new(ci): run driver loader tests on arm64 too.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

.github/workflows/release.yaml

@@ -147,7 +147,7 @@ jobs:
           sed -i s/FALCOVER/${{ github.event.release.tag_name }}/g release-body.md
           
       - name: Generate release notes
-        uses: leodido/rn2md@1378404a058ecf86701f3ab533d487333fc675a7
+        uses: leodido/rn2md@0669e5f3b21492c11c2db43cd6e267566f5880f3
         with:
           milestone: ${{ github.event.release.tag_name }}
           output: ./notes.md

.github/workflows/reusable_build_packages.yaml

@@ -119,9 +119,7 @@ jobs:
             ${{ github.workspace }}/build/falco-*.rpm
             
   build-musl-package:
-    # x86_64 only for now
-    if: ${{ inputs.arch == 'x86_64' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ (inputs.arch == 'aarch64' && 'actuated-arm64-8cpu-16gb') || 'ubuntu-latest' }}
     container: alpine:3.17
     steps:
       # Always install deps before invoking checkout action, to properly perform a full clone.
@@ -152,14 +150,14 @@ jobs:
       - name: Rename static package
         run: |
           cd build
-          mv falco-${{ inputs.version }}-x86_64.tar.gz falco-${{ inputs.version }}-static-x86_64.tar.gz 
+          mv falco-${{ inputs.version }}-${{ inputs.arch }}.tar.gz falco-${{ inputs.version }}-static-${{ inputs.arch }}.tar.gz 
           
       - name: Upload Falco static package
         uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
-          name: falco-${{ inputs.version }}-static-x86_64.tar.gz
+          name: falco-${{ inputs.version }}-static-${{ inputs.arch }}.tar.gz
           path: |
-            ${{ github.workspace }}/build/falco-${{ inputs.version }}-static-x86_64.tar.gz
+            ${{ github.workspace }}/build/falco-${{ inputs.version }}-static-${{ inputs.arch }}.tar.gz
 
   build-wasm-package:
     if: ${{ inputs.arch == 'x86_64' }}

.github/workflows/reusable_publish_packages.yaml

@@ -70,8 +70,14 @@ jobs:
         with:
           name: falco-${{ inputs.version }}-static-x86_64.tar.gz
           path: /tmp/falco-build-bin-static
-
-      - name: Import gpg key
+          
+      - name: Download static binary aarch64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-static-aarch64.tar.gz
+          path: /tmp/falco-build-bin-static    
+        
+      - name: Import gpg key 
         env:
           GPG_KEY: ${{ secrets.GPG_KEY }}
         run: printenv GPG_KEY | gpg --import -
@@ -93,6 +99,7 @@ jobs:
       - name: Publish static
         run: |
           ./scripts/publish-bin -f /tmp/falco-build-bin-static/falco-${{ inputs.version }}-static-x86_64.tar.gz -r bin${{ inputs.bucket_suffix }} -a x86_64
+          ./scripts/publish-bin -f /tmp/falco-build-bin-static/falco-${{ inputs.version }}-static-aarch64.tar.gz -r bin${{ inputs.bucket_suffix }} -a aarch64
           
   publish-packages-deb:
     runs-on: ubuntu-latest

.github/workflows/reusable_test_packages.yaml

@@ -19,7 +19,7 @@ on:
 jobs:
   test-packages:
     # See https://github.com/actions/runner/issues/409#issuecomment-1158849936
-    runs-on: ${{ (inputs.arch == 'aarch64' && 'actuated-arm64-8cpu-16gb') || 'ubuntu-22.04' }}
+    runs-on: ${{ (inputs.arch == 'aarch64' && 'actuated-arm64-8cpu-16gb') || 'ubuntu-latest' }}
     steps:
       - name: Checkout
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
@@ -43,18 +43,8 @@ jobs:
           tar -xvf $(ls falco-*.tar.gz)
           cd falco-${{ inputs.version }}-${{ inputs.arch }}
           sudo cp -r * /
-      
-      # Note: most probably the plugin related tests should be moved to the plugin repo sooner or later.
-      - name: Install needed artifacts using falcoctl
-        if: ${{ inputs.static == false }}
-        run: |
-          sudo mkdir -p /usr/share/falco/plugins
-          sudo falcoctl artifact install k8saudit-rules
-          sudo falcoctl artifact install cloudtrail-rules
-     
-      # We only run driver loader tests on x86_64
+
       - name: Install dependencies for falco-driver-loader tests
-        if: ${{ inputs.arch == 'x86_64' }}
         run: |
           sudo apt update -y
           sudo apt install -y --no-install-recommends build-essential clang make llvm gcc dkms linux-headers-$(uname -r)
@@ -81,9 +71,7 @@ jobs:
           if ${{ inputs.static && 'false' || 'true' }}; then
             ./build/falcoctl.test -test.timeout=90s -test.v >> ./report.txt 2>&1 || true
             ./build/k8saudit.test -test.timeout=90s -test.v >> ./report.txt 2>&1 || true
-            if ${{ inputs.arch == 'x86_64' && 'true' || 'false' }}; then
-                sudo ./build/falco-driver-loader.test -test.timeout=90s -test.v >> ./report.txt 2>&1 || true
-            fi    
+            sudo ./build/falco-driver-loader.test -test.timeout=90s -test.v >> ./report.txt 2>&1 || true
           fi
           cat ./report.txt | go-junit-report -set-exit-code > report.xml
           popd

.gitignore

@@ -5,4 +5,3 @@
 .vscode/*
 
 *.idea*
-CMakeUserPresets.json

CMakeLists.txt

@@ -180,6 +180,7 @@ include(static-analysis)
 # Shared build variables
 set(FALCO_SINSP_LIBRARY sinsp)
 set(FALCO_SHARE_DIR share/falco)
+set(FALCO_PLUGINS_DIR ${FALCO_SHARE_DIR}/plugins)
 set(FALCO_ABSOLUTE_SHARE_DIR "${CMAKE_INSTALL_PREFIX}/${FALCO_SHARE_DIR}")
 set(FALCO_BIN_DIR bin)
 
@@ -188,6 +189,7 @@ add_subdirectory(userspace/engine)
 add_subdirectory(userspace/falco)
 
 if(NOT WIN32 AND NOT APPLE AND NOT EMSCRIPTEN AND NOT MUSL_OPTIMIZED_BUILD)
+  include(plugins)
   include(falcoctl)
 endif()
 

README.md

@@ -2,7 +2,7 @@
 
 [![Latest release](https://img.shields.io/github/v/release/falcosecurity/falco?style=for-the-badge)](https://github.com/falcosecurity/falco/releases/latest) [![Supported Architectures](https://img.shields.io/badge/ARCHS-x86__64%7Caarch64-blueviolet?style=for-the-badge)](https://github.com/falcosecurity/falco/releases/latest) [![License](https://img.shields.io/github/license/falcosecurity/falco?style=for-the-badge)](COPYING) [![Docs](https://img.shields.io/badge/docs-latest-green.svg?style=for-the-badge)](https://falco.org/docs)
 
-[![Falco Core Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-core-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#core-scope) [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable)  [![OpenSSF Best Practices](https://img.shields.io/cii/summary/2317?label=OpenSSF%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317) <a href="https://actuated.dev/"><img alt="Arm CI sponsored by Actuated" src="https://docs.actuated.dev/images/actuated-badge.png" width="120px"></img></a>
+[![Falco Core Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-core-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#core-scope) [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable)  [![OpenSSF Best Practices](https://img.shields.io/cii/summary/2317?label=OpenSSF%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317)
 
 [![Falco](https://falco.org/img/brand/falco-horizontal-color.svg)](https://falco.org)
 

cmake/modules/CPackConfig.cmake

@@ -44,6 +44,11 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux") # only Linux has drivers
     "${CMAKE_CURRENT_BINARY_DIR};${DRIVER_COMPONENT_NAME};${DRIVER_COMPONENT_NAME};/")
 endif()
 
+if(NOT WIN32 AND NOT APPLE AND NOT EMSCRIPTEN AND NOT MUSL_OPTIMIZED_BUILD) # static builds do not have plugins
+  list(APPEND CPACK_INSTALL_CMAKE_PROJECTS
+    "${CMAKE_CURRENT_BINARY_DIR};${PLUGINS_COMPONENT_NAME};${PLUGINS_COMPONENT_NAME};/")
+endif()
+
 if(NOT CPACK_GENERATOR)
   if (CMAKE_SYSTEM_NAME MATCHES "Linux")
     set(CPACK_GENERATOR DEB RPM TGZ)

cmake/modules/driver.cmake

@@ -34,8 +34,8 @@ else()
   # In case you want to test against another driver version (or branch, or commit) just pass the variable -
   # ie., `cmake -DDRIVER_VERSION=dev ..`
   if(NOT DRIVER_VERSION)
-    set(DRIVER_VERSION "7.0.0+driver")
-    set(DRIVER_CHECKSUM "SHA256=9f2a0f14827c0d9d1c3d1abe45b8f074dea531ebeca9859363a92f0d2475757e")
+    set(DRIVER_VERSION "000d576ef877cb115cbb56f97187a1d62221e2bd")
+    set(DRIVER_CHECKSUM "SHA256=4f078e3e448ba1d4ca2eff55a361a9a9d048f3a967fb4d91f0c91aa6fa22d5d2")
   endif()
 
   # cd /path/to/build && cmake /path/to/source

cmake/modules/falcoctl.cmake

@@ -16,14 +16,14 @@ include(ExternalProject)
 
 string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} FALCOCTL_SYSTEM_NAME)
 
-set(FALCOCTL_VERSION "0.7.1")
+set(FALCOCTL_VERSION "0.6.2")
 
 if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
     set(FALCOCTL_SYSTEM_PROC_GO "amd64")
-    set(FALCOCTL_HASH "f142507c0e2b1e7dc03fd0b1ec36b479eb171f1f58c17f90d2d8edeb00668ef5")
+    set(FALCOCTL_HASH "2d06d7577dbae91fb085f71477ff6e22076a815978bddd036984fa077236a515")
 else() # aarch64
     set(FALCOCTL_SYSTEM_PROC_GO "arm64")
-    set(FALCOCTL_HASH "93e4800b68e21057da82c8c7aafa0970598594d62cd9929ebb9b38a9c02159a6")
+    set(FALCOCTL_HASH "0b711a1b3499f479d999f4f4d2c94fc4f0bc23a2506711b613e6eedb0593631b")
 endif()
 
 ExternalProject_Add(

cmake/modules/falcosecurity-libs.cmake

@@ -35,8 +35,8 @@ else()
   # In case you want to test against another falcosecurity/libs version (or branch, or commit) just pass the variable -
   # ie., `cmake -DFALCOSECURITY_LIBS_VERSION=dev ..`
   if(NOT FALCOSECURITY_LIBS_VERSION)
-    set(FALCOSECURITY_LIBS_VERSION "0.14.1")
-    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=defdea24bf3b176c63f10900d3716fe4373151965cc09d3fe67a31a3a9af0b13")
+    set(FALCOSECURITY_LIBS_VERSION "000d576ef877cb115cbb56f97187a1d62221e2bd")
+    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=4f078e3e448ba1d4ca2eff55a361a9a9d048f3a967fb4d91f0c91aa6fa22d5d2")
   endif()
 
   # cd /path/to/build && cmake /path/to/source
@@ -85,7 +85,6 @@ set(BUILD_LIBSCAP_EXAMPLES OFF CACHE BOOL "")
 
 set(USE_BUNDLED_TBB ON CACHE BOOL "")
 set(USE_BUNDLED_JSONCPP ON CACHE BOOL "")
-set(USE_BUNDLED_NLOHMANN_JSON ON CACHE BOOL "")
 set(USE_BUNDLED_VALIJSON ON CACHE BOOL "")
 set(USE_BUNDLED_RE2 ON CACHE BOOL "")
 set(USE_BUNDLED_UTHASH ON CACHE BOOL "")

cmake/modules/njson.cmake

@@ -12,16 +12,24 @@
 # specific language governing permissions and limitations under the License.
 #
 
-if(USE_BUNDLED_NLOHMANN_JSON)
-    ExternalProject_Add(njson
+#
+# nlohmann-json
+#
+if(NJSON_INCLUDE)
+    # Adding the custom target we can use it with `add_dependencies()`
+    if(NOT TARGET njson)
+        add_custom_target(njson)
+    endif()
+else()
+    # We always use the bundled version
+    set(NJSON_SRC "${PROJECT_BINARY_DIR}/njson-prefix/src/njson")
+    set(NJSON_INCLUDE "${NJSON_SRC}/single_include")
+    ExternalProject_Add(
+        njson
         URL "https://github.com/nlohmann/json/archive/v3.3.0.tar.gz"
         URL_HASH "SHA256=2fd1d207b4669a7843296c41d3b6ac5b23d00dec48dba507ba051d14564aa801"
-        CMAKE_ARGS -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${PROJECT_BINARY_DIR}/njson-prefix -DJSON_BuildTests=OFF -DBUILD_TESTING=OFF
-    )
-
-    set(nlohmann_json_INCLUDE_DIRS ${PROJECT_BINARY_DIR}/njson-prefix/include)
-else()
-    find_package(nlohmann_json CONFIG REQUIRED)
-    get_target_property(nlohmann_json_INCLUDE_DIRS nlohmann_json::nlohmann_json INTERFACE_INCLUDE_DIRECTORIES)
-    add_custom_target(njson)
+        CONFIGURE_COMMAND ""
+        BUILD_COMMAND ""
+        INSTALL_COMMAND "")
+    message(STATUS "Using bundled nlohmann-json in '${NJSON_SRC}'")
 endif()

cmake/modules/plugins.cmake

@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+include(ExternalProject)
+
+# 'stable' or 'dev'
+set(PLUGINS_DOWNLOAD_BUCKET "stable")
+
+string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} PLUGINS_SYSTEM_NAME)
+
+if(NOT DEFINED PLUGINS_COMPONENT_NAME)
+    set(PLUGINS_COMPONENT_NAME "${CMAKE_PROJECT_NAME}-plugins")
+endif()
+
+# k8saudit
+set(PLUGIN_K8S_AUDIT_VERSION "0.6.1")
+if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+    set(PLUGIN_K8S_AUDIT_HASH "e2908ebf2c03feecd26307ceab55aec9cae1cbc63d6aa05e147d8786e7670fb0")
+else() # aarch64
+    set(PLUGIN_K8S_AUDIT_HASH "8987a995fa09518aebc488ba549448166d605596c2d6478c10415a9d9f5f05dd")
+endif()
+
+ExternalProject_Add(
+  k8saudit-plugin
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/k8saudit-${PLUGIN_K8S_AUDIT_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL_HASH "SHA256=${PLUGIN_K8S_AUDIT_HASH}"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  INSTALL_COMMAND "")
+
+install(FILES "${PROJECT_BINARY_DIR}/k8saudit-plugin-prefix/src/k8saudit-plugin/libk8saudit.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
+
+ExternalProject_Add(
+  k8saudit-rules
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/k8saudit-rules-${PLUGIN_K8S_AUDIT_VERSION}.tar.gz"
+  URL_HASH "SHA256=36321b3f1d7969926073a4d40bbbb7b4b28805b038c067f140795210ab641161"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  INSTALL_COMMAND "")
+
+install(FILES "${PROJECT_BINARY_DIR}/k8saudit-rules-prefix/src/k8saudit-rules/k8s_audit_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
+
+# cloudtrail
+set(PLUGIN_CLOUDTRAIL_VERSION "0.9.0")
+if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+    set(PLUGIN_CLOUDTRAIL_HASH "c8dc8ea5337aa9475042e6441320a5188bbf76977e3a69dd34a49a6251f8e9ad")
+else() # aarch64
+    set(PLUGIN_CLOUDTRAIL_HASH "bea12e81409c3df5698f7ab6a740ee9698b9dd1275b5985810daf70ac505c810")
+endif()
+
+ExternalProject_Add(
+  cloudtrail-plugin
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/cloudtrail-${PLUGIN_CLOUDTRAIL_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL_HASH "SHA256=${PLUGIN_CLOUDTRAIL_HASH}"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  INSTALL_COMMAND "")
+
+install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-plugin-prefix/src/cloudtrail-plugin/libcloudtrail.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
+
+ExternalProject_Add(
+  cloudtrail-rules
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/cloudtrail-rules-${PLUGIN_CLOUDTRAIL_VERSION}.tar.gz"
+  URL_HASH "SHA256=b0c2b6c78d61cc3e7fb66445bcd8f763d15eb4a24f518385377e704aacec6b3f"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  INSTALL_COMMAND "")
+
+install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-rules-prefix/src/cloudtrail-rules/aws_cloudtrail_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
+
+# json
+set(PLUGIN_JSON_VERSION "0.7.1")
+if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+    set(PLUGIN_JSON_HASH "3177fd667b384df2ffd2ae3260bda867c407c09d3fbcae841af204b82c1341c1")
+else() # aarch64
+    set(PLUGIN_JSON_HASH "3b5d0a9190bfd08e21915f997f88ca314f2027564a022eb88eef80ff4e2c77fa")
+endif()
+
+ExternalProject_Add(
+  json-plugin
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/json-${PLUGIN_JSON_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL_HASH "SHA256=${PLUGIN_JSON_HASH}"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  INSTALL_COMMAND "")
+
+install(FILES "${PROJECT_BINARY_DIR}/json-plugin-prefix/src/json-plugin/libjson.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")

cmake/modules/rules.cmake

@@ -16,8 +16,8 @@ include(GNUInstallDirs)
 include(ExternalProject)
 
