github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-05 02:47:05 +00:00
Code Issues Projects Releases Wiki Activity
1,358 Commits 117 Branches 173 Tags 104 MiB
b6fec781b7
Commit Graph

1358 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Stemm
b6fec781b7 Add support for parsing "intersects" operator 
Related to the changes in https://github.com/draios/sysdig/pull/1501,
add support for an "intersects" operator that verifies if any of the
values in the rhs of an expression are found in the set of extracted
values.

For example:

  (a,b,c) in (a,b) is false, but (a,b,c) intersects (a,b) is true.

The code that implements CO_INTERSECTS is in a different commit.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2019-10-15 19:45:31 +02:00
Leo Di Donato
6019320f9d chore(proposals): apply code review about PSP rules proposal 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-14 13:59:15 +02:00
Mark Stemm
161b46474d Proposal for adding PSP Rules Support 
Separate from the PR that actually makes the changes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2019-10-14 13:59:15 +02:00
Leonardo Di Donato
f71c4f0bfd update: refer to latest probeinstaller library in falcoctl/pkg 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-11 19:43:56 +02:00
Lorenzo Fontana
7dc62b3119 docs: reflect the changes to probeloader docker images 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-11 19:43:56 +02:00
Lorenzo Fontana
707cdb5184 chore(docker/minimal): fix typo and set 0.17.1 as base 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-11 19:43:56 +02:00
Lorenzo Fontana
3c30ad9d38 chore(docker/kernel/linuxkit): reformat dockerfile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-11 19:43:56 +02:00
Lorenzo Fontana
0c6d21eca4 update: httploader now is named probeloader and uses the falcoctl 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-11 19:43:56 +02:00
Lorenzo Fontana
af27c2bea5 chore: remove http loader code 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-11 19:43:56 +02:00
Michael Ducy
b49ade5627 use COPY not ADD 
Signed-off-by: Michael Ducy <michael@ducy.org>
 2019-10-11 19:43:56 +02:00
Michael Ducy
5a703ddbb8 updates based on code review rnd 1 
Signed-off-by: Michael Ducy <michael@ducy.org>
 2019-10-11 19:43:56 +02:00
Michael Ducy
01abe71256 add init container module loader 
Signed-off-by: Michael Ducy <michael@ducy.org>
 2019-10-11 19:43:56 +02:00
Michael Ducy
ac8204dc30 Initial try at slimmer images 
Signed-off-by: Michael Ducy <michael@ducy.org>
 2019-10-11 19:43:56 +02:00
Yathi Naik
49030af988 Added more context on Sysdig Secure in Adopters.md 
Signed-off-by: Yathi Naik <yathi@sysdig.com>
 2019-10-10 12:59:03 +02:00
Benjamin
4e6d347e43 Add k8s deployment yaml files for audit purpose only 
Signed-off-by: Benjamin <benjamin@yunify.com>
 2019-10-09 16:31:03 +02:00
Felipe Bessa Coelho
8353a0b22e Ignore sensitive mounts from ecs-agent 
Without this, as ecs-agent starts we get a bunch of errors that look
like this (reformatted for readability):

  Notice Container with sensitive mount started (
    user=root
    command=init -- /agent ecs-agent (id=19d4e98bb0dc)
    image=amazon/amazon-ecs-agent:latest
    mounts=/proc:/host/proc:ro:false:rprivate,$lotsofthings
  )

ecs-agent needs those to work properly, so this can cause lots of false
positives when starting a new instance.

