github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 00:22:15 +00:00
Code Issues Projects Releases Wiki Activity
2,574 Commits 121 Branches 172 Tags 104 MiB
d989e9c2d5
Commit Graph

2574 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leonardo Di Donato
f3022e0abf build(test): target test-traces files 
This make target calls the `trace-files-psp`, `trace-files-k8s-audit`,
`trace-files-base-scap` targets to place all the integration test
fixtures in the proper position.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
9b42b20e1c build(test/trace_files): target trace-files-base-scap 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
850a49989f build(test/trace_files/psp): target trace-files-psp 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
0dc2a6abd3 build(test/traces_file/k8s_audit): target trace-files-k8s-audit 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Grasso
4346e98f20 feat(userspace/falco): print version at startup 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-16 22:35:56 +02:00
Lorenzo Fontana
38009f23b4 build: remove libyaml from cpack rpm 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Lorenzo Fontana
324a3b88e7 build: remove libyaml-0-2 as dependency in packages and dockerfiles 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Lorenzo Fontana
c03f563450 build: libyaml in bundled deps 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Leonardo Di Donato
c4b7f17271 docs: refinements to the release process docs 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-16 16:38:15 +02:00
Leonardo Di Donato
ebb0c47524 docs: 0.24.0 changelog entries 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-16 16:38:15 +02:00
Lorenzo Fontana
a447b6996e fix(userspace): rethrow inspector open exceptions 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-07-15 18:33:50 +02:00
Leonardo Di Donato
596e7ee303 fix(userspace/falco): try to insert kernel module driver conditionally 
Do it only when not running with userspace instrumentation enabled and
the syscall input source is enabled (!disable_syscall)

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-15 18:33:50 +02:00
Leonardo Di Donato
8ae6aa51b9 chore: onetbb dependency is back 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-15 18:33:50 +02:00
Leo Di Donato
1343fd7e92 update(userspace/falco): userspace instrumentation help line 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-15 18:33:50 +02:00
Kris Nova
1954cf3af3 update(userspace/falco): edits to the falco CLI 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-15 18:33:50 +02:00
Kris Nova
bc8f9a5692 feat(cli): adding -u to the usage text 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-07-15 18:33:50 +02:00
Kris Nova
1af1226566 feat(build): fixing MD5 of tpp for udig/pdig build 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-07-15 18:33:50 +02:00
Loris Degioanni
c743f1eb68 feat(cli): adding -u to flip inspector method calls 
udig support through the -u command line flag

Signed-off-by: Kris Nóva <kris@nivenly.com>
Co-authored-by: Kris Nóva <kris@nivenly.com>
 2020-07-15 18:33:50 +02:00
Leonardo Grasso
bca98e0419 update(rules): disable drift detection rules by default 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-15 18:01:57 +02:00
Nicolas Marier
32bae35de2 rule(list package_mgmt_binaries): add snapd to list 
Snap is a package manager by Canonical which was not in the
`package_mgmt_binaries` list.

Signed-off-by: Nicolas Marier <nmarier@coveo.com>
 2020-07-10 10:04:26 +02:00
Leonardo Grasso
de147447ed update(userspace/falco): rename --stats_interval to --stats-interval 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-08 17:55:16 +02:00
Leonardo Di Donato
825e249294 update(userspace/falco): rename --stats_interval to --stats-interval 
To match the style of other long flags of the Falco CLI.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-08 17:55:16 +02:00
Leonardo Di Donato
00689a5d97 fix(userspace/falco): allow stats interval greather than 999 
milliseconds

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-08 17:55:16 +02:00
Leonardo Grasso
4d31784a83 fix(docker): correct syntax error in the entrypoint script 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-08 12:11:33 +02:00
Leonardo Di Donato
2848eceb03 build(cmake/modules): update driver version to 85c889 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 21:19:08 +02:00
Leonardo Di Donato
c7ac1ef61b update(userspace/engine): const correctness for json_event class 
Co-authored-by: Nathan Baker <nathan.baker@sysdig.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 21:19:08 +02:00
Leonardo Di Donato
5fd3c38422 build(cmake/modules): update driver version to 33c00f 
This driver version, among other things (like userspace instrumentation
support) includes a fix for building the eBPF driver on CentOS 8
machines too.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 18:41:01 +02:00
Leo Di Donato
3bad1d2a56 docs: auto threadiness comment into Falco config 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 13:42:09 +02:00
Leonardo Di Donato
8ad5c4f834 update: default grpc server threadiness is 0 now ("auto") 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 13:42:09 +02:00
Leonardo Di Donato
553856ad68 chore(userspace): log the gRPC threadiness 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 13:42:09 +02:00
Leonardo Di Donato
2d52be603d update(userspace/falco): gRPC server threadiness 0 by default (which 
means "auto")

