github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-02-21 14:13:27 +00:00
Code Issues Projects Releases Wiki Activity
5,066 Commits 123 Branches 184 Tags
b511b54d216750fb5ae319a1993d7bc2e36b37b9
Commit Graph

255 Commits

Author SHA1 Message Date
Leonardo Di Giovanna
387499546f chore!: drop legacy BPF probe 
Falco 0.43.0 deprecated the legacy eBPF probe. Drop it as well as any
reference to it.

BREAKING CHANGE: drop legacy eBPF probe

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2026-02-05 13:15:54 +01:00
Leonardo Di Giovanna
d0b6c138f9 docs: add deprecation notice for legacy eBPF in pkg install dialog 
DEPRECATION NOTICE: add deprecation notice for legacy eBPF in pkg
  install dialog

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2026-01-23 14:14:47 +01:00
cannarelladev
9324799b1a fix: add update_repo to publish-rpm script 
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
 2026-01-19 18:58:18 +01:00
Leonardo Grasso
929b27b897 fix: consolidate RPM signing logic into publish-rpm 
Co-authored-by: irozzo-1A <iacopo@sysdig.com>
Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2026-01-19 16:36:17 +01:00
Leonardo Grasso
6a152d338b chore(scripts/falcoctl): increase follow interval to 1 week 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-12-18 18:27:12 +01:00
Iacopo Rozzo
c9e920b1f7 chore(falcoctl): update falco rules to version 5 
Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
Co-authored-by: Leonardo Grasso <leonardo.grasso@sysdig.com>
Co-authored-by: Leonardo DiGiovanna <leonardo.digiovanna@sysdig.com>
 2025-10-21 15:05:42 +02:00
Luca Guerra
8f86f20d17 chore(build): update falcoctl, rules for artifact follow 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2025-05-27 16:53:12 +02:00
Federico Di Pierro
cd81c52dde chore(docker,scripts): moved scripts/falco to config/ folder. 
Updated dockerignore to point to whole config folder.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-12 18:13:06 +01:00
Federico Di Pierro
050431425f cleanup(scripts): drop unmaintained and useless script. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-12 18:13:06 +01:00
Federico Di Pierro
3d70a2cbd0 new(docker,scripts,ci): use an override config file to enable ISO 8601 output timeformat on docker images. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-12 18:13:06 +01:00
Poiana
50b98b30e5 chore(falco): apply code formatting 
Signed-off-by: Poiana <poiana.bot@gmail.com>
 2024-09-30 13:25:31 +02:00
Leonardo Di Giovanna
d66c4ceb23 update(systemd): add falco.service alias to all systemd units 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2024-09-18 15:44:53 +02:00
Luca Guerra
b5461e11a7 new(ci): sign .tar.gz packages 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-17 10:17:56 +02:00
Federico Di Pierro
bdcfbba90b chore(docker,scripts): set old eBPF probe as lowest priority driver. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-18 11:18:54 +02:00
Federico Di Pierro
ac61543276 fix(docker,scripts): do not load falcoctl driver loader when installing Falco deb package in docker image. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-15 17:22:44 +02:00
Federico Di Pierro
7cc57a9fa0 docs(scripts): leave a small comment. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-15 15:13:44 +02:00
Federico Di Pierro
2ede48ccfc chore(scripts): updated debian and rpm post installation scripts to deal with new automatic driver selection as default behavior. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-15 15:13:44 +02:00
Federico Di Pierro
53d13f8bfc chore(scripts): dynamically set falcoctl allowed driver types based on cmake configuration. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-15 15:13:44 +02:00
Federico Di Pierro
2eb519380a update(cmake,scripts): bumped falcoctl to v0.8.0-rc1. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-15 15:13:44 +02:00
Aldo Lacuku
185075bfd8 update(scrips/falcoctl): bump falco-rules version to 3 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2024-03-06 07:35:54 +01:00
Luca Guerra
d69f329b54 fix(ci): update sync in deb and rpm scripts with acl 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-09 10:33:04 +01:00
Luca Guerra
b091522398 new(build): prune deb-dev and rpm-dev directories 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-07 16:46:57 +01:00
RohithRaju
195116fa09 update(scripts): address review requests 
Signed-off-by: RohithRaju <rohithraju488@gmail.com>
 2024-02-07 14:31:57 +01:00
RohithRaju
1b9c2da601 update(CI): publish wasm package as dev-wasm 
Signed-off-by: RohithRaju <rohithraju488@gmail.com>
 2024-02-07 14:31:57 +01:00
Federico Di Pierro
96f50ddac5 chore(scripts): integrate back master changes FALCO_DRIVER_CHOICE and FALCOCTL_ENABLED . 
Also, env variables always have precedence over dialog (ie: if they are set, we always skip dialog).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Federico Di Pierro
ade27c2546 chore(scripts): use new default value for falcoctl driver.host-root config key. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Federico Di Pierro
1dd47668dd chore(scripts): only configure falcoctl driver type when a driver is selected. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Federico Di Pierro
33451cf0bc fix(scripts): fixed driver names for new falcoctl/Falco naming. 
But keep old systemd units names to avoid a breaking change.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Federico Di Pierro
27161bb508 chore(scripts/systemd): properly make use of new config keys in systemd units. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Federico Di Pierro
be100f7ad5 new(docker,scripts): dropped falco-driver-loader in favor of new falcoctl driver command. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-12-11 16:37:39 +01:00
Vicente J. Jiménez Miras
13991f1ea7 Add use of FALCO_DRIVER_CHOICE and FALCOCTL_ENABLED env vars 
Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
 2023-12-06 10:13:25 +01:00
Leonardo Grasso
fe50ac22ee update: add SPDX license identifier 
See https://github.com/falcosecurity/evolution/issues/318

