github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 07:37:32 +00:00
Code Issues Projects Releases Wiki Activity
2,762 Commits 121 Branches 172 Tags 104 MiB
b5870a8656
Commit Graph

2762 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Frederico Araujo
5b99c0d481 refactor(build): moved Dockerfile and entrypoint script for UBI-based image to its own directory 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
7c85349674 fix(docker/readme): fix grammatically incorrect split of infinitive 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
9aa9ad9ee0 build(image): added label for ubi version and updated description labels 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
Frederico Araujo
b18f2084c0 build(image): fixed handling of default falco version 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
 2022-03-23 15:39:03 +01:00
TPT
dc5b332cd1 build(image): simplified untarring command to install falco binary and scripts in ubi 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
TPT
5b7260f706 build(image): updated UBI image to build dkms, and use falco binaries rather than rpm. This reduces dependencies. 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
TPT
dc40f82318 build(image): added falco ubi Dockerfile to provide a falco ubi image 
Signed-off-by: TPT <teryl.taylor@gmail.com>
 2022-03-23 15:39:03 +01:00
Jason Dellaluce
9607cbc2c7 update(build): temporarely bump cloudtrail and json plugin version to dev builds 
This is required due to the plugin API version being bumped to 1.0.0 in the framework after
the recent breaking changes. cloudtrail and json will be switched back to a stable build
once they get released to require the plugin API version with the newest major.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Jason Dellaluce
481e32cab9 update(build): bump libs version to caa0e4d0044fdaaebab086592a97f0c7f32aeaa9 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Mark Stemm
df219b5e1d New tests for rule + exception, macro with unknown source 
Add new test cases for a rule with an unknown source *and* an
exception, and a macro with an unknown source.

The first results in a rule warning (and no error), and the second
prints an error and skips.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00
Mark Stemm
3fbc90e99e Skip macros with unknown sources 
Also skip macros with unknown sources. This matters primarily for
macros related to plugins that have a distinct event source.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00
Mark Stemm
ad42baed7a Check for unknown sources earlier (to handle exceptions) 
If a rule has an unknown source, *and* has exceptions, loading the
rule will result in an error and not skipping the rule. This is
because exceptions are also validated for unknown fields, and that
occurs before the current check for unknown sources.

The fix is to move the check for unknown sources as soon as the rules
object is read.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00
Leonardo Grasso
31111ab87b docs(README.md): update slack channel URLs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-17 17:10:30 +01:00
Leonardo Grasso
7d6b46218f docs(brand): add plugin definition 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-17 17:10:30 +01:00
Leonardo Grasso
fded42c203 docs(README.md): adding plugins 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-17 17:10:30 +01:00
Leonardo Grasso
5ff9101b95 docs(README.md): moving section on top 
I am co-authoring original authors to keep their credits.

Co-Authored-by: Kris Nova <kris@nivenly.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Co-Authored-By: Massimiliano Giovagnoli <massimiliano.giovagnoli.1992@gmail.com>
Co-Authored-By: Jonah Jones <jonahjones094@gmail.com>
Co-Authored-By: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-17 17:10:30 +01:00
Matt Moyer
36acd6dfbf Add user_known_mount_in_privileged_containers 
This adds a new macro `user_known_mount_in_privileged_containers` which
allows the easier user-defined exclusions for the "Mount Launched in
Privileged Container" rule.

This would be cleaner with the exclusions feature, but this feature
is not used in the default ruleset yet, if I understand correctly.

Signed-off-by: Matt Moyer <mmoyer@figma.com>
 2022-03-17 10:50:56 +01:00
Luca Guerra
4819748ab0 fix(cli): update markdown description 
Signed-off-by: Luca Guerra <luca@guerra.sh>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-03-17 10:41:56 +01:00
Luca Guerra
f7a5dd0d5b new(falco): add CLI option to print docs in markdown format 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-03-17 10:41:56 +01:00
Claudio Vellage
4705a92c49 Allow to whitelist config modifiers 
Signed-off-by: Claudio Vellage <claudio.vellage@pm.me>
 2022-03-15 22:32:59 +01:00
Luca Guerra
a5d3663c75 update(changelog): add link to security fix for 0.31.1 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-03-11 18:59:56 +01:00
Luca Guerra
58b6496f51 docs(CHANGELOG.md): Changelog for 0.31.1 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-03-09 17:52:02 +01:00
Luca Guerra
9dd85bf9db fix(cli): restore behavior of -pc -pm -pk CLI options 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-03-08 09:00:10 +01:00
Luca Guerra
6c4b267109 chore(build): update falco libs to b7eb0dd 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-03-04 10:48:49 +01:00
Josh Soref
7c005aa9dc spelling: workaround 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
2f2c5c4a9b spelling: whether 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
aadb76f2e9 spelling: validating 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
23f4f0eee0 spelling: unusual 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
97373a8b6e spelling: unknown 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
4ecb907223 spelling: unambiguously 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
db30d0e1c7 spelling: triggered 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d173ab7a9e spelling: trailing 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
e4e8dcf06b spelling: third 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
e8aac31890 spelling: themselves 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
073339eff1 spelling: the 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
001e7557e6 spelling: the extraction 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
73f98de005 spelling: that 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
3760155ec8 spelling: temporarily 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d8cfaee242 spelling: syntactic 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
e173bf89a3 spelling: suspicious 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
f12149dc87 spelling: superseded 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
19a6cf74f8 spelling: successfully 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
c62cc5e8c0 spelling: substituted 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
ead40f898a spelling: separate 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
8eef71b801 spelling: rules 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
97883e7535 spelling: resolutions 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
4f897e0dc0 spelling: readability 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
d0ee656dac spelling: provided 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
49b88c14b2 spelling: processing 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
9a314d9443 spelling: privileged 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00