The 0 ("auto") value sets the threadiness to the number of online cores
automatically.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 13:42:09 +02:00
Leonardo Di Donato
75e62269c3 new: hardware_concurrency helper 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-07 13:42:09 +02:00
Lorenzo Fontana
3d1f27d082 build: stale bot adjustements 
Removed not existing labels and made the error message a bit more
verbose to tell people what to expect next.

Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-07 12:20:55 +02:00
Leonardo Grasso
ad960a9485 chore(docker): rename SKIP_MODULE_LOAD to SKIP_DRIVER_LOADER 
As per https://github.com/falcosecurity/falco/blob/master/proposals/20200506-artifacts-scope-part-2.md#action-items

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-07 12:17:20 +02:00
kaizhe
d8d218230d rules update: create placeholder macros for customization 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-07-03 20:54:36 +02:00
Leonardo Grasso
b7e7a10035 docs: add myself to owners 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-03 16:37:17 +02:00
Leonardo Grasso
fecf1a9fea fix(userspace/falco/lua): correct argument 
This explain why `buffered_output: false` was not honored for stdout

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-03 11:45:00 +02:00
Leonardo Di Donato
54a6d5c523 build: do not download lyaml and lpeg from draios S3 anymore 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-02 06:01:12 +02:00
Leonardo Di Donato
9fe78bf658 build: fetch libb64 and luajit from github, not from draios repos 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-02 06:01:12 +02:00
Leonardo Di Donato
727755e276 build: fetch openssl, curl, njson dependencies from github not draios 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-02 06:01:12 +02:00
Lorenzo Fontana
352307431a fix: update k8s audit endpoint to /k8s-audit everywhere 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-01 13:29:51 +02:00
Leonardo Grasso
6cfb0ec2b8 update(test): setup bidi gRPC integration test 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-30 13:04:03 +02:00
Leonardo Grasso
4af769f84c new(test): add gRPC unix socket support 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-30 13:04:03 +02:00
Leonardo Grasso
82e0b5f217 fix(userspace/falco): honor -M also when using a trace file 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
b4d005eb51 new(test): read grpc config fields 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
061c5f5ac9 new(test): setup gRPC output test case 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
c06ccf8378 update(docker/tester): grpcurl 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-30 13:04:03 +02:00
samwhite-gl
3408ea9164 Add GitLab to ADOPTERS.md 
GitLab is now using Falco to provide Container Host Security protection

Co-Authored-By: Kris Nova <kris@nivenly.com>
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-06-30 11:45:58 +02:00
samwhite-gl
51aea00be8 Add GitLab to ADOPTERS.md 
GitLab is now using Falco to provide Container Host Security protection

Co-Authored-By: Kris Nova <kris@nivenly.com>
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-06-30 11:45:58 +02:00
Antoine Deschênes
a5cadbf5fa rule(Disallowed K8s User): whitelist kube-apiserver-healthcheck 
kops 1.17 adds a kube-apiserver-healthcheck user: https://github.com/kubernetes/kops/tree/master/cmd/kube-apiserver-healthcheck

Logs are currently spammed with:
```
{"output":"18:02:15.466580992: Warning K8s Operation performed by user not in allowed list of users (user=kube-apiserver-healthcheck target=<NA>/<NA> verb=get uri=/healthz resp=200)","priority":"Warning","rule":"Disallowed K8s User","time":"2020-06-29T18:02:15.466580992Z", "output_fields": {"jevt.time":"18:02:15.466580992","ka.response.code":"200","ka.target.name":"<NA>","ka.target.resource":"<NA>","ka.uri":"/healthz","ka.user.name":"kube-apiserver-healthcheck","ka.verb":"get"}}
```

Signed-off-by: Antoine Deschênes <antoine.deschenes@equisoft.com>
 2020-06-30 11:44:11 +02:00