github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-04-08 13:02:27 +00:00
Code Issues Projects Releases Wiki Activity
4,465 Commits 127 Branches 184 Tags
fc7a451aedb04b985f5463eb70eefb68ac700bf8
Commit Graph

1460 Commits

Author SHA1 Message Date
Gianmatteo Palmieri
83910be726 new(engine): raise warning instead of error on not-unique exceptions names 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-11 17:22:28 +02:00
Federico Di Pierro
8b340d3903 chore(userspace/falco): watch all configs files. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 15:57:20 +02:00
Federico Di Pierro
e840a4ada0 new(unit_tests,userspace/falco): support loading and merging configs files when used from cmdline option. 
Also, moved core logic from yaml_helper to falco_configuration class.
Finally, updated tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
a8345327d4 chore(unit_tests,userspace/falco): throw an exception when included config file is not present. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
de9efcbec7 new(userspace/falco): allow --support to print expanded configuration file. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
74034213a2 chore(unit_test,userspace): better log management. 
Also, warnings are now returned so that yaml_helper class does not need to log anything.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
aac9b550d3 new(userspace,unit_tests): return loaded config filenames in config::load_from_file. 
Add a debug log with the list of loaded config files.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
df220e3c3b chore(userspace,unit_tests): support loading config files from directories. 
The files inside the folder will be loaded in lexicographic order,
like we do for rules_file.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
d3bf3a7560 chore(userspace/falco,unit_tests): renamed includes to configs_files. 
Moreover, split single huge test into multiple smaller ones.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
1deafee5f7 chore(userspace/falco): print a warn message if -o includes= is passed to cmdline. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
45754fda9f new(userspace,unit_tests): deny main config to include itself. 
Moreover, added a couple more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
8112f6210b chore(userspace,unit_tests): enable override of main config from secondary config files. 
Moreover, do not trigger an exception when an included file is not present; just print a warning.
Finally, add more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Federico Di Pierro
b3ebf9f57e new(userspace,unit_tests): introduce the possibility to split main config file into multiple config files. 
The PR introduces a `includes` keyword in the config file,
that points to a list of strings (paths to other config files).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-04-10 14:44:20 +02:00
Gianmatteo Palmieri
7234bc5bee chore(engine): bump engine version 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-03 18:23:53 +02:00
Gianmatteo Palmieri
05c434ed89 new(engine): enforce unique exceptions names 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-03 18:23:53 +02:00
Luca Guerra
1aae10fe84 update(engine): bump engine checksum and version 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-03-29 10:16:23 +01:00
Luca Guerra
13c8e37a41 cleanup(falco): consolidate falco::grpc::server in one class 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-03-28 10:16:15 +01:00
Gianmatteo Palmieri
7086f35eba new(engine): add warning when appending an exception with no values 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-27 09:15:13 +01:00
Gianmatteo Palmieri
d1707bef63 fix(engine): apply output substitutions for all sources 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-25 19:33:06 +01:00
Melissa Kilby
3b7b3439ec cleanup(metrics): fix build for non linux 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-03-14 10:55:24 +01:00
Melissa Kilby
09d813b22d feat(metrics): sync libs metrics collector refactor 
Includes a handful of naming changes. A notice to
https://falco.org/docs/metrics/falco-metrics/ will be added well
in advance of Falco 0.38.0

falco.hostname -> evt.hostname to be consistent with the newer evt.hostname filtercheck
cpu_usage_perc_total_host -> host_cpu_usage_perc
memory_used_host -> host_memory_used_kb (or host_memory_used_mb)
procs_running_host -> host_procs_running
open_fds_host -> host_open_fds

memory_rss -> memory_rss_kb (or memory_rss_mb)
memory_pss -> memory_pss_kb (or memory_pss_mb)
memory_vsz -> memory_vsz_kb (or memory_vsz_mb)
container_memory_used -> container_memory_used_bytes (or container_memory_used_mb)

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-03-14 10:55:24 +01:00
Andrea Terzolo
0ce2b95b89 chore: bump falco engine version 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-03-12 16:29:17 +01:00
Federico Aponte
8dbec6c779 refactor: Use FetchContent for integrating bundled yaml-cpp lib 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-03-11 13:57:15 +01:00
Federico Aponte
c32b7c1246 refactor: Use FetchContent for integrating bundled cpp-httplib 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-03-11 13:57:15 +01:00
Federico Aponte
bc499e191d refactor: Use FetchContent for integrating bundled nlohman-json lib 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-03-11 13:57:15 +01:00
Gianmatteo Palmieri
517b79ee13 chore(engine): bump engine version 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
7265190e66 new(engine): don't expose details in error message 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
f00926b8af new(engine): error on invalid macro/list name 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Melissa Kilby
5185f152c5 new(config): add falco_libs.thread_table_size 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-03-05 11:36:51 +01:00
Samuel Gaist
8f87b117c4 fix(userspace): correct directory iteration options 
The original code was using follow_directory_symlink twice, this patch
fixes that.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-03-05 10:29:51 +01:00
Samuel Gaist
f9b17b67f8 refactor(engine): fix variable / function shadowing 
Improve variable names in the code surrounding the changes.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-29 16:20:34 +01:00
Samuel Gaist
8a7361c8ab refactor(app): fix variable / function shadowing 
Improve variable names in the code surrounding the changes.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-29 16:20:34 +01:00
Gianmatteo Palmieri
ea781477d6 fix(engine): logical issue in exceptions condition 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-02-28 08:28:26 +01:00
Federico Aponte
f6af72fe76 cleanup: too many includes and useless defines 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
4d66a50d5b fix: pessimizing move warning 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
59c14f46a2 refactor: shared_ptr construction 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
557929a82a refactor: use object rather than unique_ptr 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
9a2b58c6f7 refactor: very minor improvement 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Gianmatteo Palmieri
91e74b1b19 cleanup(build): remove bundled dep check 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-02-23 15:43:08 +01:00
Jason Dellaluce
3b06fb2cbb fix(userspace): solve compilation issues 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Jason Dellaluce
c13cf79aab update(engine): bump engine version 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Jason Dellaluce
0ec2a6c708 refactor(userspace): reduce usage of raw pointers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Jason Dellaluce
b515f0a079 refactor(usersapace): adapt to changes libs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Federico Aponte
745d18ba38 refactor: test AtomicSignalHandler.handle_once_wait_consistency 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-20 15:19:56 +01:00
Samuel Gaist
05e796723f fix(userspace): remove unread variable in restart_handler 
When hitting that part, the restart signal is triggered and the code
leaves the loop, hence setting should_restart as false makes no sense
in this context.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-19 18:01:48 +01:00
Samuel Gaist
ad585cd46b fix(actions): remove unused variable in print_support 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-19 18:01:48 +01:00
Andrea Terzolo
a44bee57d9 fix(CI): fix windows CI 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
d49b21ab22 cleanup: move ebpf default value logic 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Andrea Terzolo
99781f7936 cleanup(configuration): cleanup deprecated code 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-16 18:30:38 +01:00
Samuel Gaist
5e497a4119 fix(c++): improve const correctness 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-15 22:16:33 +01:00