github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-05 19:06:44 +00:00
Code Issues Projects Releases Wiki Activity
4,285 Commits 117 Branches 173 Tags 104 MiB
eed5b906a8
Commit Graph

4285 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Stemm
0066ba49ea Falco engine changes to support load_rules result class 
Add new load_rules methods that return a result object instead of
throwing exceptions on error. The existing load_rules methods call the
new methods internally and continue to throw exceptions on
error/return individual values on success.

The result is returned as a unique_ptr so it can be populated while
loading rules (as a part of the configuration object) and then move()d
to the return value.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
8497f25a43 Add a load result interface for use in new load_rules methods 
Define a falco_load_result abstract class for use in new load_rules
methods. It's abstract so the implementation details in
rule_loader/rule_reader can be hidden from someone who wants to use
the API to load rules and work with a result.

The class defines a set of error codes/warning codes and has static
methods to get a short and long description of each error/warning.

There are virtual methods to access the important parts of a result:
 - successful or not
 - a string representation of the result, suitable for display to
   users. Takes a verbose argument. When verbose is true, the string is
   multi-line and has full details, including locations, item names,
   etc. When verbose is false, the string is single-line and just
   returns error codes.
 - a json representation of the result, suitable for automated
   parsing/interpretation later.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Andrea Terzolo
6b7be38e41 test: update a comment 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-08-04 11:47:22 +02:00
Andrea Terzolo
9d443685ea new(userspace): support SCAP_FILTERED_EVENT return code 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-08-04 11:47:22 +02:00
Jason Dellaluce
928d3225b9 fix(cmake): force using bundled valijson 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
a531e8b3ed fix(test): use old event versions in trace tests 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
07fde46e7c fix(test): sync plugin tests to new plugin loader errors 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
136b528849 fix(tests): index old version of events in rulesets 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
a46cbcffe8 fix(engine): index old version of events in rulesets 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
577ba5904b update(engine): bump version to 14 and update fields checksum 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
1b8c8a86ec update(cmake): bump libs version to b4c198773bf05486e122f6d3f7f63be125242413 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
7317d80dd8 update(cmake): bump driver version to b4c198773bf05486e122f6d3f7f63be125242413 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Andrea Terzolo
c8bc5758c3 new(userspace): print architecture information 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-31 19:57:29 +02:00
Federico Di Pierro
ae43f30b0d fix(ci): fixed docker manifest circleci. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-29 12:29:02 +02:00
Federico Di Pierro
fb579615a3 cleanup(ci): natively builds docker images for x86_64 and arm64 and then use docker manifest to combine them. 
This allows for native-speed build of docker images, reducing CI time spent in
docker buildx qemu cross build for arm64 up to 10x.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-29 10:11:02 +02:00
Andrea Terzolo
b759e77fda new(userspace): print if the BPF probe is enabled 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-28 12:25:57 +02:00
Andrea Terzolo
74b6186f7d new(userspace): print enabled sources when falco starts 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-28 12:25:57 +02:00
Mark Stemm
baf5540c30 Remove required_engine_version from falco engine load_rules APIs 
The only use of it was to include in --support output, which is
redundant as the support output already includes the full contents of
each rules file.

Additionally, it wasn't even being updated after the switch from lua
rules loading to c++ rules
loading (https://github.com/falcosecurity/falco/pull/1966/ or
surrounding PRs).

