github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-04 02:16:46 +00:00
Code Issues Projects Releases Wiki Activity
4,513 Commits 117 Branches 173 Tags 104 MiB
f18ea1e8b7
Commit Graph

4513 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Dellaluce
65993ad1ed refactor(userspace/falco): support multiple parallel event processing loops 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
f4c6a81ed8 update(userspace/falco): fix plugin list access in rule file loading action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
f9a152b24c refactor(userspace/falco): generalize responsibilities of init_inspector action 
Now, the action takes care of inizializing all app inspectors
(just one in capture mode, one for each evt source in live mode), and of
registering and initializing all loaded plugins in the right inspector as needed.
The plugin initialization logic, which also involves the filtercheck list
population and checks, was moved and refactored from the previous
implementation of the load_plugins action.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
ed025f1a86 refactor(userspace/falco): init all event sources in falco engine and in the right order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
8ba779de8c refactor(userspace/falco): restrict load_plugins action responsibilities 
Now, the action is in charge of loading all plugins and initializing:
- the offline inspector
- the list of loaded event sources
- the list of loaded plugins and their config

After this action runs, plugins are loaded but not yet initialized.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
cf8b85ad86 refactor(userspace/falco): turn open inspector action into convenience private methods 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
9cf3d118f6 update(userspace/falco): restrict clients init action to syscall inspector only 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
63bdc1119f cleanup(userspace/falco): remove legacy hacks on source selection action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
9dc3eb2fc6 update(userspace/falco): reorder actions for their new semantics 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
7bb319b21e update(userspace/falco): add convenience method for merging app run results 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
3f7d61f150 refactor(userspace/falco): re-design application state and methods 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
cf9baea624 fix(userspace/engine): avoid reading duplicate exception values 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 15:53:15 +02:00
Federico Di Pierro
ccd3c896de fix(userspace/engine): properly include stdexcept header to fix build. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-12 12:28:15 +02:00
Federico Di Pierro
11644ecafc chore(userspace/falco): be somewhat more portable, avoiding assuming that '/' is the path delim. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-09 09:59:06 +02:00
Federico Di Pierro
23df49a47f new(userspace/falco): create grpc unix socket and gvisor endpoint path automatically. 
It is also able to handle multipart paths, like /run/falco/falco/falco/falco.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-09 09:59:06 +02:00
Federico Di Pierro
3e1ef070b8 fix(circleci): falco-driver-loader image build must be done starting from just-pushed falco master image. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-09-07 16:04:04 +02:00
Aldo Lacuku
670b0733de apply suggestions from the review 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-07 10:14:03 +02:00
Aldo Lacuku
752c3d8332 update(scripts/falco-driver-loader): minikube environment is now correctly detected 
If there is a file in `/etc/VERSION` the script assumes that it is running in a minikube
enviroment. Furthermore the logic in building the `KERNEL_VERSION` has been updated
according to how the kernel and probe modules are saved in the S3 bucket. The kernel version
for the minikube kernels includes also the minikube version.

Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-09-07 10:14:03 +02:00
Aldo Lacuku
daba85b61c update(scripts/falco-driver-loader): make some config variables configurable using env variables 
When running falco-driver-loader in local we need to set some config variables to meaningful values.
Those variables usually are set by the CI during the image/packages builds. The changes introduced
by this commit allow to set them at start-up time using env variables

Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-09-07 10:14:03 +02:00
Mark Stemm
103d7e08b8 Update tests for rules loading (item names) 
Update a few tests related to rules loading to use new names for
items (e.g. "rules content" for top level errors instead of "file")

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
Mark Stemm
0f45cf49db Use enums for rules content item type 
Use an enum instead of a string for the item_type aka "parts of a
rules file" field of contexts.

The set of values is mostly defined by the contexts that were already
created. There are a couple of forward-looking values for rule
outputs/macro conditions/etc. that may be useful for later.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
Mark Stemm
7a5a4c32ee Support condition parse errors in rule loading results 
In #2098 and #2158, we reworked how rules loading errors/warnings were
returned to provide a richer set of information, including
locations/context for the errors/warnings.

