github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity
2,574 Commits 119 Branches 172 Tags 104 MiB
d989e9c2d5
Commit Graph

2574 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Vicente Herrera
e7b3d7a7e0 Added four new rules, to detect k8s operation by an administrator, nodes successfully joining the cluster, nodes unsuccessfully attempt to join, creation ingress without TLS certificate 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
 2020-04-14 13:19:14 +02:00
Vicente Herrera
2c2d126a54 Added two new rules to detect traffic to image outside local subnet and detect traffic that is not to authorized server process and port 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
 2020-04-14 13:19:14 +02:00
Bob Aman
ffa137fc7c rule(Delete Bash History): Fix typo in tags 
Signed-off-by: Bob Aman <bob@sporkmonger.com>
 2020-04-14 12:54:02 +02:00
Bob Aman
534a642074 rule(Delete or rename shell history): Fix typo in tags 
Signed-off-by: Bob Aman <bob@sporkmonger.com>
 2020-04-14 12:54:02 +02:00
Leonardo Di Donato
fd572f4bd2 update(cmake/modules): driver version bump to a259b4bf49c3 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-10 18:04:54 +02:00
kaizhe
1548ccbc4f rule(Write below root): use pmatch to check against known root directories 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-04-09 12:32:30 +02:00
Lorenzo Fontana
a0c189b730 fix: HOST_ROOT environment variable detection 
The HOST_ROOT environment variable was incorrectly detected when
deploying Falco inside a container.

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-04-08 19:14:44 +02:00
Lorenzo Fontana
37476aabed fix(driver/bpf): exact check on bpf_probe_read_str() return value 
Bump version of the driver to (commit: cd3d10123eef161d9f4e237581c1056fca29c130) that fixes #896
Summary of the needed fix can be found at patch [0]

[0] https://patch-diff.githubusercontent.com/raw/draios/sysdig/pull/1612.patch

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-04-08 19:13:14 +02:00
Leonardo Di Donato
39a27e0a09 docs: badges links to bintray repos now 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-08 19:11:44 +02:00
Leonardo Di Donato
11843948e8 docs(README): versions section 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-04-08 19:11:44 +02:00
Leonardo Grasso
35691b0e05 update(docker): update README.md 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-01 11:49:59 +02:00
Leonardo Grasso
ea0f78c2c2 chore(docker): remove kernel/linuxkit and kernel/probeloader images 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-01 11:49:59 +02:00
Leonardo Grasso
61e859745d chore(docker): remove RHEL-base image 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-04-01 11:49:59 +02:00
kaizhe
6834649fa5 rule(Service Account Created in Kube Namespace): only detect sa created in kube namespace with success 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-27 13:02:57 +01:00
danmx
4df5fe83be update(cmake): using sha256 instead of md5 
Signed-off-by: danmx <daniel@iziourov.info>
 2020-03-27 00:34:54 +01:00
kaizhe
e1cb2e9bb0 rule(Detect outbound connections to common miner pool ports): whitelist sysdig/agent and falcosecurity/falco for query miner domain dns 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-03-27 00:33:24 +01:00
Leonardo Di Donato
09b87b9a3d fix(test): use .falco dir 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Lorenzo Fontana
a9658d446f fix(test): urrlib from python 2 to 3 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
fbcdb57cea update(docker): entrypoints to call falco-driver-loader now 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
b3998a6b44 build(scripts): insert versions into falco-driver-version and install it 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
b39f322994 fix(scripts): falco-probe-loader becomes falco-driver-loader and distinghuishes driver version from falco version 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
c1d840d471 update(test): account only for falco version in tests, not driver version 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
d3a215a2db new(userspace/falco): return also driver version from --version flag 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
3934f19f3d build: cmake var to store the URL where to lookup for prebuilt drivers 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
7f9d3ca422 fix(.circleci): ensure stable docker images (packages built from tag) have exact FALCO_VERSION env variable 
This avoids `FALCO_VERSION` variable to be equal to `latest` while
`falco --version` correctly returns 0.21.0

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
c1c9ba56ac fix(.circleci): ensure docker images (packages built from master) have correct FALCO_VERSION env variable 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
7b44aafc6a ci: avoid stable releases to be published to *-dev repositories too 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Leonardo Di Donato
a56803e3c7 ci: override package update 
It may been necessary to override a Falco version package update since
the release process stopped for causes not depending on itself.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Leonardo Di Donato
ce5bc89698 ci: upsert versions on git tag (release) 
It can happen that bintray API is unresponsibe. In this case, we may
need to re-run the CI job manually and be able to not be blocked by
already created versions for the a given git tag.
Same for _developmen_ releases (from master).