 # falco_rules.yaml
-set(FALCOSECURITY_RULES_FALCO_VERSION "falco-rules-3.0.0-rc1")
-set(FALCOSECURITY_RULES_FALCO_CHECKSUM "SHA256=2e91799fee49c2daf58fb482e47410a21433eb116e02cde18206f7af87449ddb")
+set(FALCOSECURITY_RULES_FALCO_VERSION "falco-rules-2.0.0")
+set(FALCOSECURITY_RULES_FALCO_CHECKSUM "SHA256=48b6c5ae7a619a320eb51dbe036d1bc78622ab692956c9493390678874757b32")
 set(FALCOSECURITY_RULES_FALCO_PATH "${PROJECT_BINARY_DIR}/falcosecurity-rules-falco-prefix/src/falcosecurity-rules-falco/falco_rules.yaml")
 ExternalProject_Add(
   falcosecurity-rules-falco

docker/driver-loader-legacy/docker-entrypoint.sh

@@ -18,28 +18,6 @@
 #
 
 
-print_usage() {
-	echo ""
-	echo "Usage:"
-	echo "  docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro falcosecurity/falco-driver-loader-legacy:latest [driver] [options]"
-	echo ""
-	echo "Available drivers:"
-	echo "  kmod           kernel module (default)"
-	echo "  ebpf           eBPF probe"
-	echo ""
-	echo "Options:"
-	echo "  --help         show this help message"
-	echo "  --clean        try to remove an already present driver installation"
-	echo "  --compile      try to compile the driver locally (default true)"
-	echo "  --download     try to download a prebuilt driver (default true)"
-	echo "  --print-env    skip execution and print env variables for other tools to consume"
-	echo ""
-	echo "Environment variables:"
-	echo "  FALCOCTL_DRIVER_REPOS             specify different URL(s) where to look for prebuilt Falco drivers (comma separated)"
-	echo "  FALCOCTL_DRIVER_NAME              specify a different name for the driver"
-	echo ""
-}
-
 echo "* Setting up /usr/src links from host"
 
 for i in "$HOST_ROOT/usr/src"/*
@@ -48,64 +26,4 @@ do
     ln -s "$i" "/usr/src/$base"
 done
 
-ENABLE_COMPILE="false"
-ENABLE_DOWNLOAD="false"
-has_driver=
-has_opts=
-while test $# -gt 0; do
-	case "$1" in
-		kmod|ebpf)
-			if [ -n "$has_driver" ]; then
-				>&2 echo "Only one driver per invocation"
-				print_usage
-				exit 1
-			else
-				/usr/bin/falcoctl driver config --type $1
-				has_driver="true"
-			fi
-			;;
-		-h|--help)
-			print_usage
-			exit 0
-			;;
-		--clean)
-			/usr/bin/falcoctl driver cleanup
-			exit 0
-			;;
-		--compile)
-			ENABLE_COMPILE="true"
-			has_opts="true"
-			;;
-		--download)
-			ENABLE_DOWNLOAD="true"
-			has_opts="true"
-			;;
-		--source-only)
-		    >&2 echo "Support dropped in Falco 0.37.0."
-			print_usage
-			exit 1
-			;;
-		--print-env)
-			/usr/bin/falcoctl driver printenv
-			exit 0
-			;;
-		--*)
-			>&2 echo "Unknown option: $1"
-			print_usage
-			exit 1
-			;;
-		*)
-			>&2 echo "Unknown driver: $1"
-			print_usage
-			exit 1
-			;;
-	esac
-    shift
-done
-
-if [ -z "$has_opts" ]; then
-	ENABLE_COMPILE="true"
-	ENABLE_DOWNLOAD="true"
-fi
-
-/usr/bin/falcoctl driver install --compile=$ENABLE_COMPILE --download=$ENABLE_DOWNLOAD
+/usr/bin/falco-driver-loader "$@"

docker/driver-loader/docker-entrypoint.sh

@@ -18,28 +18,6 @@
 #
 
 
-print_usage() {
-	echo ""
-	echo "Usage:"
-	echo "  docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro falcosecurity/falco-driver-loader:latest [driver] [options]"
-	echo ""
-	echo "Available drivers:"
-	echo "  kmod           kernel module (default)"
-	echo "  ebpf           eBPF probe"
-	echo ""
-	echo "Options:"
-	echo "  --help         show this help message"
-	echo "  --clean        try to remove an already present driver installation"
-	echo "  --compile      try to compile the driver locally (default true)"
-	echo "  --download     try to download a prebuilt driver (default true)"
-	echo "  --print-env    skip execution and print env variables for other tools to consume"
-	echo ""
-	echo "Environment variables:"
-	echo "  FALCOCTL_DRIVER_REPOS             specify different URL(s) where to look for prebuilt Falco drivers (comma separated)"
-	echo "  FALCOCTL_DRIVER_NAME              specify a different name for the driver"
-	echo ""
-}
-
 echo "* Setting up /usr/src links from host"
 
 for i in "$HOST_ROOT/usr/src"/*
@@ -48,64 +26,4 @@ do
     ln -s "$i" "/usr/src/$base"
 done
 
-ENABLE_COMPILE="false"
-ENABLE_DOWNLOAD="false"
-has_driver=
-has_opts=
-while test $# -gt 0; do
-	case "$1" in
-		kmod|ebpf)
-			if [ -n "$has_driver" ]; then
-				>&2 echo "Only one driver per invocation"
-				print_usage
-				exit 1
-			else
-				/usr/bin/falcoctl driver config --type $1
-				has_driver="true"
-			fi
-			;;
-		-h|--help)
-			print_usage
-			exit 0
-			;;
-		--clean)
-			/usr/bin/falcoctl driver cleanup
-			exit 0
-			;;
-		--compile)
-			ENABLE_COMPILE="true"
-			has_opts="true"
-			;;
-		--download)
-			ENABLE_DOWNLOAD="true"
-			has_opts="true"
-			;;
-		--source-only)
-		    >&2 echo "Support dropped in Falco 0.37.0."
-			print_usage
-			exit 1
-			;;
-		--print-env)
-			/usr/bin/falcoctl driver printenv
-			exit 0
-			;;
-		--*)
-			>&2 echo "Unknown option: $1"
-			print_usage
-			exit 1
-			;;
-		*)
-			>&2 echo "Unknown driver: $1"
-			print_usage
-			exit 1
-			;;
-	esac
-    shift
-done
-
-if [ -z "$has_opts" ]; then
-	ENABLE_COMPILE="true"
-	ENABLE_DOWNLOAD="true"
-fi
-
-/usr/bin/falcoctl driver install --compile=$ENABLE_COMPILE --download=$ENABLE_DOWNLOAD
+/usr/bin/falco-driver-loader "$@"

docker/falco/docker-entrypoint.sh

@@ -17,29 +17,6 @@
 # limitations under the License.
 #
 
-
-print_usage() {
-	echo ""
-	echo "Usage:"
-	echo "  docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro -e 'FALCO_DRIVER_LOADER_OPTIONS=[driver] [options]' falcosecurity/falco:latest"
-	echo ""
-	echo "Available FALCO_DRIVER_LOADER_OPTIONS drivers:"
-	echo "  kmod           kernel module (default)"
-	echo "  ebpf           eBPF probe"
-	echo ""
-	echo "FALCO_DRIVER_LOADER_OPTIONS options:"
-	echo "  --help         show this help message"
-	echo "  --clean        try to remove an already present driver installation"
-	echo "  --compile      try to compile the driver locally (default true)"
-	echo "  --download     try to download a prebuilt driver (default true)"
-	echo "  --print-env    skip execution and print env variables for other tools to consume"
-	echo ""
-	echo "Environment variables:"
-	echo "  FALCOCTL_DRIVER_REPOS             specify different URL(s) where to look for prebuilt Falco drivers (comma separated)"
-	echo "  FALCOCTL_DRIVER_NAME              specify a different name for the driver"
-	echo ""
-}
-
 # Set the SKIP_DRIVER_LOADER variable to skip loading the driver
 
 if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
@@ -52,69 +29,9 @@ if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
     done
 
     # convert the optional space-separated env variable FALCO_DRIVER_LOADER_OPTIONS to array, prevent 
-    # shell expansion and use it as argument list for falcoctl
+    # shell expansion and use it as argument list for falco-driver-loader
     read -a falco_driver_loader_option_arr <<< $FALCO_DRIVER_LOADER_OPTIONS
-
-    ENABLE_COMPILE="false"
-    ENABLE_DOWNLOAD="false"
-    has_driver=
-    has_opts=
-    for opt in "${falco_driver_loader_option_arr[@]}"
-    do
-        case "$opt" in
-            kmod|ebpf)
-                if [ -n "$has_driver" ]; then
-                    >&2 echo "Only one driver per invocation"
-                    print_usage
-                    exit 1
-                else
-                    /usr/bin/falcoctl driver config --type $opt
-                    has_driver="true"
-                fi
-                ;;
-            -h|--help)
-                print_usage
-                exit 0
-                ;;    
-            --clean)
-                /usr/bin/falcoctl driver cleanup
-                exit 0
-                ;;
-            --compile)
-                ENABLE_COMPILE="true"
-                has_opts="true"
-                ;;
-            --download)
-                ENABLE_DOWNLOAD="true"
-                has_opts="true"
-                ;;
-            --source-only)
-                >&2 echo "Support dropped in Falco 0.37.0."
-                print_usage
-                exit 1
-                ;;    
-            --print-env)
-                /usr/bin/falcoctl driver printenv
-                exit 0
-                ;;
-            --*)
-                >&2 echo "Unknown option: $1"
-                print_usage
-                exit 1
-                ;;
-            *)
-                >&2 echo "Unknown driver: $1"
-                print_usage
-                exit 1
-                ;;
-        esac
-    done
-    if [ -z "$has_opts" ]; then
-        ENABLE_COMPILE="true"
-        ENABLE_DOWNLOAD="true"
-    fi
-    /usr/bin/falcoctl driver install --compile=$ENABLE_COMPILE --download=$ENABLE_DOWNLOAD
-
+    /usr/bin/falco-driver-loader "${falco_driver_loader_option_arr[@]}"
 fi
 
 exec "$@"

docker/no-driver/Dockerfile

@@ -15,7 +15,7 @@ RUN curl -L -o falco.tar.gz \
     tar -xvf falco.tar.gz && \
     rm -f falco.tar.gz && \
     mv falco-${FALCO_VERSION}-$(uname -m) falco && \
-    rm -rf /falco/usr/src/falco-*
+    rm -rf /falco/usr/src/falco-* /falco/usr/bin/falco-driver-loader
 
 RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \
     && mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml

docker/no-driver/Dockerfile.distroless

@@ -16,7 +16,7 @@ RUN FALCO_VERSION_URLENCODED=$(echo -n ${FALCO_VERSION}|jq -sRr @uri) && \
     tar -xvf falco.tar.gz && \
     rm -f falco.tar.gz && \
     mv falco-${FALCO_VERSION}-$(uname -m) falco && \
-    rm -rf /falco/usr/src/falco-*
+    rm -rf /falco/usr/src/falco-* /falco/usr/bin/falco-driver-loader
 
 RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \
     && mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml

falco.yaml

@@ -41,6 +41,7 @@
 #     json_include_output_property
 #     json_include_tags_property
 #     buffered_outputs
+#     outputs (throttling)
 #     rule_matching
 #     outputs_queue
 # Falco outputs channels
@@ -61,13 +62,13 @@
 # Falco logging / alerting / metrics related to software functioning (advanced)
 #     output_timeout
 #     syscall_event_timeouts
-#     syscall_event_drops -> [CHANGE NOTICE] Automatic notifications will be simplified in Falco 0.38! If you depend on the detailed drop counters payload, use 'metrics.output_rule' along with 'metrics.kernel_event_counters_enabled' instead
+#     syscall_event_drops
 #     metrics
 # Falco performance tuning (advanced)
-#     syscall_buf_size_preset [DEPRECATED] -> Replaced by `engine.<driver>.buf_size_preset` starting Falco 0.38!
-#     syscall_drop_failed_exit [DEPRECATED] -> Replaced by `engine.<driver>.drop_failed_exit` starting Falco 0.38! 
+#     syscall_buf_size_preset [DEPRECATED]
+#     syscall_drop_failed_exit [DEPRECATED]
 #     base_syscalls
-#     modern_bpf.cpus_for_each_syscall_buffer [DEPRECATED] -> Replaced by `engine.modern_ebpf.cpus_for_each_buffer` starting Falco 0.38! 
+#     modern_bpf.cpus_for_each_syscall_buffer [DEPRECATED]
 
 
 ################################
@@ -79,9 +80,9 @@
 # configuration options from this config file as command-line arguments by using
 # the `-o` flag followed by the option name and value. In the following example,
 # three config options (`json_output`, `log_level`, and
-# `engine.kind`) are passed as command-line
+# `modern_bpf.cpus_for_each_syscall_buffer`) are passed as command-line
 # arguments with their corresponding values: falco -o "json_output=true"
-# -o "log_level=debug" -o "engine.kind=kmod" 
+# -o "log_level=debug" -o "modern_bpf.cpus_for_each_syscall_buffer=4" 
 # Please note that command-line arguments take precedence over the options
 # specified in this config file.
 
@@ -92,32 +93,16 @@
 
 # Customize Falco settings using environment variables:
 #
-# - HOST_ROOT: Specifies the prefix to the underlying host `/proc` filesystem
+# - "HOST_ROOT": Specifies the prefix to the underlying host `/proc` filesystem
 #   when deploying Falco over a container with read-only host mounts instead of
 #   directly on the host. Defaults to "/host". 
-#
-# - !!! [DEPRECATED] FALCO_BPF_PROBE: Specify a custom path to the BPF object code file (`bpf`
+# - "FALCO_BPF_PROBE": DEPRECATED. Specify a custom path to the BPF object code file (`bpf`
 #   driver). This is not needed for the modern_bpf driver. 
-#   -> Replaced by `engine.kind: ebpf` and `engine.ebpf` starting Falco 0.38!
-#
-# - FALCO_HOSTNAME: Customize the hostname output field logged by Falco by
+# - "FALCO_HOSTNAME": Customize the hostname output field logged by Falco by
 #   setting the "FALCO_HOSTNAME" environment variable.
-#
-# - FALCO_CGROUP_MEM_PATH: Specifies the file path holding the container
+# - "FALCO_CGROUP_MEM_PATH": Specifies the file path holding the container
 #   memory usage metric for the `metrics` feature. Defaults to
 #   "/sys/fs/cgroup/memory/memory.usage_in_bytes" (Kubernetes).
-#
-# - SKIP_DRIVER_LOADER is used by the Falco fat image to skip the driver loading part.
-#
-# - FALCO_FRONTEND is useful when set to noninteractive to skip the dialog choice during 
-# the installation of Falco deb/rpm packages. This setting is somewhat similar to DEBIAN_FRONTEND.
-#
-# - FALCO_DRIVER_CHOICE is useful when set to kmod, ebpf, or modern_ebpf (matching the names 
-# used in engine.kind in the Falco config) during the installation of Falco deb/rpm packages. 
-# It skips the dialog choice but retains the driver configuration.
-#
-# - FALCOCTL_ENABLED is useful when set to 'no' during the installation of Falco deb/rpm packages, 
-# disabling the automatic artifacts followed by falcoctl.
 