Signed-off-by: Felipe Bessa Coelho <fcoelho.9@gmail.com>
 2019-10-09 16:30:36 +02:00
Mark Stemm
1d1ecd9905 Add explicit catch2 dependency for tests 
When I try to build the dev branch using the docker builder, the tests
target isn't properly checking out and building catch2 for the
dependency catch2.hpp. Adding this explicit dependency allowed the build
to succeed.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2019-10-08 16:12:18 +02:00
Leo Di Donato
aaff21106d update(.github): proposals area into PR template 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-08 16:11:43 +02:00
Lorenzo Fontana
c76518c681 update: license headers 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-10-08 16:02:26 +02:00
Leo Di Donato
0043c4937b docs: update COPYING 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-08 16:02:26 +02:00
Fahad Arshad
b951f2bb7d fix(permissions): Restrict the access to /dev on underlying host to read only (with rbac) 
Signed-off-by: Fahad Arshad <fahad.arshad@hobsons.com>
 2019-10-08 12:17:27 +02:00
Fahad Arshad
fcd1d60657 fix(permissions): Restrict the access to /dev on underlying host to read only 
Signed-off-by: Fahad Arshad <fahad.arshad@hobsons.com>
 2019-10-08 12:17:27 +02:00
Mark Stemm
2bc4bfd7fb Specify namespace compat w/ gcc 5 
I wasn't able to compile the dev branch with gcc 5.4 (e.g. not using the
builder), getting this error:

```
.../falco/userspace/falco/grpc_server.cpp:40:109: error: specialization of ‘template<class Request, class Response> void falco::grpc::request_stream_context<Request, Response>::start(falco::grpc::server*)’ in different namespace [-fpermissive]
 void falco::grpc::request_stream_context<falco::output::request, falco::output::response>::start(server* srv)
                                                                                                             ^
In file included from .../falco/userspace/falco/grpc_server.cpp:26:0:
.../falco/userspace/falco/grpc_server.h:102:7: error:   from definition of ‘template<class Request, class Response> void falco::grpc::request_stream_context<Request, Response>::start(falco::grpc::server*)’ [-fpermissive]
  void start(server* srv);
```

It looks like gcc 5.4 doesn't handle a declaration with namespace blocks
but a definition with namespaces in the
function. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56480 has more
detail.

A workaround is to add `namespace falco {` and `namespace grpc {` around
the declarations.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2019-10-04 11:43:28 +02:00
Leonardo Di Donato
db3383180c docs(userspace/falco): documenting the keepalive field of the outputs request 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-03 11:55:04 +02:00
kaizhe
cdb5d71eb6 rule update: add more comments 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2019-10-03 10:16:28 +02:00
kaizhe
e81decac13 rule update: fix missing entries 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2019-10-03 10:16:28 +02:00
kaizhe
a43ae037a9 rules update: add back rule Delete Bash History for backport compatibility 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2019-10-03 10:16:28 +02:00
Kris Nova
b2a57f376e removing maintainers file 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2019-09-30 12:17:59 -07:00
Leonardo Di Donato
8a6c0b796c fix(userspace/engine): guard lua state into falco engine 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-30 18:07:19 +02:00
Leonardo Di Donato
f0cd3344a2 fix(userspace/falco): guard lua state for falco outputs 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-30 18:07:19 +02:00
Lorenzo Fontana
3d8b7231f3 fix(userspace/falco): meta request should use the request field 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-30 16:55:24 +03:00
Lorenzo Fontana
221e1b53aa fix(userspace/falco): remove redundant check for grpc outputs 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-30 16:55:24 +03:00
Lorenzo Fontana
b08341644a update(changelog): prepare for v0.17.1 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-26 16:14:25 +02:00
kaizhe
79a10ad90e rules update: add fluent/fluentd-kubernetes-daemonset to clear log trusted images 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2019-09-26 13:56:59 +03:00
Leonardo Di Donato
c0721b3ac2 docs: document gRPC server and gRPC output service config options 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
98cdc30aa3 chore(userspace): addressing review comments and typos 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
732965f973 docs(userspace/falco): document output proto messages and service 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
905379c6da update(userspace/falco): specify go packages into protobuf 
Co-authored-by: Lorenzo Fontana <lo@linux.com>

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
e6deb59e3d chore(userspace/falco): we don't support tags yet 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
eb8248fe04 chore(userspace/falco): better organization of schema and grpc server 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
6cf2ccf857 update(userspace/falco): falco_grpc_server is now just server 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
203226d347 new(userspace/falco): namespace for falco grpc 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
392499f024 new(userspace/falco): utils file definition with read function 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
b19cb3678f fix(userspace/falco): pop output fields lua table and correctly check parameters on the stack 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
54b3aa9129 fix(userspace/falco): distinguish between sinsp and json events when resolving tokens 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
944b46cb67 new(userspace/engine): json event to map type 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Lorenzo Fontana
0565ce2f50 fix(userspace/falco): grpc server implementation subscribe handle output queue stop 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
d35971e1bc update(userspace/engine): resolve token 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
836094b28e chore: typos and miscellanea 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00
Leonardo Di Donato
c96f096821 new(userspace/falco): config certificates for the gRPC server 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 16:43:32 +03:00