github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-25 14:22:15 +00:00
Code Issues Projects Releases Wiki Activity
4,513 Commits 121 Branches 172 Tags 104 MiB
f18ea1e8b7
Commit Graph

4513 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Melissa Kilby
4ed11d90a4 chore: rename plugin name to more expressive anomalydetection term 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-02-22 10:20:05 +01:00
Melissa Kilby
bf55a7e86e update(proposals): minor enhancements and falco community call feedback 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-02-22 10:20:05 +01:00
Melissa Kilby
2f2bd6e93e update(proposals): minor enhancements and kubeconna23 feedback 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-02-22 10:20:05 +01:00
Melissa Kilby
534afca5f5 new(proposals): introduce on host anomaly detection framework 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-02-22 10:20:05 +01:00
Federico Di Pierro
71a0d0d186 fix(cmake): properly let falcoctl cmake module create /usr/share/falco/plugins/ folder. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-21 10:05:02 +01:00
Federico Aponte
b4e55ee6a1 cleanup: falco_engine test fixture 
Upgrade GTest to 1.14.0

Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-21 00:31:59 +01:00
Federico Aponte
745d18ba38 refactor: test AtomicSignalHandler.handle_once_wait_consistency 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-20 15:19:56 +01:00
Samuel Gaist
05e796723f fix(userspace): remove unread variable in restart_handler 
When hitting that part, the restart signal is triggered and the code
leaves the loop, hence setting should_restart as false makes no sense
in this context.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-19 18:01:48 +01:00
Samuel Gaist
ad585cd46b fix(actions): remove unused variable in print_support 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-19 18:01:48 +01:00
Samuel Gaist
e07f056fc5 fix(tests): remove unused variables in rule loader tests 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-19 18:01:48 +01:00
Federico Di Pierro
1178a0505c cleanup(submodules): dropped testing submodule. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-19 17:06:48 +01:00
Federico Di Pierro
fbe45125ae cleanup(ci): make use of falcosecurity/testing provided composite action. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-19 10:56:47 +01:00
Andrea Terzolo
a44bee57d9 fix(CI): fix windows CI 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
d49b21ab22 cleanup: move ebpf default value logic 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
76ab28ff59 tests: remove deprecated assertions 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
99781f7936 cleanup(configuration): cleanup deprecated code 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
9c182d23f6 cleanup(falco.yaml)!: remove deprecated configs 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Samuel Gaist
5e497a4119 fix(c++): improve const correctness 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-15 22:16:33 +01:00
dependabot[bot]
792bcdca18 build(deps): Bump submodules/falcosecurity-testing 
Bumps [submodules/falcosecurity-testing](https://github.com/falcosecurity/testing) from `ae3950a` to `7abf76f`.
- [Commits](ae3950acf0...7abf76f2a0)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-testing
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-15 19:41:33 +01:00
Luca Guerra
5564d3da11 cleanup(app): ensure unbuffered_outputs is initialized 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-15 11:03:30 +01:00
Luca Guerra
fe5c58e20e cleanup(tests): use test_falco_engine in test_enable_rule 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-15 11:03:30 +01:00
Luca Guerra
baf9e77810 cleanup(tests): update configure_interesting_sets to use test_falco_engine 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-15 11:03:30 +01:00
Luca Guerra
1afacb45fb cleanup(tests): extract engine fixture 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-15 11:03:30 +01:00
Luca Guerra
12f57514ad cleanup(tests): pass a valid inspector to factory/ast/filter tests 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-15 11:03:30 +01:00
Samuel Gaist
e18acc361e fix(c++): don't throw outside of the try catch block in nothrow function 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-15 10:19:30 +01:00
Samuel Gaist
f3491d62c9 fix(c++): re-throw original exception rather than copy 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-15 10:19:30 +01:00
Federico Aponte
7a18795ca5 cleanup: falco_engine deps and include paths 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-15 10:08:30 +01:00
Federico Aponte
539dac0590 fix: Some compiler warnings 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-15 10:07:30 +01:00
dependabot[bot]
14650f49b6 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `0f60976` to `497e011`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](0f609769ef...497e01189e)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-14 19:38:27 +01:00
Andrea Terzolo
26add16d12 cleanup(docker)!: remove unused builder dockerfile 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-14 17:10:26 +01:00
Federico Di Pierro
3476555ad1 update(docs): added CHANGELOG entry for 0.37.1 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-13 10:37:21 +01:00
Melissa Kilby
3c2bd8d4d8 cleanup: minor adjustments to readme, add new testing section 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-02-13 10:21:22 +01:00
dependabot[bot]
f268f45923 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `6ed2036` to `0f60976`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](6ed2036d83...0f609769ef)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-12 18:46:18 +01:00
Samuel Gaist
8c98ca5e8d fix(c++): add missing member initialisation to grpc server 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 18:45:18 +01:00
Samuel Gaist
d6b0810657 fix(c++): move trivial initializations to declaration site 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 18:45:18 +01:00
Samuel Gaist
42f90817ad refactor: make falco_exception a std::runtime_error 
The implementation provides more or less the same implementation
and thus it makes more sense to base it on std::runtime_error.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 18:45:18 +01:00
Samuel Gaist
f6498cd8bd fix(c++): refactor member initialization in constructor initialization list 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>

# Conflicts:
#	userspace/engine/falco_common.h
 2024-02-12 18:45:18 +01:00
Tom Müller
8bc32d248e Added http headers option for driver download in docker images 
Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
 2024-02-12 18:03:17 +01:00
Samuel Gaist
08f62200b1 fix(c++): add missing explicit to single argument constructors 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 16:59:17 +01:00
dependabot[bot]
48a7f3bcb4 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `1053b2d` to `6ed2036`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](1053b2d1b6...6ed2036d83)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-12 14:55:16 +01:00
Federico Di Pierro
6c29fdb1e5 update(cmake): bumped falcoctl to v0.7.2. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-12 11:13:16 +01:00
Jason Dellaluce
0cc1c5b44f refactor(userspace/engine): reduce allocations during rules loading 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-09 14:50:05 +01:00
Luca Guerra
d69f329b54 fix(ci): update sync in deb and rpm scripts with acl 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-09 10:33:04 +01:00
Samuel Gaist
a9e1bfef42 fix(c++): add missing overrides 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-09 08:24:03 +01:00
Federico Di Pierro
7879920570 chore(userspace/engine): introduce proper check to avoid future issues throwing an exception. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-08 15:13:59 +01:00
Federico Di Pierro
7bcbc08b52 fix(userspace/engine): always consider all rules (even the ones below min_prio) in m_rule_stats_manager. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-08 15:13:59 +01:00
Tom Müller
71f3c77a1a fixed typo in print usage 
fixed typo in the print usage description of the docker run command

Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
 2024-02-08 10:16:59 +01:00
Tom Müller
56a4e31d18 added option for insecure http driver download 
added option for insecure http driver download to the falco docker entrypoint.

Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
 2024-02-08 10:16:59 +01:00
Tom Müller
159e3f6ffc added insecure http driver download 
added insecure http driver download to the driver-loader-legacy entrypoint.

Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
 2024-02-08 10:16:59 +01:00
Tom Müller
f62c38e9e8 added option for insecure http download 
Added option for insecure http driver download in the docker-entrypoint.sh script. By passing --http-insecure to the container via an argument, the flag is forwarded to the falcoctl driver install command.

Signed-off-by: Tom Müller <60851960+toamto94@users.noreply.github.com>
 2024-02-08 10:16:59 +01:00