 
 #####################
@@ -179,8 +164,7 @@ rules_file:
 # - `modern_ebpf`: Modern eBPF (CO-RE eBPF probe)
 # - `gvisor`: gVisor (gVisor sandbox)
 # - `replay`: Replay a scap trace file
-# - `nodriver`: No driver is injected into the system.
-#   This is useful to debug and to run plugins with 'syscall' source.
+# - `none`: No event producer loaded, useful to run with plugins.
 #
 # Only one engine can be specified in the `kind` key.
 # Moreover, for each engine multiple options might be available,
@@ -334,7 +318,7 @@ engine:
     drop_failed_exit: false
   ebpf:
     # path to the elf file to load.
-    probe: ${HOME}/.falco/falco-bpf.o
+    probe: /root/.falco/falco-bpf.o
     buf_size_preset: 4
     drop_failed_exit: false
   modern_ebpf:
@@ -498,7 +482,7 @@ buffered_outputs: false
 # deploying it in production.
 rule_matching: first
 
-# [Stable] `outputs_queue`
+# [Experimental] `outputs_queue`
 #
 # Falco utilizes tbb::concurrent_bounded_queue for handling outputs, and this parameter
 # allows you to customize the queue capacity. Please refer to the official documentation:
@@ -582,8 +566,6 @@ http_output:
   client_key: "/etc/ssl/certs/client.key"
   # Whether to echo server answers to stdout
   echo: false
-  compress_uploads: false
-  keep_alive: false
 
 # [Stable] `program_output`
 #
@@ -793,7 +775,7 @@ output_timeout: 2000
 syscall_event_timeouts:
   max_consecutives: 1000
 
-# [Stable] `syscall_event_drops` -> [CHANGE NOTICE] Automatic notifications will be simplified in Falco 0.38! If you depend on the detailed drop counters payload, use 'metrics.output_rule' along with 'metrics.kernel_event_counters_enabled' instead
+# [Stable] `syscall_event_drops`
 #
 # Generates "Falco internal: syscall event drop" rule output when `priority=debug` at minimum
 #
@@ -993,7 +975,7 @@ metrics:
 # Falco performance tuning (advanced) #
 #######################################
 
-# [DEPRECATED] `syscall_buf_size_preset` -> Replaced by `engine.<driver>.buf_size_preset` starting Falco 0.38!
+# [DEPRECATED] `syscall_buf_size_preset`
 #
 # Deprecated in favor of engine.{kmod,ebpf,modern_ebpf}.buf_size_preset.
 # This config is evaluated only if the default `engine` config block is not changed,
@@ -1049,7 +1031,7 @@ metrics:
 # if the default size is not suitable for your use case.
 syscall_buf_size_preset: 4
 
-# [DEPRECATED] `syscall_drop_failed_exit` -> Replaced by `engine.<driver>.drop_failed_exit` starting Falco 0.38! 
+# [DEPRECATED] `syscall_drop_failed_exit`
 #
 # Deprecated in favor of engine.{kmod,ebpf,modern_ebpf}.drop_failed_exit.
 # This config is evaluated only if the default `engine` config block is not changed,
@@ -1178,7 +1160,7 @@ base_syscalls:
   custom_set: []
   repair: false
 
-# [DEPRECATED] `modern_bpf.cpus_for_each_syscall_buffer`, modern_bpf only -> Replaced by `engine.modern_ebpf.cpus_for_each_buffer` starting Falco 0.38! 
+# [DEPRECATED] `modern_bpf.cpus_for_each_syscall_buffer`, modern_bpf only
 #
 # Deprecated in favor of engine.modern_ebpf.cpus_for_each_buffer.
 # This config is evaluated only if the default `engine` config block is not changed,

scripts/CMakeLists.txt

@@ -41,6 +41,11 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
 	configure_file(rpm/postinstall.in rpm/postinstall COPYONLY)
 	configure_file(rpm/postuninstall.in rpm/postuninstall COPYONLY)
 	configure_file(rpm/preuninstall.in rpm/preuninstall COPYONLY)
+
+	# driver loader
+	configure_file(falco-driver-loader falco-driver-loader @ONLY)
+	install(PROGRAMS ${PROJECT_BINARY_DIR}/scripts/falco-driver-loader
+		DESTINATION ${FALCO_BIN_DIR} COMPONENT "${FALCO_COMPONENT_NAME}")
 endif()
 
 # Install Falcoctl config file
@@ -48,6 +53,5 @@ if (NOT WIN32 AND NOT APPLE AND NOT EMSCRIPTEN AND NOT MUSL_OPTIMIZED_BUILD)
 	if(NOT DEFINED FALCOCTL_ETC_DIR)
 		set(FALCOCTL_ETC_DIR "${CMAKE_INSTALL_FULL_SYSCONFDIR}/falcoctl")
 	endif()
-	configure_file(${CMAKE_CURRENT_SOURCE_DIR}/falcoctl/falcoctl.yaml.in ${PROJECT_BINARY_DIR}/scripts/falcoctl/falcoctl.yaml)
-	install(FILES ${PROJECT_BINARY_DIR}/scripts/falcoctl/falcoctl.yaml DESTINATION "${FALCOCTL_ETC_DIR}" COMPONENT "${FALCO_COMPONENT_NAME}")
+	install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/falcoctl/falcoctl.yaml DESTINATION "${FALCOCTL_ETC_DIR}" COMPONENT "${FALCO_COMPONENT_NAME}")
 endif()

scripts/debian/postinst.in

@@ -18,8 +18,6 @@
 #
 
 chosen_driver=
-chosen_unit=
-CHOICE=
 
 # Every time we call this script we want to stat from a clean state.
 echo "[POST-INSTALL] Disable all possible 'falco' services:"
@@ -38,63 +36,58 @@ systemctl --system disable 'falcoctl-artifact-follow.service' || true
 systemctl --system unmask falcoctl-artifact-follow.service || true
 
 if [ "$1" = "configure" ]; then
-        case $FALCO_DRIVER_CHOICE in
-              kmod)
-                  CHOICE=2
-                  ;;
-              ebpf)
-                  CHOICE=3
-                  ;;
-              modern_ebpf)
-                  CHOICE=4
-                  ;;
-        esac     
-        if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          
-            # If dialog is installed, create a dialog to let users choose the correct driver for them
-            CHOICE=$(dialog --clear --title "Falco drivers" --menu "Choose your preferred driver:" 12 55 4 \
-                    1 "Manual configuration (no unit is started)" \
-                    2 "Kmod" \
-                    3 "eBPF" \
-                    4 "Modern eBPF" \
+        if [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then
+          # If dialog is installed, create a dialog to let users choose the correct driver for them
+          CHOICE=$(dialog --clear --title "Falco drivers" --menu "Choose your preferred driver:" 12 55 4 \
+                1 "Manual configuration (no unit is started)" \
+                2 "Kmod" \
+                3 "eBPF" \
+                4 "Modern eBPF" \
+                2>&1 >/dev/tty)
+          case $CHOICE in
+                  2)
+                      chosen_driver="kmod"
+                      ;;
+                  3)
+                      chosen_driver="bpf"
+                      ;;
+                  4)
+                      chosen_driver="modern-bpf"
+                      ;;
+          esac
+          if [ -n "$chosen_driver" ]; then
+            CHOICE=$(dialog --clear --title "Falcoctl" --menu "Do you want to follow automatic ruleset updates?" 10 40 2 \
+                    1 "Yes" \
+                    2 "No" \
                     2>&1 >/dev/tty)
-        fi         
-        case $CHOICE in
-            2)
-                chosen_driver="kmod"
-                chosen_unit="kmod"
-                ;;
-            3)
-                chosen_driver="ebpf"
-                chosen_unit="bpf"
-                ;;
-            4)
-                chosen_driver="modern_ebpf"
-                chosen_unit="modern-bpf"
-                ;;
-        esac
-        if [ -n "$CHOICE" ]; then
-            echo "[POST-INSTALL] Configure falcoctl driver type:"
-            falcoctl driver config --type $chosen_driver
-            CHOICE=
-            case $FALCOCTL_ENABLED in
-                no)
-                    CHOICE=2
-                    ;;
-            esac
-            if [ -z $CHOICE ] &&  [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then
-                CHOICE=$(dialog --clear --title "Falcoctl" --menu "Do you want to follow automatic ruleset updates?" 10 40 2 \
-                        1 "Yes" \
-                        2 "No" \
-                        2>&1 >/dev/tty)
-            fi  
             case $CHOICE in
                 2)
-                    # we don't want falcoctl enabled, we mask it
-                    systemctl --system mask falcoctl-artifact-follow.service || true
+                # we don't want falcoctl enabled, we mask it
+                systemctl --system mask falcoctl-artifact-follow.service || true
                 ;;
             esac
-        fi    
-        clear
+          fi
+          clear
+        else
+          case $FALCO_DRIVER_CHOICE in
+              module | kmod )
+                  chosen_driver="kmod"
+                  ;;
+              bpf | ebpf | eBPF )
+                  chosen_driver="bpf"
+                  ;;
+              modern-bpf | modern-ebpf | modern-eBPF )
+                  chosen_driver="modern-bpf"
+                  ;;
+          esac
+          case $FALCOCTL_ENABLED in
+              yes )
+                  ;;
+              no )
+                  systemctl --system mask falcoctl-artifact-follow.service || true
+                  ;;
+          esac
+        fi
 fi
 
 set -e
@@ -102,25 +95,25 @@ set -e
 echo "[POST-INSTALL] Trigger deamon-reload:"
 systemctl --system daemon-reload || true
 
-# If needed, try to load/compile the driver through falcoctl
+# If needed, try to load/compile the driver through falco-driver-loader
 case "$chosen_driver" in
     "kmod")
       # Only compile for kmod, in this way we use dkms
-      echo "[POST-INSTALL] Call 'falcoctl driver install for kmod:"
-      falcoctl driver install --download=false
+      echo "[POST-INSTALL] Call 'falco-driver-loader --compile module':"
+      falco-driver-loader --compile module
       ;;
-    "ebpf")
-      echo "[POST-INSTALL] Call 'falcoctl driver install for ebpf':"
-      falcoctl driver install
+    "bpf")
+      echo "[POST-INSTALL] Call 'falco-driver-loader bpf':"
+      falco-driver-loader bpf
       ;;
 esac
 
 if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
-        if [ -n "$chosen_unit" ]; then
+        if [ -n "$chosen_driver" ]; then
             # we do this in 2 steps because `enable --now` is not always supported
-            echo "[POST-INSTALL] Enable 'falco-$chosen_unit.service':"
-            systemctl --system enable "falco-$chosen_unit.service" || true
-            echo "[POST-INSTALL] Start 'falco-$chosen_unit.service':"
-            systemctl --system start "falco-$chosen_unit.service" || true
+            echo "[POST-INSTALL] Enable 'falco-$chosen_driver.service':"
+            systemctl --system enable "falco-$chosen_driver.service" || true
+            echo "[POST-INSTALL] Start 'falco-$chosen_driver.service':"
+            systemctl --system start "falco-$chosen_driver.service" || true           
         fi
 fi

scripts/debian/prerm.in

@@ -31,7 +31,7 @@ case "$1" in
       systemctl --system stop 'falco-custom.service' || true
       systemctl --system stop 'falcoctl-artifact-follow.service' || true
 
-      echo "[PRE-REMOVE] Call 'falcoctl driver cleanup:'"
-      falcoctl driver cleanup
+      echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'"
+      falco-driver-loader --clean
     ;;
 esac

