github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 15:47:25 +00:00
Code Issues Projects Releases Wiki Activity
4,285 Commits 121 Branches 172 Tags 104 MiB
eed5b906a8
Commit Graph

4285 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]
9c5d643a90 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `5b6e2c0` to `dab4474`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](5b6e2c0241...dab44746af)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-03-17 10:20:26 +01:00
Jason Dellaluce
93ae6bb609 chore(userspace/falco): fix codespell typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
e07e3abfb5 update(userspace/falco): implement debouncing logic in restart handler 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
3f69d46f9a update(userspace/falco): minor compilation improvements 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
647441c06c fix(userspace/falco): solve gettid compilation issues 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
cd155ed6f5 refactor(userspace/falco): update actions to use new hot restarter utility with dry-run safetyc checks 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
561022ebb6 new(userspace/falco): add utility for handling hot app restarts 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
af46833ad3 update(userspace/falco): make cmdline options simpler and copyable 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
e40369648c fix(userspace/falco): solve minor compilation flaws 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
ee7fa1cb06 new(usersapce/falco): add an app option for dry-run 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
f976aa8400 update(cmake): bump libs and driver to 6ca2fc1fa9a9f5482dc92468a0a6e3404ae46723 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 18:03:14 +01:00
dependabot[bot]
8b8f42667f build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `c558fc7` to `5b6e2c0`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](c558fc7d2d...5b6e2c0241)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-03-09 11:57:13 +01:00
Jason Dellaluce
85729f3006 update(cmake): bump libs and driver to 652d6d134d5c2b355467de5be922135e53053412 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
c41665f12c update(cmake): bump libs and driver to a513c696b68676b872c2ea59636e659960ac38c6 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
e8b776a9cb update(userspace/engine): bump engine version to 17 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
3285ead22f update(cmake): bump libs and driver to 172043999fbf3d04c2c40f98cc77957badbbd43e 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
b32c0b9283 fix(unit_tests): adapt to connect4 corner cases 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
8fe474088d update(cmake): bump libs and drivers to c2e227697b2a410eeca47fef260f575375154a58 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
09ab9db423 chore(userspace/falco): apply review suggestion 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
61a7f32982 chore(userspace/falco): apply review suggestions 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
3ab7c7d753 chore: fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
aeef99e173 update(cmake): bump libs and driver versions to f0468f32d8d730d0e70d8e103d57f97d74dd374f 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
b225549679 test(unit_test): adapt and grow tests on configure_intertesting_sets 
The test now take in accoint pre/post-conditions of the actions,
usage of the -A option, and the newly-introduced base_syscall
user configuration. This also makes sure that the event selection
properly handles generic events and options/configs precedence.

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
a7f521b4b8 chore(unit_tests): move existing test in right directory 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
2645f6640c chore(userspace/falco): rename source file using its action name 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
fb37d8f365 refactor(userspace/falco): adapt event set selection to only use ppm_sc and new engine features 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
19ffadc763 update(userspace/engine): support searching ppm_sc events in rulesets 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
07980b7822 new(.github): add dependabot configuration for updating git submodules 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-08 19:03:09 +01:00
m.nabokikh
49cef071cf Add Deckhouse to Falco adopters 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
 2023-03-08 12:39:07 +01:00
Melissa Kilby
0de9af9ed0 fix(app_actions): base_syscalls check for empty string 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
58dc60e58d cleanup(app_actions): address reviewers comments 
* Plus minor adjustments to ensure correct state_event_set for all configurations
* Ensure valid check_for_rules_unsupported_events for all configurations
* Remove user input validation warning -> re-introduce in follow up PR

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
b6f6195725 cleanup(app_actions): include activated syscalls in LOG_DEBUG logs 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
d6421d4e67 new(config): add base_syscalls option to config 
See https://github.com/falcosecurity/falco/issues/2373

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Stanley Chan <pocketgamer5000@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
76a3c8d7ee new(app_actions): introduce base_syscalls 
See https://github.com/falcosecurity/falco/issues/2373

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Jason Dellaluce
7d67fbbfe7 chore(userspace/falco): apply review suggestions 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
31d06a5532 update(cmake): bump libs to e1d0fd9b043f1c7dfd91c9d030c11cfe2c062931 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
b9d03e8f2b update(cmake): bump driver and libs to c592f4f230e48f36a50c1716fd94e7e279b67513 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
5ed5c63202 refactor: adapt event set configuration changes to new libs definition 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
01faeecee7 update(cmake): bump driver to 8a8d2389e4eea9e89efef9e3b06a70aa2a0bf5d0 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
4706cd8b4e cleanup: solve std namespace issues and remove unused imports 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
010f6c6a9e update(userspace/engine): bump fields checksum 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
1485dc5d68 refactor(userspace/falco): adapt app actions to new event definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
e7d76ca722 refactor(userspace/falco): use new event definitions in app state 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
6c38ecaf0e update(userspace/engine): adapt engine classes to new libsinsp event definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
34ea7a8245 cleanup(userspace/engine): drop filtr_evttype_resolver 
Its logic was ported into libsinsp in:
3d8550e70e

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
e54eda16f7 fix(test/plugins): solve compilation issues 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
4c72f36748 update(cmake): bump libs to 8a8d2389e4eea9e89efef9e3b06a70aa2a0bf5d0 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
3b5633a3e5 cleanup(unit_tests): remove some rebase leftovers 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
d89f4b4904 cleanup(app_actions): adjust ignored events 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
16aa36291a fix rebase 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00