github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity
3,285 Commits 121 Branches 172 Tags 104 MiB
d0ceba83b4
Commit Graph

3285 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Federico Di Pierro
d0ceba83b4 update(cmake, docker, circleci): updated libs and driver to latest master. 
Docker builder image was updated to remove the libelf and libz deps as they are now properly bundled, in BUNDLED_DEPS mode.
Finally, circleci musl job was updated to enforce the use of alpine-provided libelf package, since it is already static,
and building libelf on musl is pretty cumbersome.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-11 14:56:10 +01:00
Aldo Lacuku
161246fe1a fix(output): do not print syscall_buffer_size when gvisor is enabled 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-11-10 10:32:05 +01:00
Jason Dellaluce
240c0b870d fix(userspace/falco): verify engine fields only for syscalls 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-07 15:37:25 +01:00
Federico Di Pierro
136eacc17f chore(scripts): when ENABLE_COMPILE is disabled, exit immediately if target distro could not be fetched. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-02 12:06:29 +01:00
Federico Di Pierro
c0c0246927 fix(scripts): force falco-driver-loader script to try to compile the driver anyway even on unsupported platforms. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-02 12:06:29 +01:00
Mark Stemm
acf5c4ce5f fix(engine): save syscall source only when processing events 
The optimization in https://github.com/falcosecurity/falco/pull/2210
had a bug when the engine uses multiple sources at the same
time--m_syscall_source is a pointer to an entry in the indexed vector
m_sources, but if add_source is called multiple times, the vector is
resized, which copies the structs but invalidates any pointer to the
vector entries.

So instead of caching m_syscall_source in add_source(), cache it in
process_events(). m_sources won't change once processing events starts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-10-27 18:23:25 +02:00
Yarden Shoham
4a4fa2592b fix(plugins): trim whitespace in open_params 
`open_params` is read from the falco YAML configuration file and parsed using Go's URL.

For example:
c349be6e84/plugins/k8saudit/pkg/k8saudit/source.go (L41-L42)

Go's URL parser does not handle whitespace, so if a user defines the `open_params` in the falco configuration file as follows

```yaml
open_params: >
/file/path
```

the parser returns an error. To avoid this, we now trim this parameter so no whitespace will be left for Go's URL parser to error out on.

For reference see #2262.

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
 2022-10-21 19:12:58 +02:00
Federico Di Pierro
d0467de0a7 fix(ci): fixed version bucket for release jobs. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-10-21 11:19:19 +02:00
Jason Dellaluce
c1be1496d3 update(CHANGELOG.md): change release date 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Jason Dellaluce
fa1a5d58e6 update(changelog.md): add entry for Falco 0.33.0 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Andrea Terzolo
62abefddf6 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 15:30:52 +02:00
Andrea Terzolo
784fa8b374 chore: bump plugin version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 14:32:22 +02:00
Jason Dellaluce
10fe9fd84b fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
3d7677ce5b update(userspace/falco): create struct for sync parallel event sources parallelization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
0fd765f7c3 new(userspace/falco): add simple semaphre implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
cca90b2f80 update(userspace/falco): move on from deprecated libs API for printing event list 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 17:00:18 +02:00
Jason Dellaluce
6c873418ce chore(userspace/falco): improve the CLI options helper 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Jason Dellaluce
f12531a153 chore(userspace/falco): log cli options with debug level 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Andrea Terzolo
d5e3085b54 chore: bump to latest libs commit 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 18:47:15 +02:00
Andrea Terzolo
90d6d9080a fix: inject kmod script 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 16:40:21 +02:00
Jason Dellaluce
7d28637f44 fix(test): fix regresstion test 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9d8f130f47 fix(userspace/falco): make sure validation summary is populated even when json output is requested 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9ee0298c4d fix(userspace/engine): avoid macro/list used checks if we encounter an error 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
7da30ca661 chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 13:14:20 +02:00
Andrea Terzolo
12d709b8b1 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 12:36:21 +02:00
Jason Dellaluce
57b26530b6 update(userspace) fix cppcheck warnings 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
3629c4dc4a update(userspace): solve cppcheck performance suggestions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
5e531870a9 fix(userspace/engine): fix unit test segfault 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
c2dc0a7259 test(engine): fix unit tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
f684e144be chore(userspace/falco): polish ignored event warning message 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
a4218a4b4f fix(userspace/falco): print right list in ignored events warning 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
48fbe0801d fix(userspace/falco): print right list of ignored events when in simple cons mode 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
c47492ab6d update(userspace/falco): populate list of interesting event types in app state 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
4cb556aed2 update(userspace/engine): use sinsp api to access event table information 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Andrea Terzolo
7da3041cb3 feature(falco_service): add a service unit to inject the kmod 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 10:50:21 +02:00
Andrea Terzolo
48ce85f4da fix(falco_service): falco service needs to write under /sys/module/falco 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 10:50:21 +02:00
Jason Dellaluce
5f2bc6a2d3 fix(userspace/falco): properly handle termination at source opening failures 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
88c7202fdc fix(userspace/falco): check conditions in right order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
a98a1b2c4c fix(userspace/falco/falco): allow output reopening to happen multiple times 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
77857a7236 fix(userspace/falco): solve warning 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
e011b3b5e5 chore(userspace/falco): fix typo 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
fd4d521a5f fix(userspace/falco): make multi-source termination condition more stable 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
3f3386cfe0 fix(userspace/falco): make signal handlers safe with multi-threading 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
11160f8463 fix(userspace): safely check string bounded access 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 11:23:15 +02:00
Stanley Chan
79d875c28f cleanup(scripts): cleanup systemd unit in RPM installer 
Signed-off-by: Stanley Chan <pocketgamer5000@gmail.com>
 2022-10-07 14:47:00 +02:00
Stanley Chan
7610ee53e5 cleanup(scripts): cleanup systemd unit in DEB installer 
Signed-off-by: Stanley Chan <pocketgamer5000@gmail.com>
 2022-10-07 14:47:00 +02:00
Jason Dellaluce
3c02b40a21 chore(userspace/falco): make log message termination consistent 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
e85a8c914f chore(userspace/falco): move enabled sources list printout when capture is opened 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
21c2b1f472 update(userspace/falco): use unordered_set where possible for faster lookups 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
909f6d0961 chore(userspace/falco): make log messages formatting more consistent 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00