scripts/falco-driver-loader

@@ -0,0 +1,866 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 The Falco Authors.
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Simple script that desperately tries to load the kernel instrumentation by
+# looking for it in a bunch of ways. Convenient when running Falco inside
+# a container or in other weird environments.
+#
+
+#
+# Returns 1 if $cos_ver > $base_ver, 0 otherwise
+#
+cos_version_greater() {
+	if [[ $cos_ver == "${base_ver}" ]]; then
+		return 0
+	fi
+
+	#
+	# COS build numbers are in the format x.y.z
+	#
+	a=$(echo "${cos_ver}" | cut -d. -f1)
+	b=$(echo "${cos_ver}" | cut -d. -f2)
+	c=$(echo "${cos_ver}" | cut -d. -f3)
+
+	d=$(echo "${base_ver}" | cut -d. -f1)
+	e=$(echo "${base_ver}" | cut -d. -f2)
+	f=$(echo "${base_ver}" | cut -d. -f3)
+
+	# Test the first component
+	if [[ $a -gt $d ]]; then
+		return 1
+	elif [[ $d -gt $a ]]; then
+		return 0
+	fi
+
+	# Test the second component
+	if [[ $b -gt $e ]]; then
+		return 1
+	elif [[ $e -gt $b ]]; then
+		return 0
+	fi
+
+	# Test the third component
+	if [[ $c -gt $f ]]; then
+		return 1
+	elif [[ $f -gt $c ]]; then
+		return 0
+	fi
+
+	# If we get here, probably malformatted version string?
+
+	return 0
+}
+
+get_kernel_config() {
+	if [ -f /proc/config.gz ]; then
+		echo "* Found kernel config at /proc/config.gz"
+		KERNEL_CONFIG_PATH=/proc/config.gz
+	elif [ -f "/boot/config-${KERNEL_RELEASE}" ]; then
+		echo "* Found kernel config at /boot/config-${KERNEL_RELEASE}"
+		KERNEL_CONFIG_PATH=/boot/config-${KERNEL_RELEASE}
+	elif [ -n "${HOST_ROOT}" ] && [ -f "${HOST_ROOT}/boot/config-${KERNEL_RELEASE}" ]; then
+		echo "* Found kernel config at ${HOST_ROOT}/boot/config-${KERNEL_RELEASE}"
+		KERNEL_CONFIG_PATH="${HOST_ROOT}/boot/config-${KERNEL_RELEASE}"
+	elif [ -f "/usr/lib/ostree-boot/config-${KERNEL_RELEASE}" ]; then
+		echo "* Found kernel config at /usr/lib/ostree-boot/config-${KERNEL_RELEASE}"
+		KERNEL_CONFIG_PATH="/usr/lib/ostree-boot/config-${KERNEL_RELEASE}"
+	elif [ -n "${HOST_ROOT}" ] && [ -f "${HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}" ]; then
+		echo "* Found kernel config at ${HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}"
+		KERNEL_CONFIG_PATH="${HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}"
+	elif [ -f "/lib/modules/${KERNEL_RELEASE}/config" ]; then
+		# This code works both for native host and containers assuming that
+		# Dockerfile sets up the desired symlink /lib/modules -> $HOST_ROOT/lib/modules
+		echo "* Found kernel config at /lib/modules/${KERNEL_RELEASE}/config"
+		KERNEL_CONFIG_PATH="/lib/modules/${KERNEL_RELEASE}/config"
+	fi
+
+	if [ -z "${KERNEL_CONFIG_PATH}" ]; then
+		>&2 echo "Cannot find kernel config"
+		exit 1
+	fi
+
+	if [[ "${KERNEL_CONFIG_PATH}" == *.gz ]]; then
+		HASH=$(zcat "${KERNEL_CONFIG_PATH}" | md5sum - | cut -d' ' -f1)
+	else
+		HASH=$(md5sum "${KERNEL_CONFIG_PATH}" | cut -d' ' -f1)
+	fi
+}
+
+get_target_id() {
+	if [ -f "${HOST_ROOT}/etc/os-release" ]; then
+		# freedesktop.org and systemd
+		# shellcheck source=/dev/null
+		source "${HOST_ROOT}/etc/os-release"
+		OS_ID=$ID
+	elif [ -f "${HOST_ROOT}/etc/debian_version" ]; then
+		# Older debian distros
+		# fixme > Can this happen on older Ubuntu?
+		OS_ID=debian
+	elif [ -f "${HOST_ROOT}/etc/centos-release" ]; then
+		# Older CentOS distros
+		OS_ID=centos
+	elif [ -f "${HOST_ROOT}/etc/redhat-release" ]; then
+		# Older RHEL distros
+		OS_ID=rhel
+	else
+		# No target id can be determinand
+		TARGET_ID="undetermined"
+		return
+	fi
+
+	# Overwrite the OS_ID if /etc/VERSION file is present.
+	# Not sure if there is a better way to detect minikube.
+	if [ -f "${HOST_ROOT}/etc/VERSION" ]; then
+		OS_ID=minikube
+	fi
+
+	case "${OS_ID}" in
+	("amzn")
+		case "${VERSION_ID}" in
+		("2")
+			TARGET_ID="amazonlinux2"
+			;;
+		("2022")
+			TARGET_ID="amazonlinux2022"
+			;;
+		("2023")
+			TARGET_ID="amazonlinux2023"
+			;;
+		(*)
+			TARGET_ID="amazonlinux"
+			;;
+		esac
+		;;
+	("debian")
+		# Workaround: debian kernelreleases might now be actual kernel running;
+		# instead, they might be the Debian kernel package
+		# providing the compatible kernel ABI
+		# See https://lists.debian.org/debian-user/2017/03/msg00485.html
+		# Real kernel release is embedded inside the kernel version.
+		# Moreover, kernel arch, when present, is attached to the former,
+		# therefore make sure to properly take it and attach it to the latter.
+		# Moreover, we support 3 flavors for debian kernels: cloud, rt and normal.
+		# KERNEL-RELEASE will have a `-rt`, or `-cloud` if we are in one of these flavors.
+		# Manage it to download the correct driver.
+		#
+		# Example: KERNEL_RELEASE="5.10.0-0.deb10.22-rt-amd64" and `uname -v`="5.10.178-3"
+		# should lead to: KERNEL_RELEASE="5.10.178-3-rt-amd64"
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		local ARCH_extra=""
+		if [[ $KERNEL_RELEASE =~ -?(rt-|cloud-|)(amd64|arm64) ]];
+		then
+			ARCH_extra="-${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
+		fi
+		if [[ ${DRIVER_KERNEL_VERSION} =~ ([0-9]+\.[0-9]+\.[0-9]+\-[0-9]+) ]];
+		then
+			KERNEL_RELEASE="${BASH_REMATCH[1]}${ARCH_extra}"
+		fi
+		;;
+	("ubuntu")
+		# Extract the flavor from the kernelrelease
+		# Examples:
+		# 5.0.0-1028-aws-5.0 -> ubuntu-aws
+		# 5.15.0-1009-aws -> ubuntu-aws
+		if [[ $KERNEL_RELEASE =~ -([a-zA-Z]+)(-.*)?$ ]];
+		then
+			TARGET_ID="ubuntu-${BASH_REMATCH[1]}"
+		else
+			TARGET_ID="ubuntu-generic"
+		fi
+
+
+		# In the case that the kernelversion isn't just a number
+		# we keep also the remaining part excluding `-Ubuntu`.
+		# E.g.:
+		# from the following `uname -v` result
+		# `#26~22.04.1-Ubuntu SMP Mon Apr 24 01:58:15 UTC 2023`
+		# we obtain the kernelversion`26~22.04.1`
+		if [[ ${DRIVER_KERNEL_VERSION} =~ (^\#[0-9]+\~[^-]*-Ubuntu .*$) ]];
+		then
+			KERNEL_VERSION=$(echo "${DRIVER_KERNEL_VERSION}" | sed 's/#\([^-\\ ]*\).*/\1/g')
+		fi
+		;;
+	("flatcar")
+		KERNEL_RELEASE="${VERSION_ID}"
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		;;
+	("minikube")
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		# Extract the minikube version. Ex. With minikube version equal to "v1.26.0-1655407986-14197" the extracted version
+		# will be "1.26.0"
+		if [[ $(cat ${HOST_ROOT}/etc/VERSION) =~ ([0-9]+(\.[0-9]+){2}) ]]; then
+			# kernel version for minikube is always in "1_minikubeversion" format. Ex "1_1.26.0".
+			KERNEL_VERSION="1_${BASH_REMATCH[1]}"
+		else
+			echo "* Unable to extract minikube version from ${HOST_ROOT}/etc/VERSION"
+			exit 1
+		fi
+		;;
+	("bottlerocket")
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		# variant_id has been sourced from os-release. Get only the first variant part
+		if [[ -n ${VARIANT_ID} ]];  then
+			# take just first part (eg: VARIANT_ID=aws-k8s-1.15 -> aws)
+			VARIANT_ID_CUT=${VARIANT_ID%%-*}
+		fi
+		# version_id has been sourced from os-release. Build a kernel version like: 1_1.11.0-aws
+		KERNEL_VERSION="1_${VERSION_ID}-${VARIANT_ID_CUT}"
+		;;
+	("talos")
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		# version_id has been sourced from os-release. Build a kernel version like: 1_1.4.1
+		KERNEL_VERSION="1_${VERSION_ID}"
+		;;
+	(*)
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		;;
+	esac
+}
+
+flatcar_relocate_tools() {
+	local -a tools=(
+		scripts/basic/fixdep
+		scripts/mod/modpost
+		tools/objtool/objtool
+	)
+	local -r hostld=$(ls /host/usr/lib64/ld-linux-*.so.*)
+	local -r kdir=/lib/modules/$(ls /lib/modules/)/build
+	echo "** Found host dl interpreter: ${hostld}"
+	for host_tool in ${tools[@]}; do
+		t=${host_tool}
+		tool=$(basename $t)
+		tool_dir=$(dirname $t)
+		host_tool=${kdir}/${host_tool}
+		if [ ! -f ${host_tool} ]; then
+			continue
+		fi
+		umount ${host_tool} 2>/dev/null || true
+		mkdir -p /tmp/${tool_dir}/
+		cp -a ${host_tool} /tmp/${tool_dir}/
+		echo "** Setting host dl interpreter for $host_tool"
+		patchelf --set-interpreter ${hostld} --set-rpath /host/usr/lib64 /tmp/${tool_dir}/${tool}
+		mount -o bind /tmp/${tool_dir}/${tool} ${host_tool}
+	done
+}
+
+load_kernel_module_compile() {
+	# Skip dkms on UEK hosts because it will always fail
+	if [[ ${DRIVER_KERNEL_RELEASE} == *uek* ]]; then
+		>&2 echo "Skipping because the dkms install always fail (on UEK hosts)"
+		return
+	fi
+
+	if ! hash dkms >/dev/null 2>&1; then
+		>&2 echo "This program requires dkms"
+		return
+	fi
+
+	if [ "${TARGET_ID}" == "flatcar" ]; then
+		KERNEL_RELEASE=${DRIVER_KERNEL_RELEASE}
+		echo "* Flatcar detected (version ${VERSION_ID}); relocating kernel tools"
+		flatcar_relocate_tools
+	fi
+
+	# Try to compile using all the available gcc versions
+	for CURRENT_GCC in $(ls "$(dirname "$(which gcc)")"/gcc*); do
+		# Filter away gcc-{ar,nm,...}
+		# Only gcc compiler has `-print-search-dirs` option.
+		${CURRENT_GCC} -print-search-dirs 2>&1 | grep "install:"
+		if [ "$?" -ne "0" ]; then
+			continue
+		fi
+		echo "* Trying to dkms install ${DRIVER_NAME} module with GCC ${CURRENT_GCC}"
+		echo "#!/usr/bin/env bash" > "${TMPDIR}/falco-dkms-make"
+		echo "make CC=${CURRENT_GCC} \$@" >> "${TMPDIR}/falco-dkms-make"
+		chmod +x "${TMPDIR}/falco-dkms-make"
+		if dkms install --directive="MAKE='${TMPDIR}/falco-dkms-make'" -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
+			echo "* ${DRIVER_NAME} module installed in dkms"
+			KO_FILE="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}"
+			if [ -f "$KO_FILE.ko" ]; then
+				KO_FILE="$KO_FILE.ko"
+			elif [ -f "$KO_FILE.ko.gz" ]; then
+				KO_FILE="$KO_FILE.ko.gz"
+			elif [ -f "$KO_FILE.ko.xz" ]; then
+				KO_FILE="$KO_FILE.ko.xz"
+			elif [ -f "$KO_FILE.ko.zst" ]; then
+				KO_FILE="$KO_FILE.ko.zst"
+			else
+				>&2 echo "${DRIVER_NAME} module file not found"
+				return
+			fi
+			echo "* ${DRIVER_NAME} module found: ${KO_FILE}"
+			echo "* Trying to insmod"
+			chcon -t modules_object_t "$KO_FILE" > /dev/null 2>&1 || true
+			if insmod "$KO_FILE" > /dev/null 2>&1; then
+				echo "* Success: ${DRIVER_NAME} module found and loaded in dkms"
+				exit 0
+			fi
+			echo "* Unable to insmod ${DRIVER_NAME} module"
+		else
+			DKMS_LOG="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/build/make.log"
+			if [ -f "${DKMS_LOG}" ]; then
+				echo "* Running dkms build failed, dumping ${DKMS_LOG} (with GCC ${CURRENT_GCC})"
+				cat "${DKMS_LOG}"
+			else
+				echo "* Running dkms build failed, couldn't find ${DKMS_LOG} (with GCC ${CURRENT_GCC})"
+			fi
+		fi
+	done
+}
+
+load_kernel_module_download() {
+	local FALCO_KERNEL_MODULE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko"
+	local URL=$(echo "${1}/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" | sed s/+/%2B/g)
+
+	echo "* Trying to download a prebuilt ${DRIVER_NAME} module from ${URL}"
+	if curl -L --create-dirs ${FALCO_DRIVER_CURL_OPTIONS} -o "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" "${URL}"; then
+		echo "* Download succeeded"
+		chcon -t modules_object_t "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" > /dev/null 2>&1 || true
+		if insmod "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}"; then
+			echo "* Success: ${DRIVER_NAME} module found and inserted"
+			exit 0
+		fi
+		>&2 echo "Unable to insmod the prebuilt ${DRIVER_NAME} module"
+	else
+		>&2 echo "Unable to find a prebuilt ${DRIVER_NAME} module"
+		return
+	fi
+}
+
+print_clean_termination() {
+	echo
+	echo "[SUCCESS] Cleaning phase correctly terminated."
+	echo
+	echo "================ Cleaning phase ================"
+	echo
+}
+
+print_filename_components() {
+	echo " - driver name: ${DRIVER_NAME}"
+	echo " - target identifier: ${TARGET_ID}"
+	echo " - kernel release: ${KERNEL_RELEASE}"
+	echo " - kernel version: ${KERNEL_VERSION}"
+}
+
+print_as_env_vars() {
+	echo "ARCH=\"${ARCH}\""
+	echo "KERNEL_RELEASE=\"${KERNEL_RELEASE}\""
+	echo "KERNEL_VERSION=\"${KERNEL_VERSION}\""
+	echo "ENABLE_COMPILE=\"${ENABLE_COMPILE}\""
+	echo "ENABLE_DOWNLOAD=\"${ENABLE_DOWNLOAD}\""
+	echo "TARGET_ID=\"${TARGET_ID}\""
+	echo "DRIVER=\"${DRIVER}\""
+	echo "DRIVERS_REPO=\"${DRIVERS_REPO}\""
+	echo "DRIVER_VERSION=\"${DRIVER_VERSION}\""
+	echo "DRIVER_NAME=\"${DRIVER_NAME}\""
+	echo "FALCO_VERSION=\"${FALCO_VERSION}\""
+}
+
+clean_kernel_module() {
+	echo
+	echo "================ Cleaning phase ================"
+	echo
+
+	if ! hash lsmod > /dev/null 2>&1; then
+		>&2 echo "This program requires lsmod."
+		exit 1
+	fi
+
+	if ! hash rmmod > /dev/null 2>&1; then
+		>&2 echo "This program requires rmmod."
+		exit 1
+	fi
+
+	KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
+	echo "* 1. Check if kernel module '${KMOD_NAME}' is still loaded:"
+
+	if ! lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}"; then
+		echo "- OK! There is no '${KMOD_NAME}' module loaded."
+		echo
+	fi
+
+	# Wait 50s = MAX_RMMOD_WAIT * 5s
+	MAX_RMMOD_WAIT=10
+	# Remove kernel module if is still loaded.
+	while lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" && [ $MAX_RMMOD_WAIT -gt 0 ]; do
+		echo "- Kernel module '${KMOD_NAME}' is still loaded."
+		echo "- Trying to unload it with 'rmmod ${KMOD_NAME}'..."
+		if rmmod ${KMOD_NAME}; then
+			echo "- OK! Unloading '${KMOD_NAME}' module succeeded."
+			echo
+		else
+			echo "- Nothing to do...'falco-driver-loader' will wait until you remove the kernel module to have a clean termination."
+			echo "- Check that no process is using the kernel module with 'lsmod | grep ${KMOD_NAME}'."
+			echo "- Sleep 5 seconds..."
+			echo
+			((--MAX_RMMOD_WAIT))
+			sleep 5
+		fi
+	done
+
+	if [ ${MAX_RMMOD_WAIT} -eq 0 ]; then
+		echo "[WARNING] '${KMOD_NAME}' module is still loaded, you could have incompatibility issues."
+		echo
+	fi
+
+	if ! hash dkms >/dev/null 2>&1; then
+		echo "- Skipping dkms remove (dkms not found)."
+		print_clean_termination
+		return
+	fi
+
+	# Remove all versions of this module from dkms.
+	echo "* 2. Check all versions of kernel module '${KMOD_NAME}' in dkms:"
+	DRIVER_VERSIONS=$(dkms status -m "${KMOD_NAME}" | tr -d "," | tr -d ":" | tr "/" " " | cut -d' ' -f2)
+	if [ -z "${DRIVER_VERSIONS}" ]; then
+		echo "- OK! There are no '${KMOD_NAME}' module versions in dkms."
+	else
+		echo "- There are some versions of '${KMOD_NAME}' module in dkms."
+		echo
+		echo "* 3. Removing all the following versions from dkms:"
+		echo "${DRIVER_VERSIONS}"
+		echo
+	fi
+
+	for CURRENT_VER in ${DRIVER_VERSIONS}; do
+		echo "- Removing ${CURRENT_VER}..."
+		if dkms remove -m ${KMOD_NAME} -v "${CURRENT_VER}" --all; then
+			echo
+			echo "- OK! Removing '${CURRENT_VER}' succeeded."
+			echo
+		else
+			echo "[WARNING] Removing '${KMOD_NAME}' version '${CURRENT_VER}' failed."
+		fi
+	done
+
+	print_clean_termination
+}
+
+load_kernel_module() {
+	clean_kernel_module
+
+	echo "* Looking for a ${DRIVER_NAME} module locally (kernel ${KERNEL_RELEASE})"
+
+	local FALCO_KERNEL_MODULE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko"
+	echo "* Filename '${FALCO_KERNEL_MODULE_FILENAME}' is composed of:"
+	print_filename_components
+
+	if [ -f "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" ]; then
+		echo "* Found a prebuilt ${DRIVER_NAME} module at ${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}, loading it"
+		chcon -t modules_object_t "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" > /dev/null 2>&1 || true
+		insmod "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${FALCO_KERNEL_MODULE_FILENAME}" && echo "* Success: ${DRIVER_NAME} module found and inserted"
+		exit $?
+	fi
+
+	if [ -n "$ENABLE_DOWNLOAD" ]; then
+		IFS=", " read -r -a urls <<< "${DRIVERS_REPO}"
+		for url in "${urls[@]}"; do
+			load_kernel_module_download $url
+		done
+	fi
+
+	if [ -n "$ENABLE_COMPILE" ]; then
+		load_kernel_module_compile
+	fi
+
+	# Last try (might load a previous driver version)
+	echo "* Trying to load a system ${DRIVER_NAME} module, if present"
+	if modprobe "${DRIVER_NAME}" > /dev/null 2>&1; then
+		echo "* Success: ${DRIVER_NAME} module found and loaded with modprobe"
+		exit 0
+	fi
+
+	# Not able to download a prebuilt module nor to compile one on-the-fly
+	>&2 echo "Consider compiling your own ${DRIVER_NAME} driver and loading it or getting in touch with the Falco community"
+	exit 1
+}
+
+load_bpf_probe_compile() {
+	local BPF_KERNEL_SOURCES_URL=""
+	local STRIP_COMPONENTS=1
+
+	customize_kernel_build() {
+		if [ -n "${KERNEL_EXTRA_VERSION}" ]; then
+			sed -i "s/LOCALVERSION=\"\"/LOCALVERSION=\"${KERNEL_EXTRA_VERSION}\"/" .config
+		fi
+		make olddefconfig > /dev/null
+		make modules_prepare > /dev/null
+	}
+
+	if [ "${TARGET_ID}" == "flatcar" ]; then
+		KERNEL_RELEASE=${DRIVER_KERNEL_RELEASE}
+		echo "* Flatcar detected (version ${VERSION_ID}); relocating kernel tools"
+		flatcar_relocate_tools
+	fi
+
+	if [ "${TARGET_ID}" == "cos" ]; then
+		echo "* COS detected (build ${BUILD_ID}), using COS kernel headers"
+
+		BPF_KERNEL_SOURCES_URL="https://storage.googleapis.com/cos-tools/${BUILD_ID}/kernel-headers.tgz"
+		KERNEL_EXTRA_VERSION="+"
+		STRIP_COMPONENTS=0
+
+		customize_kernel_build() {
+			pushd usr/src/* > /dev/null || exit
+
+			# Note: this overrides the KERNELDIR set while untarring the tarball
+			KERNELDIR=$(pwd)
+			export KERNELDIR
+
+			sed -i '/^#define randomized_struct_fields_start	struct {$/d' include/linux/compiler-clang.h
+			sed -i '/^#define randomized_struct_fields_end	};$/d' include/linux/compiler-clang.h
+
+			popd > /dev/null || exit
+
+			# Might need to configure our own sources depending on COS version
+			cos_ver=${BUILD_ID}
+			base_ver=11553.0.0
+
+			cos_version_greater
+			greater_ret=$?
+
+			if [[ greater_ret -eq 1 ]]; then
+			export KBUILD_EXTRA_CPPFLAGS=-DCOS_73_WORKAROUND
+			fi
+		}
+	fi
+
+	if [ "${TARGET_ID}" == "minikube" ]; then
+		MINIKUBE_VERSION="$(cat "${HOST_ROOT}/etc/VERSION")"
+		echo "* Minikube detected (${MINIKUBE_VERSION}), using linux kernel sources for minikube kernel"
+		local kernel_version
+		kernel_version=${DRIVER_KERNEL_RELEASE}
+		local -r kernel_version_major=$(echo "${kernel_version}" | cut -d. -f1)
+		local -r kernel_version_minor=$(echo "${kernel_version}" | cut -d. -f2)
+		local -r kernel_version_patch=$(echo "${kernel_version}" | cut -d. -f3)
+
+		if [ "${kernel_version_patch}" == "0" ]; then
+			kernel_version="${kernel_version_major}.${kernel_version_minor}"
+		fi
+
+		BPF_KERNEL_SOURCES_URL="http://mirrors.edge.kernel.org/pub/linux/kernel/v${kernel_version_major}.x/linux-${kernel_version}.tar.gz"
+	fi
+
+	if [ -n "${BPF_USE_LOCAL_KERNEL_SOURCES}" ]; then
+		local -r kernel_version_major=$(echo "${DRIVER_KERNEL_RELEASE}" | cut -d. -f1)
+		local -r kernel_version=$(echo "${DRIVER_KERNEL_RELEASE}" | cut -d- -f1)
+		KERNEL_EXTRA_VERSION="-$(echo "${DRIVER_KERNEL_RELEASE}" | cut -d- -f2)"
+
+		echo "* Using downloaded kernel sources for kernel version ${kernel_version}..."
+
+		BPF_KERNEL_SOURCES_URL="http://mirrors.edge.kernel.org/pub/linux/kernel/v${kernel_version_major}.x/linux-${kernel_version}.tar.gz"
+	fi
+
+	if [ -n "${BPF_KERNEL_SOURCES_URL}" ]; then
+		get_kernel_config
+
+		echo "* Downloading ${BPF_KERNEL_SOURCES_URL}"
+
+		mkdir -p /tmp/kernel
+		cd /tmp/kernel || exit
+		cd "$(mktemp -d -p /tmp/kernel)" || exit
+		if ! curl -L -o kernel-sources.tgz --create-dirs ${FALCO_DRIVER_CURL_OPTIONS} "${BPF_KERNEL_SOURCES_URL}"; then
+			>&2 echo "Unable to download the kernel sources"
+			return
+		fi
+
+		echo "* Extracting kernel sources"
+
+		mkdir kernel-sources && tar xf kernel-sources.tgz -C kernel-sources --strip-components "${STRIP_COMPONENTS}"
+
+		cd kernel-sources || exit
+		KERNELDIR=$(pwd)
+		export KERNELDIR
+
+		if [[ "${KERNEL_CONFIG_PATH}" == *.gz ]]; then
+			zcat "${KERNEL_CONFIG_PATH}" > .config
+		else
+			cat "${KERNEL_CONFIG_PATH}" > .config
+		fi
+
+		echo "* Configuring kernel"
+		customize_kernel_build
+	fi
+
+	echo "* Trying to compile the eBPF probe (${BPF_PROBE_FILENAME})"
+
+	make -C "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf" > /dev/null
+
+	mkdir -p "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}"
+	mv "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf/probe.o" "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}"
+
+	if [ -n "${BPF_KERNEL_SOURCES_URL}" ]; then
+		rm -r /tmp/kernel
+	fi
+
+}
+
+load_bpf_probe_download() {
+	local URL
+	URL=$(echo "${1}/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" | sed s/+/%2B/g)
+
+	echo "* Trying to download a prebuilt eBPF probe from ${URL}"
+
+	if ! curl -L --create-dirs ${FALCO_DRIVER_CURL_OPTIONS} -o "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" "${URL}"; then
+		>&2 echo "Unable to find a prebuilt ${DRIVER_NAME} eBPF probe"
+		return 1
+	fi
+	return 0
+}
+
+load_bpf_probe() {
+
+	if [ ! -d /sys/kernel/debug/tracing ]; then
+		echo "* Mounting debugfs"
+		mount -t debugfs nodev /sys/kernel/debug
+	fi
+
+	BPF_PROBE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.o"
+	echo "* Filename '${BPF_PROBE_FILENAME}' is composed of:"
+	print_filename_components
+
+	if [ -n "$ENABLE_DOWNLOAD" ]; then
+		if [ -f "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" ]; then
+			echo "* Skipping download, eBPF probe is already present in ${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}"
+		else
+			IFS=", " read -r -a urls <<< "${DRIVERS_REPO}"
+			for url in "${urls[@]}"; do
+				load_bpf_probe_download $url
+				if [ $? -eq 0 ]; then
+                	break
+                fi
+			done
+		fi
+	fi
+
+	if [ -n "$ENABLE_COMPILE" ]; then
+		if [ -f "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" ]; then
+			echo "* Skipping compilation, eBPF probe is already present in ${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}"
+		else
+			load_bpf_probe_compile
+		fi
+	fi
+
+	if [ -f "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" ]; then
+		echo "* eBPF probe located in ${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}"
+
+		ln -sf "${HOME}/.falco/${DRIVER_VERSION}/${ARCH}/${BPF_PROBE_FILENAME}" "${HOME}/.falco/${DRIVER_NAME}-bpf.o" \
+			&& echo "* Success: eBPF probe symlinked to ${HOME}/.falco/${DRIVER_NAME}-bpf.o"
+		exit $?
+	else
+		>&2 echo "Unable to load the ${DRIVER_NAME} eBPF probe"
+		exit 1
+	fi
+}
+
+print_usage() {
+	echo ""
+	echo "Usage:"
+	echo "  falco-driver-loader [driver] [options]"
+	echo ""
+	echo "Available drivers:"
+	echo "  module        kernel module (default)"
+	echo "  bpf           eBPF probe"
+	echo ""
+	echo "Options:"
+	echo "  --help         show brief help"
+	echo "  --clean        try to remove an already present driver installation"
+	echo "  --compile      try to compile the driver locally (default true)"
+	echo "  --download     try to download a prebuilt driver (default true)"
+	echo "  --source-only  skip execution and allow sourcing in another script using `. falco-driver-loader`"
+	echo "  --print-env    skip execution and print env variables for other tools to consume"
+	echo ""
+	echo "Environment variables:"
+	echo "  DRIVERS_REPO             specify different URL(s) where to look for prebuilt Falco drivers (comma separated)"
+	echo "  DRIVER_NAME              specify a different name for the driver"
+	echo "  DRIVER_INSECURE_DOWNLOAD whether you want to allow insecure downloads or not"
+	echo "  DRIVER_CURL_OPTIONS      specify additional options to be passed to curl command used to download Falco drivers"
+	echo "  DRIVER_KERNEL_RELEASE    specify the kernel release for which to download/build the driver in the same format used by 'uname -r' (e.g. '6.1.0-10-cloud-amd64')"
+	echo "  DRIVER_KERNEL_VERSION    specify the kernel version for which to download/build the driver in the same format used by 'uname -v' (e.g. '#1 SMP PREEMPT_DYNAMIC Debian 6.1.38-2 (2023-07-27)')"
+	echo ""
+	echo "Versions:"
+	echo "  Falco version  ${FALCO_VERSION}"
+	echo "  Driver version ${DRIVER_VERSION}"
+	echo ""
+}
+
+ARCH=$(uname -m)
+
+DRIVER_KERNEL_RELEASE=${DRIVER_KERNEL_RELEASE:-$(uname -r)}
+KERNEL_RELEASE=${DRIVER_KERNEL_RELEASE}
+
+if ! hash sed > /dev/null 2>&1; then
+	>&2 echo "This program requires sed"
+	exit 1
+fi
+
+DRIVER_KERNEL_VERSION=${DRIVER_KERNEL_VERSION:-$(uname -v)}
+KERNEL_VERSION=$(echo "${DRIVER_KERNEL_VERSION}" | sed 's/#\([[:digit:]]\+\).*/\1/')
+
+DRIVERS_REPO=${DRIVERS_REPO:-"@DRIVERS_REPO@"}
+
+FALCO_DRIVER_CURL_OPTIONS="-fsS --connect-timeout 5 --max-time 60 --retry 3 --retry-max-time 120"
+
+if [ -n "$DRIVER_INSECURE_DOWNLOAD" ]
+then
+	FALCO_DRIVER_CURL_OPTIONS+=" -k"
+fi
+
+FALCO_DRIVER_CURL_OPTIONS+=" "${DRIVER_CURL_OPTIONS}
+
+if [[ -z "$MAX_RMMOD_WAIT" ]]; then
+	MAX_RMMOD_WAIT=60
+fi
+
+DRIVER_VERSION=${DRIVER_VERSION:-"@DRIVER_VERSION@"}
+DRIVER_NAME=${DRIVER_NAME:-"@DRIVER_NAME@"}
+FALCO_VERSION="@FALCO_VERSION@"
+
+TARGET_ID=
+get_target_id
+
+DRIVER="module"
+if [ -v FALCO_BPF_PROBE ]; then
+	DRIVER="bpf"
+fi
+
+TMPDIR=${TMPDIR:-"/tmp"}
+
+ENABLE_COMPILE=
+ENABLE_DOWNLOAD=
+
+clean=
+has_args=
+has_opts=
+print_env=
+source_only=
+while test $# -gt 0; do
+	case "$1" in
+		module|bpf)
+			if [ -n "$has_args" ]; then
+				>&2 echo "Only one driver per invocation"
+				print_usage
+				exit 1
+			else
+				DRIVER="$1"
+				has_args="true"
+				shift
+			fi
+			;;
+		-h|--help)
+			print_usage
+			exit 0
+			;;
+		--clean)
+			clean="true"
+			shift
+			;;
+		--compile)
+			ENABLE_COMPILE="yes"
+			has_opts="true"
+			shift
+			;;
+		--download)
+			ENABLE_DOWNLOAD="yes"
+			has_opts="true"
+			shift
+			;;
+		--source-only)
+			source_only="true"
+			shift
+			;;
+		--print-env)
+			print_env="true"
+			shift
+			;;
+		--*)
+			>&2 echo "Unknown option: $1"
+			print_usage
+			exit 1
+			;;
+		*)
+			>&2 echo "Unknown driver: $1"
+			print_usage
+			exit 1
+			;;
+	esac
+done
+
+if [ -z "$has_opts" ]; then
+	ENABLE_COMPILE="yes"
+	ENABLE_DOWNLOAD="yes"
+fi
+
+if [ -n "$source_only" ]; then
+	# Return or exit, depending if we've been sourced.
+	(return 0 2>/dev/null) && return || exit 0
+fi
+
+if [ -n "$print_env" ]; then
+	print_as_env_vars
+	exit 0
+fi
+
+echo "* Running falco-driver-loader for: falco version=${FALCO_VERSION}, driver version=${DRIVER_VERSION}, arch=${ARCH}, kernel release=${KERNEL_RELEASE}, kernel version=${KERNEL_VERSION}"
+
+if [ "$(id -u)" != 0 ]; then
+	>&2 echo "This program must be run as root (or with sudo)"
+	exit 1
+fi
+
+if [ "$TARGET_ID" = "undetermined" ]; then
+	if [ -n "$ENABLE_COMPILE" ]; then
+		ENABLE_DOWNLOAD=
+		>&2 echo "Detected an unsupported target system, please get in touch with the Falco community. Trying to compile anyway."
+	else
+		>&2 echo "Detected an unsupported target system, please get in touch with the Falco community."
+		exit 1
+	fi
+fi
+
+if [ -n "$clean" ]; then
+	if [ -n "$has_opts" ]; then
+		>&2 echo "Cannot use --clean with other options"
+		exit 1
+	fi
+
+	echo "* Running falco-driver-loader with: driver=$DRIVER, clean=yes"
+	case $DRIVER in
+	module)
+		clean_kernel_module
+		;;
+	bpf)
+		>&2 echo "--clean not supported for driver=bpf"
+		exit 1
+	esac
+else
+	if ! hash curl > /dev/null 2>&1; then
+		>&2 echo "This program requires curl"
+		exit 1
+	fi
+
+	echo "* Running falco-driver-loader with: driver=$DRIVER, compile=${ENABLE_COMPILE:-"no"}, download=${ENABLE_DOWNLOAD:-"no"}"
+	case $DRIVER in
+		module)
+			load_kernel_module
+			;;
+		bpf)
+			load_bpf_probe
+			;;
+	esac
+fi

