github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-02 01:22:16 +00:00
Code Issues Projects Releases Wiki Activity
3,607 Commits 119 Branches 173 Tags 104 MiB
dad382edd6
Commit Graph

3607 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Federico Di Pierro
eb9a9c6e7d update(build): updated libs to 1be924900a09cf2e4db4b4ae13d03d838959f350 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 18:19:26 +02:00
Federico Di Pierro
75712caa9a fix(test): dropped file:// from k8s audit log tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
db5f1bec3d update(cmake): updated plugins. 
Moreover, add support for aarch64 plugins, even if Falco 0.32 won't be distributed with official arm64 support.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Federico Di Pierro
1d343c93f3 update(build): updated libs version for Falco 0.32.0 release. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 11:07:27 +02:00
Jason Dellaluce
3b462af58e fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
09eae35f3a refactor(userspace/falco): create action for initializing k8s and mesos clients (step 2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
383b8f9660 refactor(userspace/falco): create action for initializing k8s and mesos clients 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
13d70b65ae update(userspace/engine): rename ruleset.h in filter_ruleset.h 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
9fd10220a5 update(userspace/falco): sync falco with new engine definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
0abd7eaa28 refactor(userspace/engine): refactor engine interface and internals 
This updates the engine to comply and work properly with the newly-introduced
interface design.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
5ddc8e20f4 test(userspace/engine): adapt test_rulesets to new definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
a1bdf95a0f refactor(userspace/engine): improve ruleset interface definitions 
The filter_ruleset interface its implementation evt_type_index_ruleset
have been modified as follows:
- Only keep track of ruleset ids and not names. The falco engine will take
care of mapping easy-to-remember ruleset names to ruleset ids.
To emphasize this, use ruleset_id everywhere and not ruleset.
Also, make it non-optional.
- Have explicit separate functions to enable/disable rules, instead of a single enable() method combined with a boolean flag.
This does *not* change the falco_engine interface, which has
similar methods, to avoid breaking API changes.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Mark Stemm <mark.stemm@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
833fec8537 refactor(userspace/engine): leverage falco_rule def in stats manager 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
50c2aa9c81 refactor(userspace/engine): update rule loader to use new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
f41f51f736 refactor(userspace/engine): update falco engine to use new ruleset interface and have one ruleset for each source 
This also fixes a couple of bugs. With the current implementation, the multi-ruleset feature is broken with multiple sources.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
3af8d1c0d2 refactor(userspace/engine): adapt existing ruleset implementation to new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
bbbdb311e0 refactor(userspace/engine): introduce interface for rulesets and their factory 
This interface will allow us to use different ruleset implementations inside the same engine.
The goal is to define API boundaries that will allow swapping the current evttype-index
ruleset implementation more easily. Key benefits include: smaller component with less responsibilities,
easier substituibility, more testable design, opportunity to adopt different index strategies
depending on the ruleset implementation.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Andrea Terzolo
d860472987 update(userspace/falco): improve falco termination 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 18:35:18 +02:00
Andrea Terzolo
3a3d5dfdcd Update userspace/falco/app_actions/load_rules_files.cpp 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
46159b8de9 update(userspace/engine): introduce new check_plugin_requirements API 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
e751bf79c3 fix(userspace/engine): improve rule loader source checks for macros and lists 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:54:17 +02:00
Federico Di Pierro
d9d8dedc32 update(test): fixed tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
39f55f4b5c update(userspace): split filterchecks list for each source idx. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
5f00cea3c9 fix(userspace/falco): do not start webserver in capture mode. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
f6dba24b81 update(build): updated libs to latest master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Brad Clark
9d41b0a151 use endswith ash_history to catch both bash and ash 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
b9bcf79035 rule(macro truncate_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Brad Clark
3cca4c23cc rule(macro modify_shell_history): include .ash_history 
Signed-off-by: Brad Clark <bdashrad@gmail.com>
 2022-05-14 07:55:29 +02:00
Federico Di Pierro
a7ebfbf137 update(ci): add workflow_dispatch to be able to manually trigger ci. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
fbc7ede75a Update .github/workflows/ci.yml 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
7b45520f37 fix(ci): fetch all history from git to correctly populate FALCO_VERSION. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
2b6c0f3f9e fix(ci): fixed ubuntu kernel headers install. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
f5f836ca8b fix(ci): fixed centos debug job. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
3b73433c48 update(ci): dropped circleCI jobs that are now provided by gh actions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
1a3556affc update(ci): ported all no-output jobs to github actions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
b3aec1967b fix(ci): use sudo. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Federico Di Pierro
004e93f19f new(ci): initial build minimal action ported to gh action. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-13 17:28:54 +02:00
Jason Dellaluce
96e2864c16 test(falco_k8s_audit): fix k8s audit tests to used plugin ruleset 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
e2b7b1208a build(cmake/modules): add plugins rules and bump plugins versions 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
d4f76f1f93 update!: moving out plugins ruleset files 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
65de03aa29 update(rules): remove plugins ruleset files 
Plugins' rules files now lives in their repositories. See https://github.com/falcosecurity/plugins/pull/98

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Leonardo Grasso
298913471c wip: bump libs version to ff0b1f8d4612d197368b3f7feff28178f3bd3ad184f3707942ab52219e98f461 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 18:28:34 +02:00
Stefano
3e603188d4 Changed field in thread.cap_effective 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
c3bcf604a5 Changed Rule focus to be broader then just a specific CVE 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
2e2b13236b Fixed CVE number 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Stefano
24bd1abc43 Added new rule for CVE-2022-4092 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-05-12 14:42:34 +02:00
Federico Di Pierro
acbbcf7481 Update userspace/falco/app_cmdline_options.h 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
3ba64d8a49 new(userspace/falco): new inotify watcher is now able to properly watch rules folders, when specified. 
This means that when starting Falco passing to it a folder for its rules, it will properly manage
changes to any file inside the folders, plus any created/deleted file inside it.

Unified list of rules parsing, instead of having it done twice inside cmdline_options and configuration.
Instead, it is done only once, inside load_rules_files.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
293a6c2b40 update(userspace/falco): moved to a config option. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
a9fe979071 chore(userspace/falco): small cleanup. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00