github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-14 23:14:41 +00:00
Code Issues Projects Releases Wiki Activity
3,344 Commits 118 Branches 173 Tags 104 MiB
ca55e70a33
Commit Graph

3344 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Grasso
935d9f5378 fix(docker/no-driver): enable time_format_iso_8601 by default 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Leonardo Grasso
2345ea2770 new(docker): add falco-no-driver image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Leonardo Grasso
901239c3c8 docs(docker): add falcosecurity/falco-no-driver image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 18:59:29 +02:00
Lorenzo Fontana
d0f4f7cbb5 docs(tests): fix typo 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00
Lorenzo Fontana
d67b3f5577 docs(CONTRIBUTING): mention the unit test page on CONTRIBUTING 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00
Lorenzo Fontana
1d43d4eb40 build(tests): allow to pass FALCO_TESTS_ARGUMENTS to the tests target 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00
Lorenzo Fontana
e9e2547a44 docs(tests): initial unit-tests readme 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-14 15:02:15 +02:00
Leonardo Grasso
0f23a9477f update(docker/OWNERS): add myself to approvers 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 14:09:46 +02:00
Leonardo Grasso
9242c45214 update(examples): move /examples to contrib repo 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-14 12:54:09 +02:00
Leonardo Grasso
ede2ef8706 update(integration): move /integration to contrib repo 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-13 15:15:40 +02:00
Leonardo Grasso
0c4074b7a9 update(docker): remove minimal image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-13 10:39:07 +02:00
Leonardo Grasso
05c684d68c test: add bin package (tar.gz) to integration test 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 19:22:49 +02:00
Leonardo Grasso
a520a9b666 update(proposals/20200506-artifacts-scope-part-2.md): resolution about image naming 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
9393ae9e03 fix(proposals/20200506-artifacts-scope): typos 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
fcd2849a5d update(proposals/20200506-artifacts-scope): refinements 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

As per https://github.com/falcosecurity/falco/pull/1184/files#r420856406
 2020-05-12 18:53:46 +02:00
Leo Di Donato
c7573c3db9 update(proposals/20200506-artifacts-scope-part-2): refinements to the future SoA of Falco artifacts and images 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-12 18:53:46 +02:00
Leo Di Donato
737ef557ae update(proposals/20200506-artifacts-scope-part-1): improvements to SoA of Falco artifacts and images 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-authored-by: Lorenzo Fontana <lo@linux.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
078c98f847 docs(proposal): split artifacts scope proposal in 2 parts 
Still some TODOs

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
63eafd2ff8 docs(proposals/20200504-falco-artifacts-scope.md): update from review 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
69714a8124 fix(proposals/20200504-falco-artifacts-scope.md): minor fixes 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
b6bbc27e57 feat(docs): "Official Support" is the highest and most coveted status. 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
df3fc73e55 feat(docs): Updating proposal with new vernacular 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
b9bf985fae feat(proposal): Adding artifacts scope and proposal 
- Highlights scope of Falco
 - Highlights subprojects and groups evolution
 - Defines build artifacts
 - Defines artifact naming convention
 - Dictates that we take action to make these changes happen

Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
Mark Stemm
8adcc95bac Add unit tests for ruleset handling 
A new unit test file test_rulesets adds tests for the following:

 - enabling/disabling rules based on substrings
 - enabling/disabling rules based on exact matches
 - enabling/disabling rules based on tags

There are variants that test for default and non-default rulesets.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-11 14:15:42 +02:00
Mark Stemm
176d6f2bfe Make token bucket unit test pass valgrind 
Previously, valgrind was complaining about the leaked token bucket.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-11 14:15:42 +02:00
Mark Stemm
7fd350d49a Allow exact matches for rule names 
Currently, when calling enable_rule, the provided rule name pattern is a
substring match, that is if the rules file has a rule "My fantastic
rule", and you call engine->enable_rule("fantastic", true), the rule
will be enabled.

This can cause problems if one rule name is a complete subset of another
rule name e.g. rules "My rule" and "My rule is great", and calling
engine->enable_rule("My rule", true).

To allow for this case, add an alternate method enable_rule_exact() in
both default ruleset and ruleset variants. In this case, the rule name
must be an exact match.

