github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 09:02:18 +00:00
Code Issues Projects Releases Wiki Activity
3,041 Commits 119 Branches 172 Tags 104 MiB
c81f3fc87e
Commit Graph

3041 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Di Donato
4b0333cc08 update(docker/falco): SKIP_MODULE_LOAD not supported anymore - use SKIP_DRIVER_LOADER 
When we started to implemented 20200506-artifacts-scope-part-2 proposal
, among a million other things, we renamed `SKIP_MODULE_LOAD` to
`SKIP_DRIVER_LOADER`. We reatained compatibility with `SKIP_MODULE_LOAD`
for a bunch of releases.

Now, after 9 months have passed I think it's time to completely
deprecate it.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-04-08 20:40:39 +02:00
Lorenzo Fontana
cdeafa6fdc docs(test): express that grpcurl and virtualenv are needed 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2021-04-08 17:32:02 +02:00
Leonardo Grasso
36378371ab update(test): update performance tests fixture URL 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-08 12:36:09 +02:00
Leonardo Grasso
aeca36bdaf update(test): update regression tests fixture URL 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-08 12:36:09 +02:00
Leonardo Grasso
7998560dcb chore(README): correct comments 
Applying suggestions from https://github.com/falcosecurity/falco/pull/1577

Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-07 16:45:50 +02:00
Leonardo Grasso
c587fadbce chore(scripts): typos 
Applying suggestions from
https://github.com/falcosecurity/falco/pull/1577

Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-07 16:45:50 +02:00
Leonardo Grasso
9e50e87ebc chore: remove "cleanup" script and job 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-04-07 16:45:50 +02:00
Mark Stemm
3da5dfa67b Properly parse numbers in condition fields 
Falco won't properly parse a rule like this:

---
- rule: Some Rule
  desc: Some Desc
  condition: evt.type=execve and container.image.repository = 271931939120.dkr
  output: Some output
  priority: INFO
---

This is the error when validating the rules:

Tue Mar 30 12:00:40 2021: Validating rules file(s):
Tue Mar 30 12:00:40 2021:    /home/mstemm/test.yaml
1 errors:
Compilation error when compiling "evt.type=execve and container.image.repository = 271931939120.dkr": 63: syntax error, unexpected 'dkr', expecting 'or', 'and'

The parsing of the string on the right hand side stops at the period
before the dkr. The dkr then doesn't match the grammar, resulting in the
error.

Looking at the parser implementation more closely, the problem is in the
definition of "Number":

---
-   Number = C(V "Hex" + V "Float" + V "Int") / function(n)
          return tonumber(n)
       end,
---
Note that it stops after the number, but does not have any requirement
about what follows.

This changes the definition of number to require that what follows the
number is not an identifier character. With this change, values that are
only numbers are parsed as numbers, and values that start with numbers
don't match the Number definition and are parsed as BareStrings instead.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-04-07 16:43:44 +02:00
Leo Di Donato
8c9d4f49d5 fix(falco/test): bump pyyaml from 5.3.1 to 5.4 
CVE-2020-14343 affects one of the dependencies the Falco (integration) test suite uses.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-30 14:47:01 +02:00
Leonardo Grasso
f2c12bbf9c fix(.circleci): tar must be present in the image 
Since `amazon/aws-cli` does not include the tar util (which must be present in the image, as per CircleCI requirement) we are switching from `amazon/aws-cli` to `centos`.

See
https://app.circleci.com/pipelines/github/falcosecurity/falco/1391/workflows/c1e1bc39-f008-4644-b8bf-45d1105e1978/jobs/11263

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-29 11:50:09 +02:00
Leonardo Grasso
0b69f210c4 fix(.circleci): correct job dependency 
The `publish/packages-deb-dev` failed because it wrongly required `tests/integration-static` (that has `/build-static` and `/source-static`) instead of `tests/integration` which comes with both `/build` and `/source`.

Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 18:31:11 +01:00
Leonardo Grasso
002a2e34dd fix(.circleci): tar package is required by circleci 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 18:31:11 +01:00
Leonardo Grasso
ef75c63e63 chore(scripts): print versions at the beginning 
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 14:54:53 +01:00
Leonardo Grasso
fb126cb730 feat(scripts): --clean option for falco-driver-loader 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
645f51b296 new(scripts): falco-driver-loader know the Falco version it has been 
built for

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
d912cf0d94 docs(scripts): falco-driver-loader outputs the Falco version it has been built for, also the driver version in use 
Both in the help/usage message and at running time.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
3f75f27410 docs(scripts): improve help of falco-driver-loader script 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Di Donato
1504e77f4e update(scripts): falco-driver-loader can now start with a custom driver name 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-26 14:54:53 +01:00
Leonardo Grasso
40edfe66ba fix(docker/no-driver): handle urlencoding 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
f800d4a101 docs: update links and badges for download.falco.org 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
4f1a2418fe build(.circleci): publish packages to S3 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
442011d07e build(.circleci): publish dev packages to S3 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
70ee1093d8 build(docker): fetch packages from download.falco.org 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
3936740390 build(scripts): add cloudfront invalidation for publishing scripts 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
9bc04fd02d build(scripts): publishing script for DEBs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
b6ac6de227 build(scripts): publishing script for RPMs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
Leonardo Grasso
5ebb653977 build(scripts): publishing script for bin packages 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-26 12:55:11 +01:00
stevenshuang
167c5bc691 fix: update rule description 
Signed-off-by: stevenshuang <stevenshuang521@gmail.com>
 2021-03-24 18:47:55 +01:00
Leonardo Di Donato
1ded30f173 update(test): tighten the condition to test the drops thresholds 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
7edd965a08 fix(test/confs): drop log messages are debug, fix the test fixture accordingly 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
920ab6982a new(test): test cases about wrong threshold drop config value 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
3842e07422 update(userspace/falco): drop messages are DEBUG level 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
7bc5fcf047 fix(userspace/falco): validate the drop threshold config value 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
199a1c22c6 fix(userspace/falco): n_evts does not containd the dropped events count 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
5380fe5308 new(test): test case about illogical drop actions 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
e3f7cdab20 update(userspace/falco): pass to sdropmgr the threshold 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
1714926cc6 update(userspace/falco): reduce noisiness 
The threshold governs the noisiness of the drops.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
4774e92bc2 refactor(userspace/falco): refactor the enum of drop actions into an enum class 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
a1b58d70a7 update(userspace/falco): grab the threshold configuration value + do not allow the ignore action to work with any other except the exit one 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Leonardo Di Donato
b8b50932fe update: reduce the max burst of event drops 
This also introduces a threshold configurable value.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-03-22 19:42:30 +01:00
Kaizhe Huang
7ea80e39b1 rule(Set Setuid or Setgid bit) update: add k3s-agent in the whitelist 
Signed-off-by: Kaizhe Huang <derek0405@gmail.com>
 2021-03-22 11:36:59 +01:00
Kaizhe Huang
b58f76b268 rule (Debugfs Launched in Privileged Container and Mount Launched in Privileged Container): create 
Signed-off-by: Kaizhe Huang <derek0405@gmail.com>
 2021-03-22 11:36:59 +01:00
JenTing Hsiao
b1801c28c7 Bump year to 2021 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
JenTing Hsiao
e1d3e68a84 Modprobe/rmmod at systemd service start/stop 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
JenTing Hsiao
5661b491af Removes the comments in systemd service files 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
JenTing Hsiao
39bb5c28c7 Migrate from init to systemd in debian package 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
JenTing Hsiao
3ba62a4031 Migrate from init to systemd in rpm package 
Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com>
 2021-03-12 10:45:31 +01:00
Shane Lawrence
2f0e09b549 rule (Write below monitored dir): Clean up and use glob matching. 
Signed-off-by: Shane Lawrence <shane@lawrence.dev>
 2021-03-12 10:37:16 +01:00
POCTEO
34bbe2984f Pocteo as an adopter 
Signed-off-by: Walid DRIDI <contact@pocteo.co>
 2021-03-11 16:58:59 +01:00
Leonardo Grasso
825e6caf2d build: fetch build deps from download.falco.org 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-03-10 18:00:52 +01:00