scripts/falcoctl/falcoctl.yaml

@@ -1,10 +1,3 @@
-driver:
-    type: "kmod"
-    name: "@DRIVER_NAME@"
-    repos:
-        - "@DRIVERS_REPO@"
-    version: "@DRIVER_VERSION@"
-    hostroot: "/"
 artifact:
   follow:
     every: 6h0m0s

scripts/rpm/postinstall.in

@@ -17,8 +17,6 @@
 #
 
 chosen_driver=
-chosen_unit=
-CHOICE=
 
 # Every time we call this script we want to stat from a clean state.
 echo "[POST-INSTALL] Disable all possible enabled 'falco' service:"
@@ -37,18 +35,7 @@ systemctl --system disable 'falcoctl-artifact-follow.service' || true
 systemctl --system unmask falcoctl-artifact-follow.service || true
 
 if [ $1 -ge 1 ]; then
-        case $FALCO_DRIVER_CHOICE in
-              kmod)
-                  CHOICE=2
-                  ;;
-              ebpf)
-                  CHOICE=3
-                  ;;
-              modern_ebpf)
-                  CHOICE=4
-                  ;;
-        esac     
-        if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          
+        if [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then
             # If dialog is installed, create a dialog to let users choose the correct driver for them
             CHOICE=$(dialog --clear --title "Falco drivers" --menu "Choose your preferred driver:" 12 55 4 \
                     1 "Manual configuration (no unit is started)" \
@@ -56,44 +43,50 @@ if [ $1 -ge 1 ]; then
                     3 "eBPF" \
                     4 "Modern eBPF" \
                     2>&1 >/dev/tty)
-        fi         
-        case $CHOICE in
-            2)
-                chosen_driver="kmod"
-                chosen_unit="kmod"
-                ;;
-            3)
-                chosen_driver="ebpf"
-                chosen_unit="bpf"
-                ;;
-            4)
-                chosen_driver="modern_ebpf"
-                chosen_unit="modern-bpf"
-                ;;
-        esac
-        if [ -n "$CHOICE" ]; then
-            echo "[POST-INSTALL] Configure falcoctl driver type:"
-            falcoctl driver config --type $chosen_driver
-            CHOICE=
-            case $FALCOCTL_ENABLED in
-                no)
-                    CHOICE=2
-                    ;;
-            esac
-            if [ -z $CHOICE ] &&  [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then
-                CHOICE=$(dialog --clear --title "Falcoctl" --menu "Do you want to follow automatic ruleset updates?" 10 40 2 \
-                        1 "Yes" \
-                        2 "No" \
-                        2>&1 >/dev/tty)
-            fi  
             case $CHOICE in
                 2)
-                    # we don't want falcoctl enabled, we mask it
-                    systemctl --system mask falcoctl-artifact-follow.service || true
-                ;;
+                    chosen_driver="kmod"
+                    ;;
+                3)
+                    chosen_driver="bpf"
+                    ;;
+                4)
+                    chosen_driver="modern-bpf"
+                    ;;
             esac
-        fi    
-        clear
+            if [ -n "$chosen_driver" ]; then
+              CHOICE=$(dialog --clear --title "Falcoctl" --menu "Do you want to follow automatic ruleset updates?" 10 40 2 \
+                      1 "Yes" \
+                      2 "No" \
+                      2>&1 >/dev/tty)
+              case $CHOICE in
+                  2)
+                      # we don't want falcoctl enabled, we mask it
+                      systemctl --system mask falcoctl-artifact-follow.service || true
+                  ;;
+              esac
+            fi
+            clear
+        else
+            case $FALCO_DRIVER_CHOICE in
+                module | kmod )
+                    chosen_driver="kmod"
+                    ;;
+                bpf | ebpf | eBPF )
+                    chosen_driver="bpf"
+                    ;;
+                modern-bpf | modern-ebpf | modern-eBPF )
+                    chosen_driver="modern-bpf"
+                    ;;
+            esac
+            case $FALCOCTL_ENABLED in
+                yes )
+                    ;;
+                no )
+                    systemctl --system mask falcoctl-artifact-follow.service || true
+                    ;;
+            esac
+        fi
 fi
 
 set -e
@@ -101,16 +94,16 @@ set -e
 echo "[POST-INSTALL] Trigger deamon-reload:"
 systemctl --system daemon-reload || true
 
-# If needed, try to load/compile the driver through falcoctl
+# If needed, try to load/compile the driver through falco-driver-loader
 case "$chosen_driver" in
     "kmod")
       # Only compile for kmod, in this way we use dkms
-       echo "[POST-INSTALL] Call 'falcoctl driver install for kmod:"
-       falcoctl driver install --download=false
+      echo "[POST-INSTALL] Call 'falco-driver-loader --compile module':"
+      falco-driver-loader --compile module
       ;;
-    "ebpf")
-      echo "[POST-INSTALL] Call 'falcoctl driver install for ebpf':"
-      falcoctl driver install
+    "bpf")
+      echo "[POST-INSTALL] Call 'falco-driver-loader bpf':"
+      falco-driver-loader bpf
       ;;
 esac
 
@@ -121,14 +114,14 @@ esac
 # systemd_post macro expands to
 # if postinst:
 #   `systemd-update-helper install-system-units <service>`
-%systemd_post "falco-$chosen_unit.service"
+%systemd_post "falco-$chosen_driver.service"
 
 # post install/upgrade mirrored from .deb
 if [ $1 -ge 1 ]; then
-        if [ -n "$chosen_unit" ]; then
-            echo "[POST-INSTALL] Enable 'falco-$chosen_unit.service':"
-            systemctl --system enable "falco-$chosen_unit.service" || true
-            echo "[POST-INSTALL] Start 'falco-$chosen_unit.service':"
-            systemctl --system start "falco-$chosen_unit.service" || true
+        if [ -n "$chosen_driver" ]; then
+            echo "[POST-INSTALL] Enable 'falco-$chosen_driver.service':"
+            systemctl --system enable "falco-$chosen_driver.service" || true
+            echo "[POST-INSTALL] Start 'falco-$chosen_driver.service':"
+            systemctl --system start "falco-$chosen_driver.service" || true
         fi
 fi

scripts/rpm/preuninstall.in

@@ -25,8 +25,8 @@ systemctl --system stop 'falco-modern-bpf.service' || true
 systemctl --system stop 'falco-custom.service' || true
 systemctl --system stop 'falcoctl-artifact-follow.service' || true
 
-echo "[PRE-REMOVE] Call 'falcoctl driver cleanup:'"
-falcoctl driver cleanup
+echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'"
+falco-driver-loader --clean
 