In the underlying ruleset code, add a "match_exact" option to
falco_ruleset::enable() that denotes whether the substring is an exact
or substring match.

This doesn't change the default behavior of falco in any way, as the
existing calls still use enable_rule().

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-05-11 14:15:42 +02:00
Leonardo Grasso
900a3b5860 refactor(docker): driverloader to falco-driver-loader 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-08 18:08:03 +02:00
Leonardo Di Donato
3991552553 update(cmake/modules): bump driver version to 96bd9bc560f67742738eb7255aeb4d03046b8045 
This driver version contains a fix for kernels < 3.17

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-06 20:35:31 +02:00
Leonardo Grasso
83d5ce4d58 fix(.circleci): correct driverloader's base tag 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 15:05:53 +02:00
Leonardo Grasso
2e703f0565 refactor(docker/driverloader): rename build arg 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 15:05:53 +02:00
Leonardo Grasso
24c0e80bd8 chore(docker): clean up unused set -e 
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 11:27:38 +02:00
Leonardo Grasso
5e421c9ac4 docs(docker): add driverloader into supported images 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 11:27:38 +02:00
Leonardo Grasso
6a20526c4b update(.circleci): add steps to build and publish the driverloader image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 11:27:38 +02:00
Leonardo Grasso
63259f3885 new(docker/driverloader): docker image to load the driver 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-04 11:27:38 +02:00
Lorenzo Fontana
9909af8bfb fix(scripts): fix ignored calls script to use the new paths 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-05-01 19:06:51 +02:00
Leonardo Di Donato
03670680ed fix(cmake/modules): update driver to support kernels 5.6.y 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-30 20:11:57 +02:00
Lorenzo Fontana
0d34394817 fix: grpc compilation with splitted gpr library 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-04-30 08:31:02 -07:00
Stuxend
e51ee60646 fixing curl command error 0 bytes for CDN download. 
Signed-off-by: Stuxend <friquet@gmail.com>
 2020-04-29 19:11:48 +02:00
kaizhe
f27056c394 fix rule naming following naming convention 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-04-28 18:18:06 +02:00
Leonardo Grasso
ca7398dbe1 docs(RELASE.md): apply suggestions from review 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-28 18:16:27 +02:00
Leo Di Donato
3fe3bc42c2 docs(RELEASE.md): review document and apply corrections 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
 2020-04-28 18:16:27 +02:00
Leonardo Grasso
585f437326 docs: add release process 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-28 18:16:27 +02:00
Lorenzo Fontana
d4d78349ad update(cmake/modules): catch2 version bump to v2.12.1 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-04-24 15:44:08 +02:00
Leonardo Di Donato
8a1cae6989 fix(scripts): correct "drivers build gruid" URLs 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-24 15:42:29 +02:00
Leonardo Grasso
9915b9077c update(docker/event-generator): remove the event-generator from the Falco repo 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-24 15:40:50 +02:00
Leonardo Di Donato
26621ca381 fix(scripts): falco-driver-loader must infer the OS ID from the host 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-24 11:28:05 +02:00
Leonardo Di Donato
3ec4b5b652 build: rename the driver to "falco" and setup the DBG URL 
DBG stands for Drivers Build Grid, a repository holding a set of
prebuilt drivers (both Falco kernel modules and Falco eBPF probes).

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-24 11:28:05 +02:00
Leonardo Di Donato
207f74b17c update(scripts): changes to falco-driver-loader to support the Falco 
eBPF probes coming from the drivers build grid

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-24 11:28:05 +02:00
Leonardo Di Donato
9baa3707dc fix(scripts): falco-driver-loader takes into account the new kernel modules URLs 
The new Falco kernel modules URLs are:
`<base_url>/kernel-module/<driver_version>/falco_<target_id>_<kernel_release>_<kernel_version>`

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-24 11:28:05 +02:00
Mark Stemm
357da40fc4 Only use metadata in k8s audit event for secrets 
Instead of using the request object to identify service account tokens,
exclude any secrets activity by system users (e.g. users starting with
"system:"). This allows the rules to work on k8s audit events at
Metadata level instead of RequestResponse level.

Also change the example objects for automated tests to ones collected at
Metadata level.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-04-22 21:00:38 +02:00