github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 09:02:18 +00:00
Code Issues Projects Releases Wiki Activity
1,860 Commits 119 Branches 172 Tags 104 MiB
a72f27c028
Commit Graph

1860 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
danmx
4df5fe83be update(cmake): using sha256 instead of md5 
Signed-off-by: danmx <daniel@iziourov.info>
 2020-03-27 00:34:54 +01:00
kaizhe
e1cb2e9bb0 rule(Detect outbound connections to common miner pool ports): whitelist sysdig/agent and falcosecurity/falco for query miner domain dns 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-27 00:33:24 +01:00
Leonardo Di Donato
09b87b9a3d fix(test): use .falco dir 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Lorenzo Fontana
a9658d446f fix(test): urrlib from python 2 to 3 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
fbcdb57cea update(docker): entrypoints to call falco-driver-loader now 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
b3998a6b44 build(scripts): insert versions into falco-driver-version and install it 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
b39f322994 fix(scripts): falco-probe-loader becomes falco-driver-loader and distinghuishes driver version from falco version 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
c1d840d471 update(test): account only for falco version in tests, not driver version 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
d3a215a2db new(userspace/falco): return also driver version from --version flag 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
3934f19f3d build: cmake var to store the URL where to lookup for prebuilt drivers 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
7f9d3ca422 fix(.circleci): ensure stable docker images (packages built from tag) have exact FALCO_VERSION env variable 
This avoids `FALCO_VERSION` variable to be equal to `latest` while
`falco --version` correctly returns 0.21.0

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
c1c9ba56ac fix(.circleci): ensure docker images (packages built from master) have correct FALCO_VERSION env variable 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
7b44aafc6a ci: avoid stable releases to be published to *-dev repositories too 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Leonardo Di Donato
a56803e3c7 ci: override package update 
It may been necessary to override a Falco version package update since
the release process stopped for causes not depending on itself.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Leonardo Di Donato
ce5bc89698 ci: upsert versions on git tag (release) 
It can happen that bintray API is unresponsibe. In this case, we may
need to re-run the CI job manually and be able to not be blocked by
already created versions for the a given git tag.
Same for _developmen_ releases (from master).

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Lorenzo Fontana
ea46adfbc8 new(userspace/falco): add --disable-cri-async flag 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-18 16:23:19 +01:00
Lorenzo Fontana
c5674c9001 build: fix tbb dependency rename 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-18 04:07:47 -07:00
Kris Nova
1cbe0b27bb docs(readme): adding new release archive 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-03-17 21:48:31 +01:00
Lorenzo Fontana
9db36822e7 update(docker/tester): python 3 support for regression tests 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-17 21:24:31 +01:00
Leonardo Di Donato
5909eac307 fix(.circleci): remove --labels flag from circleci 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 18:30:41 +01:00
Leonardo Di Donato
f69c419940 fix(.circleci): remove github tag rel nots flag (not working) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 17:57:22 +01:00
Leonardo Di Donato
10e4983297 fix(.circleci): to create stable versions bintray secret and user are needed 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 16:45:18 +01:00
Leonardo Di Donato
9e69972ec4 docs: highlight breaking change in the changelog for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
87e8457ce7 docs: bump versions to 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
56ccdf29c8 docs: CHANGELOG for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Mark Stemm
2126616529 Fix image for event generator deployment yaml 
I had a bug in https://github.com/falcosecurity/falco/pull/1088 where
the image name for the event generator was pointing to a temporary tag
instead of latest. This switches the image name back to latest.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 21:32:24 +01:00
Hiroki Suezawa
3067af566e rule(Change thread namespace): fix regression test 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Hiroki Suezawa
742538ac86 rule(Change thread namespace): change condition to detect suspicious container activity 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Mark Stemm
6488ea8456 (WIP) K8s Deployment to run event generator w k8s_audit 
Add a deployment yaml that allows running the event generator in a k8s
cluster:

 - Change the event generator to create/delete objects in a namespace
   "falco-eg-sandbox" instead of "falco-event-generator". That way you
   separate the generator from the resources it modifies (mostly, the
   exception being the rolebinding).
 - Create a serviceaccount, clusterrole, and rolebinding that allows the
   event generator to create/list/delete objects in the falco-eg-sandbox
   namespace. The list of permissions is fairly broad mostly so the
   event generator can delete all resources without explicitly naming
   them. The binding does limit permissions to the falco-eg-sandbox
   namespace, though.

A one-line way to run this would be:

kubectl create namespace falco-event-generator && \
  kubectl create namespace falco-eg-sandbox && \
  kubectl apply -f event-generator-role-rolebinding-serviceaccount.yaml && \
  kubectl apply -f event-generator-k8saudit-deployment.yaml

I haven't actually pushed a new docker image to replace the current
event generator yet--the deployment yaml refers to a placeholder
falcosecurity/falco-event-generator:eg-sandbox image. Once the review is
done I'll rebase this to change the image to latest before merging.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Mark Stemm
3fd67aa5c3 K8s Daemonset to run event generator w/ syscalls 
Add a Daemonset yaml that allows running the falco event generator on
syscalls. It will run on any non-master node.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Vicente Herrera
085009ad93 Fixed use of "tag" instead of "tags" in default rules 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
 2020-03-10 20:51:45 +01:00
Leonardo Di Donato
788d3294bd chore: re-enabling package build, sign, and docker push from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
de5cd1ce6f update(docker): latest or explicit FALCO_VERSION for docker images via docker build argument 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
4d4a2af8b6 chore: temporary test for circleci 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
36501c5f1d new(cmake/modules): provide and parse FALCO_VERSION_PRERELEASE too 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Lorenzo Fontana
123a75062e build: passing driver checksum down to download makefile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-10 18:00:04 +01:00
Lorenzo Fontana
74b0e18253 build: PROBE_VERSION must use the driver version 
The driver version was also setup in the wrong cmake file.

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-10 18:00:04 +01:00
Lorenzo Fontana
aef06f1dda fix(.circleci): fix get falco version for image build 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 20:46:48 +01:00
Lorenzo Fontana
6711abf3d7 fix(.circleci): build args for minimal dockerfile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 11:53:28 +01:00
Lorenzo Fontana
941313b1f1 fix(docker/minimal): untar of downloaded falco package 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-06 11:53:28 +01:00
Kris Nova
210da83402 docs: updating branding 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-03-05 10:58:43 +01:00
Leonardo Di Donato
8481b94f4c fix(.circleci): docker minimal images need exact FALCO_VERSION 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-04 09:30:13 +01:00
kaizhe
4a8d8a049f add comments 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-04 09:28:43 +01:00
kaizhe
b4f2fdc439 disable cryptomining rule by default; add exception of localhost and rfc1918 ip addresses 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-04 09:28:43 +01:00
Leonardo Di Donato
1c74c68ff3 fix(.circleci): dockerhub authentication during releasing process 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 21:16:26 +01:00
Leonardo Di Donato
e637b1ebbc update(.circleci): build and publish from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
f4c152a216 fix(.circleci): sign RPMs 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
906585d31a new(.circleci): build and publish docker images 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
272bb59df4 update(docker): reorganize docker images with build arguments 
Using the VERSION_BUCKET build arguments at docker build time users can now choose from which Falco version to build them.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00
Leonardo Di Donato
fae4bcf9ae fix(.circleci): expect script needs eof 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-02-28 17:32:38 +01:00