That did *not* include locations within condition expressions,
though. When parsing a condition expression resulted in a
warning/error, the location simply pointed to the condition property
of the rule.

This commit improves this to handle parse errors:

- When libsinsp::filter::parser::parse() throws an exception, use
  get_pos() to get the position within the condition string.
- Add a new context() constructor that takes a filter pos_info instead
  of a YAML::Mark.

Now that positions aren't always related to the location of yaml
nodes, Make up a generic "position" struct for locations and convert
YAML::Mark and parser positions to a position struct.

Also allow a context to contain an alternate content string which is
used to build the snippet. For contexts related to condition strings,
the content is the condition.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
VadimZy
af95455bab dropping fix for list parsing due to the absence of regex portability. 
reverting to the inefficient code.

Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
4b75f213c6 use <onigposix.h> instead of <regex.h> 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
0de617a7fb remove sinsp.h public dependencies 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
5745faeccc fix tests, remove dead code 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
f9ee45b38e Improve Falco engine performance when loading rules and creating the rule sets 
- replace std::set<uint16_t> with fixed size vector in event types propagation
- rework lists expansion by replacing repetitive string::find in constantly growing expansion string with regex tokenization
- improve json_event parsing by moving const initializations into static routines

Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
Jason Dellaluce
7d2f82fddc update(usperspace/engine): bump engine version to 15 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
0956bac0de tests: add unit tests for plugin requirements checks in the engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
1b410ea2cc update(userspace/engine): consider plugin version requirements in engine checks 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
52402ac805 update(userspace/engine): support plugin version requirement alternatives in rule reader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
6e0971f1e1 update(userspace/engine): support plugin version requirement alternatives in rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Andrea Terzolo
934ae2f1a6 update(OWNERS): add Andrea Terzolo to owners 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-02 12:14:42 +02:00
Leonardo Grasso
fab95f38a9 update(.circleci): re-enabled cppcheck 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-09-02 08:54:27 +02:00
Mauro Ezequiel Moltrasio
0be0191c53 Add StackRox to adopters 
Co-authored-by: mfosterrox <mfoster@redhat.com>
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
 2022-09-01 22:33:25 +02:00
Melissa Kilby
5dcc329339 chore(rules): change FALCO_ENGINE_VERSION to 13 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-09-01 14:45:23 +02:00
Melissa Kilby
721aa30e80 cleanup(rules): cleanup redundant use of always_true macros - 2 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-09-01 14:45:23 +02:00
Melissa Kilby
565ddd70d3 cleanup(rules): cleanup rules disabled by default - 4 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-09-01 14:45:23 +02:00
Leonardo Grasso
c000695816 docs(README.md): cross linking resources and minor improvements 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-31 15:27:42 +02:00
Leonardo Grasso
d67edeb39d docs(README.md): update URLs 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-31 15:27:42 +02:00
Leonardo Grasso
1a22bfc654 docs(README.md): remove client-rs and client-py SDKs 
Those SDKs are now archived projects, see:
 - https://github.com/falcosecurity/evolution/issues/161
 - https://github.com/falcosecurity/evolution/issues/162

Hoping we can restore them in the future.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-31 15:27:42 +02:00
Federico Di Pierro
bd865450ef new(scripts): improved falco-driver-loader supporting any ubuntu flavor. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-08-30 12:25:37 +02:00
Jason Dellaluce
98b8e390a1 chore(rules): fix old url redirection 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-29 15:42:33 +02:00
Jason Dellaluce
6c1f908ca5 cleanup(cmake): rename legacy cmake variables 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-29 15:42:33 +02:00
Jason Dellaluce
574a4b9f0a update(userspace/falco): fix copyright notice year 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
c05ad6fde4 update(userspace/falco): fix copyright notice year 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
e361069092 chore(userspace/falco): fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
9c6ad6ce84 update(userspace/falco): use json lib in stats writer 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
2d8efee73e refactor(userspace/falco): improve design and docs of stats writer 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
28ff6ad3bd refactor(userspace/falco): rename stats writer source files 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00