 # validate rpm macros by `rpm -qp --scripts <rpm>`
 # RPM scriptlets: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_systemd

scripts/systemd/falco-bpf.service

@@ -7,7 +7,8 @@ Wants=falcoctl-artifact-follow.service
 [Service]
 Type=simple
 User=root
-ExecStart=/usr/bin/falco -o engine.kind=ebpf
+Environment=FALCO_BPF_PROBE=
+ExecStart=/usr/bin/falco
 ExecReload=kill -1 $MAINPID
 UMask=0077
 TimeoutSec=30

scripts/systemd/falco-kmod.service

@@ -9,7 +9,7 @@ Wants=falcoctl-artifact-follow.service
 [Service]
 Type=simple
 User=root
-ExecStart=/usr/bin/falco -o engine.kind=kmod
+ExecStart=/usr/bin/falco
 ExecReload=kill -1 $MAINPID
 UMask=0077
 TimeoutSec=30

scripts/systemd/falco-modern-bpf.service

@@ -7,7 +7,7 @@ Wants=falcoctl-artifact-follow.service
 [Service]
 Type=simple
 User=root
-ExecStart=/usr/bin/falco -o engine.kind=modern_ebpf
+ExecStart=/usr/bin/falco --modern-bpf
 ExecReload=kill -1 $MAINPID
 UMask=0077
 TimeoutSec=30

unit_tests/engine/test_add_source.cpp

@@ -1,89 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2023 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <gtest/gtest.h>
-
-#include <falco_engine.h>
-#include <evttype_index_ruleset.h>
-
-static std::string syscall_source_name = "syscall";
-
-// A variant of evttype_index_ruleset_factory that uses a singleton
-// for the underlying ruleset. This allows testing of
-// ruleset_for_source
-
-namespace
-{
-class test_ruleset_factory : public evttype_index_ruleset_factory
-{
-public:
-	test_ruleset_factory(std::shared_ptr<gen_event_filter_factory> factory):
-		evttype_index_ruleset_factory(factory)
-	{
-		ruleset = evttype_index_ruleset_factory::new_ruleset();
-	}
-
-	virtual ~test_ruleset_factory() = default;
-
-	inline std::shared_ptr<filter_ruleset> new_ruleset() override
-	{
-		return ruleset;
-	}
-
-	std::shared_ptr<filter_ruleset> ruleset;
-};
-}; // namespace
-
-TEST(AddSource, basic)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-
-	auto filter_factory = std::shared_ptr<gen_event_filter_factory>(
-		new sinsp_filter_factory(&inspector, filterchecks));
-	auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
-		new sinsp_evt_formatter_factory(&inspector, filterchecks));
-	test_ruleset_factory *test_factory = new test_ruleset_factory(filter_factory);
-	auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>(test_factory);
-
-	falco_source syscall_source;
-	syscall_source.name = syscall_source_name;
-	syscall_source.ruleset = ruleset_factory->new_ruleset();
-	syscall_source.ruleset_factory = ruleset_factory;
-	syscall_source.filter_factory = filter_factory;
-	syscall_source.formatter_factory = formatter_factory;
-
-	size_t source_idx = engine.add_source(syscall_source_name,
-					      filter_factory,
-					      formatter_factory,
-					      ruleset_factory);
-
-	ASSERT_TRUE(engine.is_source_valid(syscall_source_name));
-
-	ASSERT_EQ(engine.filter_factory_for_source(syscall_source_name), filter_factory);
-	ASSERT_EQ(engine.filter_factory_for_source(source_idx), filter_factory);
-
-	ASSERT_EQ(engine.formatter_factory_for_source(syscall_source_name), formatter_factory);
-	ASSERT_EQ(engine.formatter_factory_for_source(source_idx), formatter_factory);
-
-	ASSERT_EQ(engine.ruleset_factory_for_source(syscall_source_name), ruleset_factory);
-	ASSERT_EQ(engine.ruleset_factory_for_source(source_idx), ruleset_factory);
-
-	ASSERT_EQ(engine.ruleset_for_source(syscall_source_name), test_factory->ruleset);
-	ASSERT_EQ(engine.ruleset_for_source(source_idx), test_factory->ruleset);
-}

unit_tests/engine/test_enable_rule.cpp

@@ -1,251 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2023 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <string>
-
-#include <gtest/gtest.h>
-
-#include <sinsp.h>
-#include <filter_check_list.h>
-#include <filter.h>
-
-#include <falco_engine.h>
-
-static std::string single_rule = R"END(
-- rule: test rule
-  desc: A test rule
-  condition: evt.type=execve
-  output: A test rule matched (evt.type=%evt.type)
-  priority: INFO
-  source: syscall
-  tags: [process]
-
-- rule: disabled rule
-  desc: A disabled rule
-  condition: evt.type=execve
-  output: A disabled rule matched (evt.type=%evt.type)
-  priority: INFO
-  source: syscall
-  enabled: false
-  tags: [exec process]
-)END";
-
-// This must be kept in line with the (private) falco_engine::s_default_ruleset
-static const std::string default_ruleset = "falco-default-ruleset";
-
-static const std::string ruleset_1 = "ruleset-1";
-static const std::string ruleset_2 = "ruleset-2";
-static const std::string ruleset_3 = "ruleset-3";
-static const std::string ruleset_4 = "ruleset-4";
-
-static void load_rules(falco_engine& engine, sinsp& inspector, sinsp_filter_check_list& filterchecks)
-{
-	std::unique_ptr<falco::load_result> res;
-
-	auto filter_factory = std::shared_ptr<gen_event_filter_factory>(
-		new sinsp_filter_factory(&inspector, filterchecks));
-	auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
-		new sinsp_evt_formatter_factory(&inspector, filterchecks));
-
-	engine.add_source("syscall", filter_factory, formatter_factory);
-
-	res = engine.load_rules(single_rule, "single_rule.yaml");
-
-	EXPECT_TRUE(res->successful());
-}
-
-TEST(EnableRule, enable_rule_name)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-
-	load_rules(engine, inspector, filterchecks);
-
-	// No rules should be enabled yet for any custom rulesets
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(default_ruleset));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	// Enable for first ruleset, only that ruleset should have an
-	// enabled rule afterward
-	engine.enable_rule("test", true, ruleset_1);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	// Enable for second ruleset
-	engine.enable_rule("test", true, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	// When the substring is blank, all rules are enabled
-	// (including the disabled rule)
-	engine.enable_rule("", true, ruleset_3);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_3));
-
-	// Now disable for second ruleset
-	engine.enable_rule("test", false, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_3));
-}
-
-TEST(EnableRule, enable_rule_tags)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-	std::set<std::string> process_tags = {"process"};
-
-	load_rules(engine, inspector, filterchecks);
-
-	// No rules should be enabled yet for any custom rulesets
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(default_ruleset));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-
-	// Enable for first ruleset, only that ruleset should have an
-	// enabled rule afterward
-	engine.enable_rule_by_tag(process_tags, true, ruleset_1);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-
-	// Enable for second ruleset
-	engine.enable_rule_by_tag(process_tags, true, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-
-	// Now disable for second ruleset
-	engine.enable_rule_by_tag(process_tags, false, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-}
-
-TEST(EnableRule, enable_disabled_rule_by_tag)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-	std::set<std::string> exec_process_tags = {"exec process"};
-
-	load_rules(engine, inspector, filterchecks);
-
-	// Only the first rule should be enabled
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(default_ruleset));
-
-	// Enable the disabled rule by tag
-	engine.enable_rule_by_tag(exec_process_tags, true);
-
-	// Both rules should be enabled now
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(default_ruleset));
-}
-
-TEST(EnableRule, enable_rule_id)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-	uint16_t ruleset_1_id;
-	uint16_t ruleset_2_id;
-	uint16_t ruleset_3_id;
-
-	load_rules(engine, inspector, filterchecks);
-
-	// The cases are identical to above, just using ruleset ids
-	// instead of names.
-
-	ruleset_1_id = engine.find_ruleset_id(ruleset_1);
-	ruleset_2_id = engine.find_ruleset_id(ruleset_2);
-	ruleset_3_id = engine.find_ruleset_id(ruleset_3);
-
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(default_ruleset));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	engine.enable_rule("test rule", true, ruleset_1_id);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	engine.enable_rule("test rule", true, ruleset_2_id);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-
-	engine.enable_rule("", true, ruleset_3_id);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_3));
-
-	engine.enable_rule("test", false, ruleset_2_id);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_3));
-}
-
-TEST(EnableRule, enable_rule_name_exact)
-{
-	falco_engine engine;
-	sinsp inspector;
-	sinsp_filter_check_list filterchecks;
-
-	load_rules(engine, inspector, filterchecks);
-
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(default_ruleset));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_4));
-
-	engine.enable_rule_exact("test rule", true, ruleset_1);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_4));
-
-	engine.enable_rule_exact("test rule", true, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_4));
-
-	// This should **not** enable as this is a substring and not
-	// an exact match.
-	engine.enable_rule_exact("test", true, ruleset_3);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_4));
-
-	engine.enable_rule_exact("", true, ruleset_4);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_4));
-
-	engine.enable_rule("test rule", false, ruleset_2);
-	EXPECT_EQ(1, engine.num_rules_for_ruleset(ruleset_1));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_2));
-	EXPECT_EQ(0, engine.num_rules_for_ruleset(ruleset_3));
-	EXPECT_EQ(2, engine.num_rules_for_ruleset(ruleset_4));
-}

