13 Commits

Author SHA1 Message Date
Mark Stemm
53c7e101fe Add netcat to docker images (#456)
It may be useful as a way to enable generic event forwarding.

This fixes https://github.com/falcosecurity/falco/issues/433.
2018-11-05 17:50:53 -08:00
TaoBeier
bc34e438ce fix deprecated statement. (#429)
falco-CLA-1.0-signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2018-10-12 19:43:57 -07:00
Mark Stemm
6445cdb950 Better copyright notices (#426)
* Use correct copyright years.

Also include the start year.

* Improve copyright notices.

Use the proper start year instead of just 2018.

Add the right owner Draios dba Sysdig.

Add copyright notices to some files that were missing them.
2018-09-26 19:49:19 -07:00
Brett Bertocci
fc70c635d1 Add dkms+xz dependencies to falco container 2018-09-25 12:06:19 -07:00
Mark Stemm
2352b96d6b Change license to Apache 2.0 (#419)
Replace references to GNU Public License to Apache license in:

 - COPYING file
 - README
 - all source code below falco
 - rules files
 - rules and code below test directory
 - code below falco directory
 - entrypoint for docker containers (but not the Dockerfiles)

I didn't generally add copyright notices to all the examples files, as
they aren't core falco. If they did refer to the gpl I changed them to
apache.
2018-09-20 11:47:10 -07:00
Mark Stemm
ab0413a9ee Downgrade binutils in docker image (#397)
debian:unstable head contains binutils 2.31, which generates binaries
that are incompatible with kernels < 4.16.

To fix this, after installing everything, downgrade binutils to
2.30-22. This has to be done as the last step as it introduces conflicts
in other dependencies of the various gcc versions and some of the
packages already in the image.
2018-07-31 10:44:47 -07:00
Brett Bertocci
7289315837 Ensure the /lib/modules symlink to /host/lib/modules is set correctly
If /lib/modules exists in the base image, the symlink will get created at
/lib/modules/modules. This removes any existing empty directory but will
fail if we try to remove a non-empty /lib/modules. (Punting on how to
handle non-empty base image dirs for now)
2018-07-16 13:42:41 -07:00
Michael Ducy
81a38fb909 add gcc-6 to Dockerfiles: (#382) 2018-06-12 13:07:15 -07:00
Gianluca Borello
2a7851c77b eBPF support for Falco 2018-05-09 14:15:10 -07:00
David Archer
73e1ae616a Don't make driver compilation fail when kernel is compiled with CONFIG_ORC_UNWINDER or CONFIG_STACK_VALIDATION. (#362)
sysdig-CLA-1.0-signed-off-by: David Archer <darcher@gmail.com>
2018-04-30 14:40:28 -07:00
Luca Marturana
ba6d6dbf9d Use gcc 5 by default to compile properly on Ubuntu Xenial, remove gcc 4.9 since CentOS does not work anyway due to glibc 2018-02-27 09:39:13 -08:00
Mark Stemm
ec5adfe892 Build and package standalone falco kernel module
Start packaging (and building when necessary) a falco-specific kernel
module in falco releases. Previously, falco would depend on sysdig and
use its kernel module instead.

The kernel module was already templated to some degree in various
places, so we just had to change the templated name from
sysdig/sysdig-probe to falco/falco-probe.

In containers, run falco-probe-loader instead of
sysdig-probe-loader. This is actually a script in the sysdig repository
which is modified in https://github.com/draios/sysdig/pull/789, and uses
the filename to indicate what kernel module to build and/or load.

For the falco package itself, don't depend on sysdig any longer but instead
depend on dkms and its dependencies, using sysdig as a guide on the set
of required packages.

Additionally, for the package pre-install/post-install scripts start
running falco-probe-loader.

Finally, add a --version argument to falco so it can pass the desired
version string to falco-probe-loader.
2017-03-20 15:56:37 -07:00
Mark Stemm
10d0c8f982 Add a local dockerfile variant.
Add a local dockerfile variant that allows creating an image from a
local .deb package.
2017-01-17 10:24:38 -08:00