github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity
3,607 Commits 121 Branches 172 Tags 104 MiB
dad382edd6
Commit Graph

3607 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Stemm
910b8ff858 Fix(engine) Save parse positions when finding unresolved macros 
Now that ASTs contain parse positions, use them when reporting errors
about unknown macros.

When doing the first pass to find all macro references, save macros as
a map<macro name,parse position> instead of a set<macro name>. While
making that change, change the visitor struct to use references
instead of pointers.

In the second pass, when reporting any unresolved macro references,
also report the parse position.

The unit tests also check that the positions of macros are properly
returned in the resolved/unresolved maps.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-12-01 17:03:52 +01:00
Mark Stemm
83b12bab1d Fix(engine): include parse positions in compile errors 
Now that ASTs have parse positions and the compiler will return the
position of the last error, use that in falco rules to return errors
within condition strings instead of reporting the position as the
beginning of the condition.

This led to a change in the filter_ruleset interface--now, an ast is
compiled to a filter before being passed to the filter_ruleset
object. That avoids polluting the interface with a lot of details
about rule_loader contexts, errors, etc. The ast is still provided in
case the filter_ruleset wants to do indexing/analysis of the filter.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-12-01 17:03:52 +01:00
Lorenzo Susini
ecc1853d60 update(rule): improve insmod detection within container using CAP_SYS_MODULE 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2022-12-01 11:17:50 +01:00
Andrea Terzolo
fbd6628693 new(config): add the simulate_drops config explicitly 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-11-30 19:26:47 +01:00
Jason Dellaluce
ba61706557 update(userspace/falco): enable using zlib with webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-30 19:24:47 +01:00
vin01
234026e14b rule(macro rpm_procs): let salt-call write to rpm database 
Signed-off-by: vin01 <vinc.i@protonmail.ch>
 2022-11-30 19:20:47 +01:00
vin01
d03826379b rule(Read sensitive file untrusted): let salt-call read sensitive files 
Signed-off-by: vin01 <vinc.i@protonmail.ch>
 2022-11-30 19:20:47 +01:00
Alessandro Brucato
3697d1fae2 Fixed typo 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Alessandro Brucato
e76c31b493 Added PTRACE_SEIZE, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS and whitelist macro 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Alessandro Brucato
d95e36b526 Rule: PTRACE attached to process 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-11-30 19:12:47 +01:00
Jason Dellaluce
15b57bd972 fix: remove minor string view dependencies 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
68f4d5bb59 fix(userspace/engine): no need to use external deps 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
138e373ace chore(cmake/modlule): cleanup DownloadStringViewLite 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
47fd90bb7f chore: remove not used dependency - string-view-lite 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Luca Guerra
3a56804cff new(CHANGELOG): add entry for 0.33.1 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-29 10:29:41 +01:00
Melissa Kilby
8f188ebe06 update(docs): polish release.md based on community feedback 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Melissa Kilby
7ead21daac update(docs): polish overview and versioning sections of release.md 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Melissa Kilby
d3badeb77e update(docs): add overview and versioning to release.md 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-11-28 10:45:35 +01:00
Edvin Norling
588ab01bfd Add Xenit AB to adopters 
Signed-off-by: Edvin Norling <edvin.norling@xenit.se>
 2022-11-23 13:12:57 +01:00
Luca Guerra
f08a5b4067 update(cli): also add cg / kg container-gvisor / kubernetes-gvisor 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
dea02f82e8 update(falco): add container-gvisor and kubernetes-gvisor print options 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
e3dbae3259 fix(engine): fix warning about redundant std::move 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-11 16:19:11 +01:00
Federico Di Pierro
d0ceba83b4 update(cmake, docker, circleci): updated libs and driver to latest master. 
Docker builder image was updated to remove the libelf and libz deps as they are now properly bundled, in BUNDLED_DEPS mode.
Finally, circleci musl job was updated to enforce the use of alpine-provided libelf package, since it is already static,
and building libelf on musl is pretty cumbersome.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-11 14:56:10 +01:00
Aldo Lacuku
161246fe1a fix(output): do not print syscall_buffer_size when gvisor is enabled 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-11-10 10:32:05 +01:00
Jason Dellaluce
240c0b870d fix(userspace/falco): verify engine fields only for syscalls 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-07 15:37:25 +01:00
Federico Di Pierro
136eacc17f chore(scripts): when ENABLE_COMPILE is disabled, exit immediately if target distro could not be fetched. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-02 12:06:29 +01:00
Federico Di Pierro
c0c0246927 fix(scripts): force falco-driver-loader script to try to compile the driver anyway even on unsupported platforms. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-11-02 12:06:29 +01:00
Mark Stemm
acf5c4ce5f fix(engine): save syscall source only when processing events 
The optimization in https://github.com/falcosecurity/falco/pull/2210
had a bug when the engine uses multiple sources at the same
time--m_syscall_source is a pointer to an entry in the indexed vector
m_sources, but if add_source is called multiple times, the vector is
resized, which copies the structs but invalidates any pointer to the
vector entries.