unit_tests/engine/test_rule_loader.cpp

@@ -1,970 +0,0 @@
-#include <gtest/gtest.h>
-
-#include "falco_engine.h"
-#include "rule_loader_reader.h"
-#include "rule_loader_compiler.h"
-#include "rule_loading_messages.h"
-
-class engine_loader_test : public ::testing::Test {
-protected:
-	void SetUp() override
-	{
-		m_sample_ruleset = "sample-ruleset";
-		m_sample_source = falco_common::syscall_source;
-
-		// create a falco engine ready to load the ruleset
-		m_inspector.reset(new sinsp());
-		m_engine.reset(new falco_engine());
-		m_filter_factory = std::shared_ptr<gen_event_filter_factory>(
-			new sinsp_filter_factory(m_inspector.get(), m_filterlist));
-		m_formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
-			new sinsp_evt_formatter_factory(m_inspector.get(), m_filterlist));
-		m_engine->add_source(m_sample_source, m_filter_factory, m_formatter_factory);
-	}
-
-	void TearDown() override
-	{
-
-	}
-
-	bool load_rules(std::string rules_content, std::string rules_filename)
-	{
-		bool ret = false;
-		falco::load_result::rules_contents_t rc = {{rules_filename, rules_content}};
-		m_load_result = m_engine->load_rules(rules_content, rules_filename);
-		m_load_result_string = m_load_result->as_string(true, rc);
-		m_load_result_json = m_load_result->as_json(rc);
-		ret = m_load_result->successful();
-
-		if (ret)
-		{
-			m_engine->enable_rule("", true, m_sample_ruleset);
-		}
-
-		return ret;
-	}
-
-	// This must be kept in line with the (private) falco_engine::s_default_ruleset
-	uint64_t num_rules_for_ruleset(std::string ruleset = "falco-default-ruleset")
-	{
-		return m_engine->num_rules_for_ruleset(ruleset);
-	}
-
-	bool has_warnings()
-	{
-		return m_load_result->has_warnings();
-	}
-
-	bool check_warning_message(std::string warning_msg)
-	{
-		if(!m_load_result->has_warnings())
-		{
-			return false;
-		}
-
-		for(auto &warn : m_load_result_json["warnings"])
-		{
-			std::string msg = warn["message"];
-			// Debug:
-			// printf("msg: %s\n", msg.c_str());
-			if(msg.find(warning_msg) != std::string::npos)
-			{
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	bool check_error_message(std::string error_msg)
-	{
-		// if the loading is successful there are no errors
-		if(m_load_result->successful())
-		{
-			return false;
-		}
-
-		for(auto &err : m_load_result_json["errors"])
-		{
-			std::string msg = err["message"];
-			// Debug:
-			// printf("msg: %s\n", msg.c_str());
-			if(msg.find(error_msg) != std::string::npos)
-			{
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	std::string get_compiled_rule_condition(std::string rule_name = "")
-	{
-		auto rule_description = m_engine->describe_rule(&rule_name, {});
-		return rule_description["rules"][0]["details"]["condition_compiled"].template get<std::string>();
-	}
-
-	std::string m_sample_ruleset;
-	std::string m_sample_source;
-	sinsp_filter_check_list m_filterlist;
-	std::shared_ptr<gen_event_filter_factory> m_filter_factory;
-	std::shared_ptr<gen_event_formatter_factory> m_formatter_factory;
-	std::unique_ptr<falco_engine> m_engine;
-	std::unique_ptr<falco::load_result> m_load_result;
-	std::string m_load_result_string;
-	nlohmann::json m_load_result_json;
-	std::unique_ptr<sinsp> m_inspector;
-};
-
-std::string s_sample_ruleset = "sample-ruleset";
-std::string s_sample_source = falco_common::syscall_source;
-
-TEST_F(engine_loader_test, list_append)
-{
-    std::string rules_content = R"END(
-- list: shell_binaries
-  items: [ash, bash, csh, ksh, sh, tcsh, zsh, dash]
-
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type=open and proc.name in (shell_binaries)
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- list: shell_binaries
-  items: [pwsh]
-  override:
-    items: append
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-	ASSERT_EQ(get_compiled_rule_condition("legit_rule"),"(evt.type = open and proc.name in (ash, bash, csh, ksh, sh, tcsh, zsh, dash, pwsh))");
-}
-
-TEST_F(engine_loader_test, condition_append)
-{
-    std::string rules_content = R"END(
-- macro: interactive
-  condition: >
-    ((proc.aname=sshd and proc.name != sshd) or
-    proc.name=systemd-logind or proc.name=login)
-
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type=open and interactive
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- macro: interactive
-  condition: or proc.name = ssh
-  override:
-    condition: append
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-	ASSERT_EQ(get_compiled_rule_condition("legit_rule"),"(evt.type = open and (((proc.aname = sshd and proc.name != sshd) or proc.name = systemd-logind or proc.name = login) or proc.name = ssh))");
-}
-
-TEST_F(engine_loader_test, rule_override_append)
-{
-    std::string rules_content = R"END(
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type=open
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: legit_rule
-  desc: with append
-  condition: and proc.name = cat
-  output: proc=%proc.name
-  override:
-    desc: append
-    condition: append
-    output: append
-)END";
-
-	std::string rule_name = "legit_rule";
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-
-	// Here we don't use the deprecated `append` flag, so we don't expect the warning.
-	ASSERT_FALSE(check_warning_message(WARNING_APPEND));
-
-	auto rule_description = m_engine->describe_rule(&rule_name, {});
-	ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
-	 	"evt.type=open and proc.name = cat");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
-	 	"user=%user.name command=%proc.cmdline file=%fd.name proc=%proc.name");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
-	 	"legit rule description with append");
-}
-
-TEST_F(engine_loader_test, rule_append)
-{
-    std::string rules_content = R"END(
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type=open
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: legit_rule
-  condition: and proc.name = cat
-  append: true
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-
-	// We should have at least one warning because the 'append' flag is deprecated.
-	ASSERT_TRUE(check_warning_message(WARNING_APPEND));
-
-	ASSERT_EQ(get_compiled_rule_condition("legit_rule"),"(evt.type = open and proc.name = cat)");
-}
-
-TEST_F(engine_loader_test, rule_override_replace)
-{
-    std::string rules_content = R"END(
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type=open
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: legit_rule
-  desc: a replaced legit description
-  condition: evt.type = close
-  override:
-    desc: replace
-    condition: replace
-)END";
-
-	std::string rule_name = "legit_rule";
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-
-	auto rule_description = m_engine->describe_rule(&rule_name, {});
-	ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
-	 	"evt.type = close");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
-	 	"user=%user.name command=%proc.cmdline file=%fd.name");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
-	 	"a replaced legit description");
-}
-
-TEST_F(engine_loader_test, rule_override_append_replace)
-{
-    std::string rules_content = R"END(
-- rule: legit_rule
-  desc: legit rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: legit_rule
-  desc: a replaced legit description
-  condition: and proc.name = cat
-  priority: WARNING
-  override:
-    desc: replace
-    condition: append
-    priority: replace
-)END";
-
-	std::string rule_name = "legit_rule";
-	ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;
-
-	auto rule_description = m_engine->describe_rule(&rule_name, {});
-	ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
-	 	"evt.type = close and proc.name = cat");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
-	 	"user=%user.name command=%proc.cmdline file=%fd.name");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
-	 	"a replaced legit description");
-
-	ASSERT_EQ(rule_description["rules"][0]["info"]["priority"].template get<std::string>(),
-	 	"Warning");
-}
-
-TEST_F(engine_loader_test, rule_incorrect_override_type)
-{
-    std::string rules_content = R"END(
-- rule: failing_rule
-  desc: legit rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: failing_rule
-  desc: an appended incorrect field
-  condition: and proc.name = cat
-  priority: WARNING
-  override:
-    desc: replace
-    condition: append
-    priority: append
-)END";
-
-	std::string rule_name = "failing_rule";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message("Key 'priority' cannot be appended to, use 'replace' instead"));
-	ASSERT_TRUE(std::string(m_load_result_json["errors"][0]["context"]["snippet"]).find("priority: append") != std::string::npos);
-}
-
-TEST_F(engine_loader_test, rule_incorrect_append_override)
-{
-    std::string rules_content = R"END(
-- rule: failing_rule
-  desc: legit rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: failing_rule
-  desc: an appended incorrect field
-  condition: and proc.name = cat
-  append: true
-  override:
-    desc: replace
-    condition: append
-)END";
-
-	std::string rule_name = "failing_rule";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	
-	// We should have at least one warning because the 'append' flag is deprecated.
-	ASSERT_TRUE(check_warning_message(WARNING_APPEND));
-	
-	ASSERT_TRUE(check_error_message(ERROR_OVERRIDE_APPEND));
-}
-
-TEST_F(engine_loader_test, macro_override_append_before_macro_definition)
-{
-    std::string rules_content = R"END(
-
-- macro: open_simple
-  condition: or evt.type = openat2
-  override:
-    condition: append
-
-- macro: open_simple
-  condition: evt.type in (open,openat)
-
-- rule: test_rule
-  desc: simple rule
-  condition: open_simple
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a macro override before the macro definition.
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_MACRO));
-}
-
-TEST_F(engine_loader_test, macro_override_replace_before_macro_definition)
-{
-    std::string rules_content = R"END(
-
-- macro: open_simple
-  condition: or evt.type = openat2
-  override:
-    condition: replace
-
-- macro: open_simple
-  condition: evt.type in (open,openat)
-
-- rule: test_rule
-  desc: simple rule
-  condition: open_simple
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// The first override defines a macro that is overridden by the second macro definition
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"evt.type in (open, openat)");	
-}
-
-TEST_F(engine_loader_test, macro_append_before_macro_definition)
-{
-    std::string rules_content = R"END(
-
-- macro: open_simple
-  condition: or evt.type = openat2
-  append: true
-
-- macro: open_simple
-  condition: evt.type in (open,openat)
-
-- rule: test_rule
-  desc: simple rule
-  condition: open_simple
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a macro override before the macro definition.
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_MACRO));
-}
-
-TEST_F(engine_loader_test, macro_override_append_after_macro_definition)
-{
-    std::string rules_content = R"END(
-
-- macro: open_simple
-  condition: evt.type in (open,openat)
-
-- macro: open_simple
-  condition: or evt.type = openat2
-  override:
-    condition: append
-
-- rule: test_rule
-  desc: simple rule
-  condition: open_simple
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a macro override before the macro definition.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type in (open, openat) or evt.type = openat2)");
-}
-
-TEST_F(engine_loader_test, macro_append_after_macro_definition)
-{
-    std::string rules_content = R"END(
-
-- macro: open_simple
-  condition: evt.type in (open,openat)
-
-- macro: open_simple
-  condition: or evt.type = openat2
-  append: true
-
-- rule: test_rule
-  desc: simple rule
-  condition: open_simple
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a macro override before the macro definition.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type in (open, openat) or evt.type = openat2)");
-}
-
-TEST_F(engine_loader_test, rule_override_append_before_rule_definition)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  condition: and proc.name = cat
-  override:
-    condition: append
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type in (open,openat)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_RULE_APPEND));
-}
-
-TEST_F(engine_loader_test, rule_override_replace_before_rule_definition)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  condition: and proc.name = cat
-  override:
-    condition: replace
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type in (open,openat)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_RULE_REPLACE));
-}
-
-TEST_F(engine_loader_test, rule_append_before_rule_definition)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  condition: and proc.name = cat
-  append: true
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type in (open,openat)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_RULE_APPEND));
-}
-
-TEST_F(engine_loader_test, rule_override_append_after_rule_definition)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type in (open,openat)
-  output: command=%proc.cmdline
-  priority: INFO
-
-- rule: test_rule
-  condition: and proc.name = cat
-  override:
-    condition: append
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type in (open, openat) and proc.name = cat)");
-}
-
-TEST_F(engine_loader_test, rule_append_after_rule_definition)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type in (open,openat)
-  output: command=%proc.cmdline
-  priority: INFO
-
-- rule: test_rule
-  condition: and proc.name = cat
-  append: true
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type in (open, openat) and proc.name = cat)");
-}
-
-TEST_F(engine_loader_test, list_override_append_wrong_key)
-{
-	// todo: maybe we want to manage some non-existent keys
-	// Please note how the non-existent key 'non-existent keys' is ignored.
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  override_written_wrong:
-    items: append
-
-- list: dev_creation_binaries
-  items: [blkid]
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// Since there is a wrong key in the first list definition the `override` is not
-	// considered. so in this situation, we are defining the list 2 times. The 
-	// second one overrides the first one.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type = execve and proc.name in (blkid))");
-}
-
-TEST_F(engine_loader_test, list_override_append_before_list_definition)
-{
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  override:
-    items: append
-
-- list: dev_creation_binaries
-  items: [blkid]
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a list override before the list definition.
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_LIST));
-}
-
-TEST_F(engine_loader_test, list_override_replace_before_list_definition)
-{
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  override:
-    items: replace
-
-- list: dev_creation_binaries
-  items: [blkid]
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// With override replace we define a first list that then is overridden by the second one.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type = execve and proc.name in (blkid))");
-}
-
-TEST_F(engine_loader_test, list_append_before_list_definition)
-{
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  append: true
-
-- list: dev_creation_binaries
-  items: [blkid]
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	// We cannot define a list append before the list definition.
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message(ERROR_NO_PREVIOUS_LIST));
-}
-
-TEST_F(engine_loader_test, list_override_append_after_list_definition)
-{
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: [blkid]
-
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  override:
-    items: append
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type = execve and proc.name in (blkid, csi-provisioner, csi-attacher))");
-}
-
-TEST_F(engine_loader_test, list_append_after_list_definition)
-{
-    std::string rules_content = R"END(
-- list: dev_creation_binaries
-  items: [blkid]
-
-- list: dev_creation_binaries
-  items: ["csi-provisioner", "csi-attacher"]
-  append: true
-
-- rule: test_rule
-  desc: simple rule
-  condition: evt.type = execve and proc.name in (dev_creation_binaries)
-  output: command=%proc.cmdline
-  priority: INFO
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"(evt.type = execve and proc.name in (blkid, csi-provisioner, csi-attacher))");
-}
-
-TEST_F(engine_loader_test, rule_override_without_field)
-{
-    std::string rules_content = R"END(
-- rule: failing_rule
-  desc: legit rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: failing_rule
-  desc: an appended incorrect field
-  override:
-    desc: replace
-    condition: append
-)END";
-
-	std::string rule_name = "failing_rule";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message("An append override for 'condition' was specified but 'condition' is not defined"));
-}
-
-TEST_F(engine_loader_test, rule_override_extra_field)
-{
-    std::string rules_content = R"END(
-- rule: failing_rule
-  desc: legit rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-
-- rule: failing_rule
-  desc: an appended incorrect field
-  condition: and proc.name = cat
-  priority: WARNING
-  override:
-    desc: replace
-    condition: append
-)END";
-
-	std::string rule_name = "failing_rule";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message("Unexpected key 'priority'"));
-}
-
-TEST_F(engine_loader_test, missing_enabled_key_with_override)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-- rule: test_rule
-  desc: missing enabled key
-  condition: and proc.name = cat
-  override:
-    desc: replace
-    condition: append
-    enabled: replace
-)END";
-
-	// In the rule override we miss `enabled: true`
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message("'enabled' was specified but 'enabled' is not defined"));
-}
-
-TEST_F(engine_loader_test, rule_override_with_enabled)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-- rule: test_rule
-  desc: correct override
-  condition: and proc.name = cat
-  enabled: true
-  override:
-    desc: replace
-    condition: append
-    enabled: replace
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_FALSE(has_warnings());
-	// The rule should be enabled at the end.
-	EXPECT_EQ(num_rules_for_ruleset(), 1);
-}
-
-TEST_F(engine_loader_test, rule_not_enabled)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: rule not enabled
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_FALSE(has_warnings());
-	EXPECT_EQ(num_rules_for_ruleset(), 0);
-}
-
-TEST_F(engine_loader_test, rule_enabled_warning)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-- rule: test_rule
-  enabled: true
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_warning_message(WARNING_ENABLED));
-	// The rule should be enabled at the end.
-	EXPECT_EQ(num_rules_for_ruleset(), 1);
-}
-
-// todo!: Probably we shouldn't allow this syntax
-TEST_F(engine_loader_test, rule_enabled_is_ignored_by_append)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-- rule: test_rule
-  condition: and proc.name = cat
-  append: true
-  enabled: true
-)END";
-
-	// 'enabled' is ignored by the append, this syntax is not supported
-	// so the rule is not enabled.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	EXPECT_EQ(num_rules_for_ruleset(), 0);
-}
-
-// todo!: Probably we shouldn't allow this syntax
-TEST_F(engine_loader_test, rewrite_rule)
-{
-    std::string rules_content = R"END(
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-- rule: test_rule
-  desc: redefined rule syntax
-  condition: proc.name = cat
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: WARNING
-  enabled: true
-)END";
-
-	// The above syntax is not supported, we cannot override the content
-	// of a rule in this way.
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	// In this case the rule is completely overridden but this syntax is not supported.
-	EXPECT_EQ(num_rules_for_ruleset(), 1);
-	ASSERT_EQ(get_compiled_rule_condition("test_rule"),"proc.name = cat");
-}
-
-TEST_F(engine_loader_test, required_engine_version_semver)
-{
-    std::string rules_content = R"END(
-- required_engine_version: 0.26.0
-
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_FALSE(has_warnings());
-}
-
-TEST_F(engine_loader_test, required_engine_version_not_semver)
-{
-    std::string rules_content = R"END(
-- required_engine_version: 26
-
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_FALSE(has_warnings());
-}
-
-TEST_F(engine_loader_test, required_engine_version_invalid)
-{
-    std::string rules_content = R"END(
-- required_engine_version: seven
-
-- rule: test_rule
-  desc: test rule description
-  condition: evt.type = close
-  output: user=%user.name command=%proc.cmdline file=%fd.name
-  priority: INFO
-  enabled: false
-
-)END";
-
-	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(check_error_message("Unable to parse engine version"));
-}
-
-// checks for issue described in https://github.com/falcosecurity/falco/pull/3028
-TEST_F(engine_loader_test, list_value_with_escaping)
-{
-    std::string rules_content = R"END(
-- list: my_list
-  items: [non_escaped_val, "escaped val"]
-)END";
-
-	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
-	ASSERT_TRUE(m_load_result->successful());
-  ASSERT_TRUE(m_load_result->has_warnings()); // a warning for the unused list
-
-  auto rule_description = m_engine->describe_rule(nullptr, {});
-  ASSERT_TRUE(m_load_result->successful());
-  ASSERT_EQ(rule_description["rules"].size(), 0);
-  ASSERT_EQ(rule_description["macros"].size(), 0);
-  ASSERT_EQ(rule_description["lists"].size(), 1);
-
-  // escaped values must not be interpreted as list refs by mistake
-  ASSERT_EQ(rule_description["lists"][0]["details"]["lists"].size(), 0);
-
-  // values should be escaped correctly
-  ASSERT_EQ(rule_description["lists"][0]["details"]["items_compiled"].size(), 2);
-  ASSERT_EQ(rule_description["lists"][0]["details"]["items_compiled"][0].template get<std::string>(), "non_escaped_val");
-  ASSERT_EQ(rule_description["lists"][0]["details"]["items_compiled"][1].template get<std::string>(), "escaped val");
-}

unit_tests/falco/test_configuration.cpp

@@ -114,35 +114,17 @@ TEST(Configuration, configuration_environment_variables)
     // Set an environment variable for testing purposes
     std::string env_var_value = "envVarValue";
     std::string env_var_name = "ENV_VAR";
-    SET_ENV_VAR(env_var_name.c_str(), env_var_value.c_str());
-
-    std::string embedded_env_var_value = "${ENV_VAR}";
-    std::string embedded_env_var_name = "ENV_VAR_EMBEDDED";
-    SET_ENV_VAR(embedded_env_var_name.c_str(), embedded_env_var_value.c_str());
-
-    std::string bool_env_var_value = "true";
-    std::string bool_env_var_name = "ENV_VAR_BOOL";
-    SET_ENV_VAR(bool_env_var_name.c_str(), bool_env_var_value.c_str());
-
-    std::string int_env_var_value = "12";
-    std::string int_env_var_name = "ENV_VAR_INT";
-    SET_ENV_VAR(int_env_var_name.c_str(), int_env_var_value.c_str());
-
-    std::string empty_env_var_value = "";
-    std::string empty_env_var_name = "ENV_VAR_EMPTY";
-    SET_ENV_VAR(empty_env_var_name.c_str(), empty_env_var_value.c_str());
-
     std::string default_value = "default";
-    std::string env_var_sample_yaml =
+    SET_ENV_VAR(env_var_name.c_str(), env_var_value.c_str());
+    yaml_helper conf;
+
+    std::string sample_yaml =
         "base_value:\n"
         "    id: $ENV_VAR\n"
         "    name: '${ENV_VAR}'\n"
         "    string: my_string\n"
         "    invalid: $${ENV_VAR}\n"
-	"    invalid_env: $$ENV_VAR\n"
-	"    invalid_double_env: $${ENV_VAR}$${ENV_VAR}\n"
-	"    invalid_embedded_env: $${${ENV_VAR}}\n"
-	"    invalid_valid_env: $${ENV_VAR}${ENV_VAR}\n"
+		"    invalid_env: $$ENV_VAR\n"
         "    escaped: \"${ENV_VAR}\"\n"
         "    subvalue:\n"
         "        subvalue2:\n"
@@ -151,135 +133,52 @@ TEST(Configuration, configuration_environment_variables)
         "    sample_list:\n"
         "        - ${ENV_VAR}\n"
         "        - ' ${ENV_VAR}'\n"
-	"        - '${ENV_VAR} '\n"
-        "        - $UNSED_XX_X_X_VAR\n"
-        "paths:\n"
-	"    - ${ENV_VAR}/foo\n"
-	"    - $ENV_VAR/foo\n"
-	"    - /foo/${ENV_VAR}/\n"
-	"    - /${ENV_VAR}/${ENV_VAR}${ENV_VAR}/foo\n"
-	"    - ${ENV_VAR_EMBEDDED}/foo\n"
-	"is_test: ${ENV_VAR_BOOL}\n"
-	"num_test: ${ENV_VAR_INT}\n"
-	"empty_test: ${ENV_VAR_EMPTY}\n"
-	"plugins:\n"
-	"  - name: k8saudit\n"
-	"    library_path: /foo/${ENV_VAR}/libk8saudit.so\n"
-	"    open_params: ${ENV_VAR_INT}\n";
-
-    yaml_helper conf;
-    conf.load_from_string(env_var_sample_yaml);
+        "        - $UNSED_XX_X_X_VAR\n";
+    conf.load_from_string(sample_yaml);
 
     /* Check if the base values are defined */
     ASSERT_TRUE(conf.is_defined("base_value"));
     ASSERT_TRUE(conf.is_defined("base_value_2"));
-    ASSERT_TRUE(conf.is_defined("paths"));
     ASSERT_FALSE(conf.is_defined("unknown_base_value"));
 
     /* Test fetching of a regular string without any environment variable */
-    auto base_value_string = conf.get_scalar<std::string>("base_value.string", default_value);
+    std::string base_value_string = conf.get_scalar<std::string>("base_value.string", default_value);
     ASSERT_EQ(base_value_string, "my_string");
 
     /* Test fetching of escaped environment variable format. Should return the string as-is after stripping the leading `$` */
-    auto base_value_invalid = conf.get_scalar<std::string>("base_value.invalid", default_value);
+    std::string base_value_invalid = conf.get_scalar<std::string>("base_value.invalid", default_value);
     ASSERT_EQ(base_value_invalid, "${ENV_VAR}");
 
-    /* Test fetching of invalid escaped environment variable format. Should return the string as-is */
-    auto base_value_invalid_env = conf.get_scalar<std::string>("base_value.invalid_env", default_value);
+	/* Test fetching of invalid escaped environment variable format. Should return the string as-is */
+    std::string base_value_invalid_env = conf.get_scalar<std::string>("base_value.invalid_env", default_value);
     ASSERT_EQ(base_value_invalid_env, "$$ENV_VAR");
 
-    /* Test fetching of 2 escaped environment variables side by side. Should return the string as-is after stripping the leading `$` */
-    auto base_value_double_invalid = conf.get_scalar<std::string>("base_value.invalid_double_env", default_value);
-    ASSERT_EQ(base_value_double_invalid, "${ENV_VAR}${ENV_VAR}");
-
-    /*
-     * Test fetching of escaped environment variable format with inside an env variable.
-     * Should return the string as-is after stripping the leading `$` with the resolved env variable within
-     */
-    auto base_value_embedded_invalid = conf.get_scalar<std::string>("base_value.invalid_embedded_env", default_value);
-    ASSERT_EQ(base_value_embedded_invalid, "${" + env_var_value + "}");
-
-    /*
-     * Test fetching of an escaped env variable plus an env variable side by side.
-     * Should return the escaped one trimming the leading `$` plus the second one resolved.
-     */
-    auto base_value_valid_invalid = conf.get_scalar<std::string>("base_value.invalid_valid_env", default_value);
-    ASSERT_EQ(base_value_valid_invalid, "${ENV_VAR}" + env_var_value);
-
     /* Test fetching of strings that contain environment variables */
-    auto base_value_id = conf.get_scalar<std::string>("base_value.id", default_value);
+    std::string base_value_id = conf.get_scalar<std::string>("base_value.id", default_value);
     ASSERT_EQ(base_value_id, "$ENV_VAR"); // Does not follow the `${VAR}` format, so it should be treated as a regular string
 
