need to be compiled again wihin the
falco engine after rules loading.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-30 20:24:33 +01:00
Mark Stemm
88a57bfd1a
Add ability for rulesets to access falco engine state
...
Some rulesets may need information which is held by the falco_engine
that created this ruleset. So define a set of functions in a struct
and have setters/getters for those functions in the base class.
Derived classes can use the struct's functions to obtain the falco
engine information.
The only function so far is to obtain the filter_ruleset for a given
event source.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-30 20:24:33 +01:00
Mark Stemm
ce5a50cbb5
Add addl support for rules reader/compiler subclasses
...
To support subclasses that may extend the falco rules format, add
additional error/warning/item types for an extension item.
When subclasses report errors and warnings, they can use these
codes/item types in context objects and still provide an exact
line/column context.
Also make some previously static functions in rules reader protected
methods so they can be used in sub-classes.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-30 20:24:33 +01:00