So instead of caching m_syscall_source in add_source(), cache it in
process_events(). m_sources won't change once processing events starts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-10-27 18:23:25 +02:00
Yarden Shoham
4a4fa2592b fix(plugins): trim whitespace in open_params 
`open_params` is read from the falco YAML configuration file and parsed using Go's URL.

For example:
c349be6e84/plugins/k8saudit/pkg/k8saudit/source.go (L41-L42)

Go's URL parser does not handle whitespace, so if a user defines the `open_params` in the falco configuration file as follows

```yaml
open_params: >
/file/path
```

the parser returns an error. To avoid this, we now trim this parameter so no whitespace will be left for Go's URL parser to error out on.

For reference see #2262.

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
 2022-10-21 19:12:58 +02:00
Federico Di Pierro
d0467de0a7 fix(ci): fixed version bucket for release jobs. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-10-21 11:19:19 +02:00
Jason Dellaluce
c1be1496d3 update(CHANGELOG.md): change release date 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Jason Dellaluce
fa1a5d58e6 update(changelog.md): add entry for Falco 0.33.0 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-19 10:52:57 +02:00
Andrea Terzolo
62abefddf6 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 15:30:52 +02:00
Andrea Terzolo
784fa8b374 chore: bump plugin version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-14 14:32:22 +02:00
Jason Dellaluce
10fe9fd84b fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
3d7677ce5b update(userspace/falco): create struct for sync parallel event sources parallelization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
0fd765f7c3 new(userspace/falco): add simple semaphre implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
cca90b2f80 update(userspace/falco): move on from deprecated libs API for printing event list 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 17:00:18 +02:00
Jason Dellaluce
6c873418ce chore(userspace/falco): improve the CLI options helper 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Jason Dellaluce
f12531a153 chore(userspace/falco): log cli options with debug level 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Andrea Terzolo
d5e3085b54 chore: bump to latest libs commit 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 18:47:15 +02:00
Andrea Terzolo
90d6d9080a fix: inject kmod script 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 16:40:21 +02:00
Jason Dellaluce
7d28637f44 fix(test): fix regresstion test 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9d8f130f47 fix(userspace/falco): make sure validation summary is populated even when json output is requested 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9ee0298c4d fix(userspace/engine): avoid macro/list used checks if we encounter an error 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
7da30ca661 chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 13:14:20 +02:00
Andrea Terzolo
12d709b8b1 chore: bump libs version 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-12 12:36:21 +02:00
Jason Dellaluce
57b26530b6 update(userspace) fix cppcheck warnings 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
3629c4dc4a update(userspace): solve cppcheck performance suggestions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
5e531870a9 fix(userspace/engine): fix unit test segfault 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00