This will simplify follow-on changes to add a real "result" to rules
loading methods, as there will be fewer API variants to support.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-07-25 17:57:42 +02:00
Eric Engberg
c3ddd7d5f1 fix: added arch to bpf download url 
Signed-off-by: Eric Engberg <eric.engberg@hardrockdigital.com>
 2022-07-22 11:06:07 +02:00
Stefano
b378c3a77d Add darryk10 as rules OWNERS as reviewer 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
 2022-07-21 17:42:07 +02:00
Jason Dellaluce
0cab9ba6ed chore(OWNERS): remove duplicates in reviewers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-20 10:39:56 +02:00
Jason Dellaluce
8cb6fc532f cleanup(OWNERS): remove inactive approvers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-20 10:39:56 +02:00
Andrea Terzolo
35db0b4a24 cleanup(userspace): remove unused logic 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
4136a27de1 new(userspace): add exception management 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
e73dbd4b42 new(userspace): add current drop_pct 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Shane Lawrence <shane@lawrence.dev>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
b57a2d5a5f update(userspace): introduce nlohmann json library 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Federico Di Pierro
1bf5f864bc chore(docs): updated release.md template for packages adding aarch64 packages. 
Moreover, updated readme using aarch64 instead of arm64 (same that is used in the badge), and adding "-x86_64" suffix to x86 packages.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-13 12:01:23 +02:00
Alessandro Brucato
c40d1a5141 Update rules/falco_rules.yaml 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-07-13 11:54:23 +02:00
Alessandro Brucato
409ca4382e Update rules/falco_rules.yaml 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>

Co-authored-by: schie <77834235+darryk10@users.noreply.github.com>
 2022-07-13 11:54:23 +02:00
Alessandro Brucato
a71a635b7e Update rules/falco_rules.yaml 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>

Co-authored-by: schie <77834235+darryk10@users.noreply.github.com>
 2022-07-13 11:54:23 +02:00
Alessandro Brucato
07024a2e0f Update rules/falco_rules.yaml 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>

Co-authored-by: schie <77834235+darryk10@users.noreply.github.com>
 2022-07-13 11:54:23 +02:00
Brucedh
6feeaee0cd Added exception to Launch Privileged Container 
Signed-off-by: Alessandro Brucato <alessandro.brucato@sysdig.com>
 2022-07-13 11:54:23 +02:00
Andrea Terzolo
a7153f2fd8 fix(userspace): compute the drop ratio in the right way 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Shane Lawrence <shane@lawrence.dev>
 2022-07-13 09:38:22 +02:00
Ravi Ranjan
c078f7c21d Falco Rules/Conditions Updates 
Signed-off-by: Ravi Ranjan <ravi.ranjan@elastisys.com>
 2022-07-12 12:08:38 +02:00
Aldo Lacuku
46f625c449 chore(engine): remove trailing colon from logs when loading rule files 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-07-12 10:40:43 +02:00
Luca Guerra
4c4ed56c19 update(docs): changelog for version 0.32.1 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-11 11:19:44 +02:00
Luca Guerra
773156de04 update(falco): update libs to 0.7.0 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-11 10:16:43 +02:00
Jason Dellaluce
62c1e875d5 update(userspace/falco): simplify sinsp logger sev decoding 
Co-authored-by: Luca Guerra <luca@guerra.sh>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Jason Dellaluce
7dade32688 refactor(userspace/falco): make sinsp logging part of the configuration (default to false) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Jason Dellaluce
bae68b37ee new(userspace/falco): enable attaching libsinsp logger to the falco one 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Federico Di Pierro
3ddabc3b95 docs(readme): added arm64 mention + packages + badge. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-05 17:46:00 +02:00
Federico Di Pierro
a8b9ec18b0 fix(circleci): properly set BUILD_DIR and SOURCE_DIR to /build and /source respectively. 
Inside job "build-arm64" these are the locations used inside the container.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-05 17:45:01 +02:00
Federico Di Pierro
34404141e4 fix(circleci): share docker socket with docker container. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-05 17:45:01 +02:00
Federico Di Pierro
315b44dc17 new(circleci): enable integration tests for arm64. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-07-05 17:45:01 +02:00
Luca Guerra
161fe6fb3c update(falco): upgrade drivers to 2.0.0, libs to latest rc 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-05 11:02:38 +02:00
Luca Guerra
3cde70eda8 fix(falco): parameter ordering in initialization 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
982e8663be update(gvisor): make gvisor_enable depend on config 
Signed-off-by: Luca Guerra <luca@guerra.sh>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-01 14:17:38 +02:00
Luca Guerra
993516f430 new(falco): add compile-time option to enable or disable gvisor support 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
60b149709d fix(gvisor): formatting 
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-01 14:17:38 +02:00
Luca Guerra
698eda8680 new(gvisor): add option to generate gVisor configuration 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00