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-09-21 13:21:47 +02:00
hjenkins
63ba15962b fix(scripts): falco-driver-loader add print env 
Fixes #2352

Needed to refactor the target_id code paths to allow this to be used in
env printing and sourcing.

Signed-off-by: hjenkins <henry@henryjenkins.name>
 2023-08-31 12:10:28 +02:00
jabdr
66841d8009 Support reload in falco-modern-bpf.service 
Signed-off-by: jabdr <jd@q321.de>
 2023-08-30 15:28:26 +02:00
jabdr
43ae8b0cac Support reload in falco-custom.service 
Signed-off-by: jabdr <jd@q321.de>
 2023-08-30 15:28:26 +02:00
jabdr
9a5f625d5f Support reload in falco-bpf.service 
Signed-off-by: jabdr <jd@q321.de>
 2023-08-30 15:28:26 +02:00
jabdr
799c09e638 Support reload in falco-kmod.service 
Signed-off-by: jabdr <jd@q321.de>
 2023-08-30 15:28:26 +02:00
Andrea Terzolo
ba1528e3c2 cleanup: remove unused --pidfile option 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-08-28 17:06:19 +02:00
Jason Dellaluce
527c42c030 chore: polish conditional compilation flags for emscripten 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-08-24 10:30:40 +02:00
Jason Dellaluce
0faa45669b update(build): setup cpack for emscripten build 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Rohith Raju <rohithraju488@gmail.com>
 2023-08-24 10:30:40 +02:00
Johanan Liebermann
e7c5139563 Allow specifying kernel release and version 
Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>
 2023-08-24 09:17:39 +02:00
Johanan Liebermann
f4c8833a0e Relocate tools on Flatcar in BPF mode 
In https://github.com/falcosecurity/falco/pull/2043 we've added logic
for relocating tools on Flatcar when running falco-driver-loader in kmod
mode. This logic is relevant for BPF mode, too, which is currently
broken on Flatcar. Call flatcar_relocate_tools in BPF mode, too.

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>
 2023-08-21 10:48:20 +02:00
Federico Di Pierro
fbcb971751 fix(scripts): fix falco-driver-loader for debian. 
Support debian `rt` and `cloud` flavors.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-06-23 16:14:59 +02:00
Roberto Scolaro
c2af4c3a21 fix(scripts/falco-driver-loader): fixed ubuntu kernel version 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2023-06-22 15:17:55 +02:00
Federico Di Pierro
577bccabd0 new(scripts): updated falco-driver-loader to properly support talos. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-05-16 16:49:55 +02:00
jabdr
f25c057ce8 Remove MAKEWRAPPER var 
Signed-off-by: jabdr <jd@q321.de>
 2023-05-04 13:14:32 +02:00
jabdr
e1492ae9df Use TMPDIR for falco-driver-loader 
Signed-off-by: jabdr <jd@q321.de>
 2023-05-04 13:14:32 +02:00
jabdr
b83b1e2578 falco-driver-loader add TMPDIR support 
Closes 2517
Make wrapper now uses $TMPDIR if set.

Signed-off-by: jabdr <jd@q321.de>
 2023-05-04 13:14:32 +02:00
Federico Di Pierro
53c9f3a743 fix(scripts): fix falco-driver-loader for some debian kernels. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-04-27 11:46:14 +02:00
Federico Di Pierro
0d73f9624d update(scripts): updated falco-driver-loader to support al2022 and al2023. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-04-14 20:00:08 +02:00