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-19 10:36:36 -07:00
Lorenzo Fontana
ea46adfbc8 new(userspace/falco): add --disable-cri-async flag 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-18 16:23:19 +01:00
Lorenzo Fontana
c5674c9001 build: fix tbb dependency rename 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-18 04:07:47 -07:00
Kris Nova
1cbe0b27bb docs(readme): adding new release archive 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-03-17 21:48:31 +01:00
Lorenzo Fontana
9db36822e7 update(docker/tester): python 3 support for regression tests 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-17 21:24:31 +01:00
Leonardo Di Donato
5909eac307 fix(.circleci): remove --labels flag from circleci 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 18:30:41 +01:00
Leonardo Di Donato
f69c419940 fix(.circleci): remove github tag rel nots flag (not working) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 17:57:22 +01:00
Leonardo Di Donato
10e4983297 fix(.circleci): to create stable versions bintray secret and user are needed 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 16:45:18 +01:00
Leonardo Di Donato
9e69972ec4 docs: highlight breaking change in the changelog for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
87e8457ce7 docs: bump versions to 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Leonardo Di Donato
56ccdf29c8 docs: CHANGELOG for 0.21.0 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-17 15:34:20 +01:00
Mark Stemm
2126616529 Fix image for event generator deployment yaml 
I had a bug in https://github.com/falcosecurity/falco/pull/1088 where
the image name for the event generator was pointing to a temporary tag
instead of latest. This switches the image name back to latest.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 21:32:24 +01:00
Hiroki Suezawa
3067af566e rule(Change thread namespace): fix regression test 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Hiroki Suezawa
742538ac86 rule(Change thread namespace): change condition to detect suspicious container activity 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00
Mark Stemm
6488ea8456 (WIP) K8s Deployment to run event generator w k8s_audit 
Add a deployment yaml that allows running the event generator in a k8s
cluster:

 - Change the event generator to create/delete objects in a namespace
   "falco-eg-sandbox" instead of "falco-event-generator". That way you
   separate the generator from the resources it modifies (mostly, the
   exception being the rolebinding).
 - Create a serviceaccount, clusterrole, and rolebinding that allows the
   event generator to create/list/delete objects in the falco-eg-sandbox
   namespace. The list of permissions is fairly broad mostly so the
   event generator can delete all resources without explicitly naming
   them. The binding does limit permissions to the falco-eg-sandbox
   namespace, though.

A one-line way to run this would be:

kubectl create namespace falco-event-generator && \
  kubectl create namespace falco-eg-sandbox && \
  kubectl apply -f event-generator-role-rolebinding-serviceaccount.yaml && \
  kubectl apply -f event-generator-k8saudit-deployment.yaml

I haven't actually pushed a new docker image to replace the current
event generator yet--the deployment yaml refers to a placeholder
falcosecurity/falco-event-generator:eg-sandbox image. Once the review is
done I'll rebase this to change the image to latest before merging.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Mark Stemm
3fd67aa5c3 K8s Daemonset to run event generator w/ syscalls 
Add a Daemonset yaml that allows running the falco event generator on
syscalls. It will run on any non-master node.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-03-12 13:12:40 +01:00
Vicente Herrera
085009ad93 Fixed use of "tag" instead of "tags" in default rules 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
 2020-03-10 20:51:45 +01:00
Leonardo Di Donato
788d3294bd chore: re-enabling package build, sign, and docker push from master 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
de5cd1ce6f update(docker): latest or explicit FALCO_VERSION for docker images via docker build argument 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
4d4a2af8b6 chore: temporary test for circleci 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Leonardo Di Donato
36501c5f1d new(cmake/modules): provide and parse FALCO_VERSION_PRERELEASE too 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-10 20:46:52 +01:00
Lorenzo Fontana
123a75062e build: passing driver checksum down to download makefile 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-10 18:00:04 +01:00