-    auto base_value_name = conf.get_scalar<std::string>("base_value.name", default_value);
+    std::string base_value_name = conf.get_scalar<std::string>("base_value.name", default_value);
     ASSERT_EQ(base_value_name, env_var_value); // Proper environment variable format
 
-    auto base_value_escaped = conf.get_scalar<std::string>("base_value.escaped", default_value);
+    std::string base_value_escaped = conf.get_scalar<std::string>("base_value.escaped", default_value);
     ASSERT_EQ(base_value_escaped, env_var_value); // Environment variable within quotes
 
-    /* Test fetching of an undefined environment variable. Resolves to empty string. */
-    auto unknown_boolean = conf.get_scalar<std::string>("base_value.subvalue.subvalue2.boolean", default_value);
-    ASSERT_EQ(unknown_boolean, "");
+    /* Test fetching of an undefined environment variable. Expected to return the default value.*/
+    std::string unknown_boolean = conf.get_scalar<std::string>("base_value.subvalue.subvalue2.boolean", default_value);
+    ASSERT_EQ(unknown_boolean, default_value);
 
     /* Test fetching of environment variables from a list */
-    auto base_value_2_list_0 = conf.get_scalar<std::string>("base_value_2.sample_list[0]", default_value);
+    std::string base_value_2_list_0 = conf.get_scalar<std::string>("base_value_2.sample_list[0]", default_value);
     ASSERT_EQ(base_value_2_list_0, env_var_value); // Proper environment variable format
 
-    auto base_value_2_list_1 = conf.get_scalar<std::string>("base_value_2.sample_list[1]", default_value);
-    ASSERT_EQ(base_value_2_list_1, " " + env_var_value); // Environment variable preceded by a space, still extracted env var with leading space
+    std::string base_value_2_list_1 = conf.get_scalar<std::string>("base_value_2.sample_list[1]", default_value);
+    ASSERT_EQ(base_value_2_list_1, " ${ENV_VAR}"); // Environment variable preceded by a space, hence treated as a regular string
 
-    auto base_value_2_list_2 = conf.get_scalar<std::string>("base_value_2.sample_list[2]", default_value);
-    ASSERT_EQ(base_value_2_list_2, env_var_value + " "); // Environment variable followed by a space, still extracted env var with trailing space
+    std::string base_value_2_list_2 = conf.get_scalar<std::string>("base_value_2.sample_list[2]", default_value);
+    ASSERT_EQ(base_value_2_list_2, "$UNSED_XX_X_X_VAR"); // Does not follow the `${VAR}` format, so should be treated as a regular string
 
-    auto base_value_2_list_3 = conf.get_scalar<std::string>("base_value_2.sample_list[3]", default_value);
-    ASSERT_EQ(base_value_2_list_3, "$UNSED_XX_X_X_VAR"); // Does not follow the `${VAR}` format, so should be treated as a regular string
-
-    /* Test expansion of environment variables within strings */
-    auto path_list_0 = conf.get_scalar<std::string>("paths[0]", default_value);
-    ASSERT_EQ(path_list_0, env_var_value + "/foo"); // Even if env var is part of bigger string, it gets expanded
-
-    auto path_list_1 = conf.get_scalar<std::string>("paths[1]", default_value);
-    ASSERT_EQ(path_list_1, "$ENV_VAR/foo"); // Does not follow the `${VAR}` format, so should be treated as a regular string
-
-    auto path_list_2 = conf.get_scalar<std::string>("paths[2]", default_value);
-    ASSERT_EQ(path_list_2, "/foo/" + env_var_value + "/"); // Even when env var is in the middle of a string. it gets expanded
-
-    auto path_list_3 = conf.get_scalar<std::string>("paths[3]", default_value);
-    ASSERT_EQ(path_list_3, "/" + env_var_value + "/" + env_var_value + env_var_value + "/foo"); // Even when the string contains multiple env vars they are correctly expanded
-
-    auto path_list_4 = conf.get_scalar<std::string>("paths[4]", default_value);
-    ASSERT_EQ(path_list_4, env_var_value + "/foo"); // Even when the env var contains another env var, it gets correctly double-expanded
-
-    /* Check that variable expansion is type-aware */
-    auto boolean = conf.get_scalar<bool>("is_test", false);
-    ASSERT_EQ(boolean, true); // `true` can be parsed to bool.
-
-    auto boolean_as_str = conf.get_scalar<std::string>("is_test", "false");
-    ASSERT_EQ(boolean_as_str, "true"); // `true` can be parsed to string.
-
-    auto boolean_as_int = conf.get_scalar<int32_t>("is_test", 0);
-    ASSERT_EQ(boolean_as_int, 0); // `true` cannot be parsed to integer.
-
-    auto integer = conf.get_scalar<int32_t>("num_test", -1);
-    ASSERT_EQ(integer, 12);
-
-    // An env var that resolves to an empty string returns ""
-    auto empty_default_str = conf.get_scalar<std::string>("empty_test", default_value);
-    ASSERT_EQ(empty_default_str, "");
-
-    std::list<falco_configuration::plugin_config> plugins;
-    conf.get_sequence<std::list<falco_configuration::plugin_config>>(plugins, std::string("plugins"));
-    std::vector<falco_configuration::plugin_config> m_plugins{ std::make_move_iterator(std::begin(plugins)),
-							      std::make_move_iterator(std::end(plugins)) };
-    ASSERT_EQ(m_plugins[0].m_name, "k8saudit");
-    ASSERT_EQ(m_plugins[0].m_library_path, "/foo/" + env_var_value + "/libk8saudit.so");
-    ASSERT_EQ(m_plugins[0].m_open_params, "12");
-
-    /* Clear the set environment variables after testing */
-    SET_ENV_VAR(env_var_name.c_str(), "");
-    SET_ENV_VAR(embedded_env_var_name.c_str(), "");
-    SET_ENV_VAR(bool_env_var_name.c_str(), "");
-    SET_ENV_VAR(int_env_var_name.c_str(), "");
-    SET_ENV_VAR(empty_env_var_name.c_str(), "");
+    /* Clear the set environment variable after testing */
+    SET_ENV_VAR(env_var_name.c_str(), env_var_value.c_str());
 }
 
 TEST(Configuration, configuration_webserver_ip)

userspace/engine/CMakeLists.txt

@@ -11,7 +11,7 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 
-add_library(falco_engine STATIC
+set(FALCO_ENGINE_SOURCE_FILES
     falco_common.cpp
     falco_engine.cpp
     falco_load_result.cpp
@@ -25,8 +25,9 @@ add_library(falco_engine STATIC
     rule_loader.cpp
     rule_loader_reader.cpp
     rule_loader_collector.cpp
-    rule_loader_compiler.cpp
-)
+    rule_loader_compiler.cpp)
+
+add_library(falco_engine STATIC ${FALCO_ENGINE_SOURCE_FILES})
 
 if (EMSCRIPTEN)
 	target_compile_options(falco_engine PRIVATE "-sDISABLE_EXCEPTION_CATCHING=0")
@@ -34,17 +35,14 @@ endif()
 
 add_dependencies(falco_engine yamlcpp njson)
 
-target_include_directories(falco_engine
-PUBLIC
-    ${LIBSCAP_INCLUDE_DIRS}
-    ${LIBSINSP_INCLUDE_DIRS}
-    ${PROJECT_BINARY_DIR}/userspace/engine
-    ${nlohmann_json_INCLUDE_DIRS}
-    ${TBB_INCLUDE_DIR}
-    ${YAMLCPP_INCLUDE_DIR}
-)
+target_include_directories(
+    falco_engine
+    PUBLIC
+      "${NJSON_INCLUDE}"
+      "${TBB_INCLUDE_DIR}"
+      "${LIBSCAP_INCLUDE_DIRS}"
+      "${LIBSINSP_INCLUDE_DIRS}"
+      "${YAMLCPP_INCLUDE_DIR}"
+      "${PROJECT_BINARY_DIR}/userspace/engine")
 
-target_link_libraries(falco_engine
-    ${FALCO_SINSP_LIBRARY}
-    ${YAMLCPP_LIB}
-)
+target_link_libraries(falco_engine "${FALCO_SINSP_LIBRARY}" "${YAMLCPP_LIB}")

userspace/engine/falco_engine.cpp

@@ -79,6 +79,26 @@ sinsp_version falco_engine::engine_version()
 	return sinsp_version(FALCO_ENGINE_VERSION);
 }
 
+const falco_source* falco_engine::find_source(const std::string& name) const
+{
+	auto ret = m_sources.at(name);
+	if(!ret)
+	{
+		throw falco_exception("Unknown event source " + name);
+	}
+	return ret;
+}
+
+const falco_source* falco_engine::find_source(std::size_t index) const
+{
+	auto ret = m_sources.at(index);
+	if(!ret)
+	{
+		throw falco_exception("Unknown event source index " + std::to_string(index));
+	}
+	return ret;
+}
+
 // Return a key that uniquely represents a field class.
 // For now, we assume name + shortdesc is unique.
 static std::string fieldclass_key(const gen_event_filter_factory::filter_fieldclass_info &fld_info)
@@ -157,6 +177,15 @@ void falco_engine::list_fields(std::string &source, bool verbose, bool names_onl
 	}
 }
 
+void falco_engine::load_rules(const std::string &rules_content, bool verbose, bool all_events)
+{
+	static const std::string no_name = "N/A";
+
+	std::unique_ptr<load_result> res = load_rules(rules_content, no_name);
+
+	interpret_load_result(res, no_name, rules_content, verbose);
+}
+
 std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_content, const std::string &name)
 {
 	rule_loader::configuration cfg(rules_content, m_sources, name);
@@ -228,15 +257,47 @@ std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_c
 	return std::move(cfg.res);
 }
 
+void falco_engine::load_rules_file(const std::string &rules_filename, bool verbose, bool all_events)
+{
+	std::string rules_content;
+
+	read_file(rules_filename, rules_content);
+
+	std::unique_ptr<load_result> res = load_rules(rules_content, rules_filename);
+
+	interpret_load_result(res, rules_filename, rules_content, verbose);
+}
+
+std::unique_ptr<load_result> falco_engine::load_rules_file(const std::string &rules_filename)
+{
+	std::string rules_content;
+
+	try {
+		read_file(rules_filename, rules_content);
+	}
+	catch (falco_exception &e)
+	{
+		rule_loader::context ctx(rules_filename);
+
+		std::unique_ptr<rule_loader::result> res(new rule_loader::result(rules_filename));
+
+		res->add_error(load_result::LOAD_ERR_FILE_READ, e.what(), ctx);
+
+// Old gcc versions (e.g. 4.8.3) won't allow move elision but newer versions
+// (e.g. 10.2.1) would complain about the redundant move.
+#if __GNUC__ > 4
+		return res;
+#else
+		return std::move(res);
+#endif
+	}
+
+	return load_rules(rules_content, rules_filename);
+}
+
 void falco_engine::enable_rule(const std::string &substring, bool enabled, const std::string &ruleset)
 {
 	uint16_t ruleset_id = find_ruleset_id(ruleset);
-
-	enable_rule(substring, enabled, ruleset_id);
-}
-
-void falco_engine::enable_rule(const std::string &substring, bool enabled, const uint16_t ruleset_id)
-{
 	bool match_exact = false;
 
 	for(const auto &it : m_sources)
@@ -255,12 +316,6 @@ void falco_engine::enable_rule(const std::string &substring, bool enabled, const
 void falco_engine::enable_rule_exact(const std::string &rule_name, bool enabled, const std::string &ruleset)
 {
 	uint16_t ruleset_id = find_ruleset_id(ruleset);
-
-	enable_rule_exact(rule_name, enabled, ruleset_id);
-}
-
-void falco_engine::enable_rule_exact(const std::string &rule_name, bool enabled, const uint16_t ruleset_id)
-{
 	bool match_exact = true;
 
 	for(const auto &it : m_sources)
@@ -280,11 +335,6 @@ void falco_engine::enable_rule_by_tag(const std::set<std::string> &tags, bool en
 {
 	uint16_t ruleset_id = find_ruleset_id(ruleset);
 
-	enable_rule_by_tag(tags, enabled, ruleset_id);
-}
-
-void falco_engine::enable_rule_by_tag(const std::set<std::string> &tags, bool enabled, const uint16_t ruleset_id)
-{
 	for(const auto &it : m_sources)
 	{
 		if(enabled)
@@ -355,7 +405,21 @@ std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_ev
 	// source_idx, which means that at any time each filter_ruleset will only
 	// be accessed by a single thread.
 
-	const falco_source *source = find_source(source_idx);
+	const falco_source *source;
+
+	if(source_idx == m_syscall_source_idx)
+	{
+		if(m_syscall_source == NULL)
+		{
+			m_syscall_source = find_source(m_syscall_source_idx);
+		}
+
+		source = m_syscall_source;
+	}
+	else
+	{
+		source = find_source(source_idx);
+	}
 
 	if(should_drop_evt() || !source)
 	{
@@ -457,7 +521,7 @@ nlohmann::json falco_engine::describe_rule(std::string *rule, const std::vector<
 	// output of rules, macros, and lists.
 	if (m_last_compile_output == nullptr)
 	{
-		throw falco_exception("rules must be loaded before describing them");
+		throw falco_exception("rules most be loaded before describing them");
 	}
 
 	// use collected and compiled info to print a json output
@@ -860,50 +924,6 @@ bool falco_engine::is_source_valid(const std::string &source) const
 	return m_sources.at(source) != nullptr;
 }
 
-std::shared_ptr<gen_event_filter_factory> falco_engine::filter_factory_for_source(const std::string& source)
-{
-	return find_source(source)->filter_factory;
-}
-
-std::shared_ptr<gen_event_filter_factory> falco_engine::filter_factory_for_source(std::size_t source_idx)
-{
-	return find_source(source_idx)->filter_factory;
-}
-
-std::shared_ptr<gen_event_formatter_factory> falco_engine::formatter_factory_for_source(const std::string& source)
-{
-	return find_source(source)->formatter_factory;
-}
-
-std::shared_ptr<gen_event_formatter_factory> falco_engine::formatter_factory_for_source(std::size_t source_idx)
-{
-	return find_source(source_idx)->formatter_factory;
-}
-
-std::shared_ptr<filter_ruleset_factory> falco_engine::ruleset_factory_for_source(const std::string& source)
-{
-	return find_source(source)->ruleset_factory;
-}
-
-std::shared_ptr<filter_ruleset_factory> falco_engine::ruleset_factory_for_source(std::size_t source_idx)
-{
-	return find_source(source_idx)->ruleset_factory;
-}
-
-std::shared_ptr<filter_ruleset> falco_engine::ruleset_for_source(const std::string& source_name)
-{
-	const falco_source *source = find_source(source_name);
-
-	return source->ruleset;
-}
-
-std::shared_ptr<filter_ruleset> falco_engine::ruleset_for_source(std::size_t source_idx)
-{
-	const falco_source *source = find_source(source_idx);
-
-	return source->ruleset;
-}
-
 void falco_engine::read_file(const std::string& filename, std::string& contents)
 {
 	std::ifstream is;
@@ -918,6 +938,29 @@ void falco_engine::read_file(const std::string& filename, std::string& contents)
 			std::istreambuf_iterator<char>());
 }
 
+void falco_engine::interpret_load_result(std::unique_ptr<load_result>& res,
+					 const std::string& rules_filename,
+					 const std::string& rules_content,
+					 bool verbose)
+{
+	falco::load_result::rules_contents_t rc = {{rules_filename, rules_content}};
+
+	if(!res->successful())
+	{
+		// The output here is always the full e.g. "verbose" output.
+		throw falco_exception(res->as_string(true, rc).c_str());
+	}
+
+	if(verbose && res->has_warnings())
+	{
+		// Here, verbose controls whether to additionally
+		// "log" e.g. print to stderr. What's logged is always
+		// non-verbose so it fits on a single line.
+		// todo(jasondellaluce): introduce a logging callback in Falco
+		fprintf(stderr, "%s\n", res->as_string(false, rc).c_str());
+	}
+}
+
 static bool check_plugin_requirement_alternatives(
 		const std::vector<falco_engine::plugin_version_requirement>& plugins,
 		const rule_loader::plugin_version_info::requirement_alternatives& alternatives,

userspace/engine/falco_engine.h

@@ -74,8 +74,15 @@ public:
 	void list_fields(std::string &source, bool verbose, bool names_only, bool markdown) const;
 
 	//
-	// Load rules and returns a result object.
+	// Load rules either directly or from a filename.
 	//
+	void load_rules_file(const std::string &rules_filename, bool verbose, bool all_events);
+	void load_rules(const std::string &rules_content, bool verbose, bool all_events);
+
+	//
+	// Identical to above, but returns a result object instead of
+	// throwing exceptions on error.
+	std::unique_ptr<falco::load_result> load_rules_file(const std::string &rules_filename);
 	std::unique_ptr<falco::load_result> load_rules(const std::string &rules_content, const std::string &name);
 
 	//
@@ -89,23 +96,15 @@ public:
 	//
 	void enable_rule(const std::string &substring, bool enabled, const std::string &ruleset = s_default_ruleset);
 
-	// Same as above but providing a ruleset id instead
-	void enable_rule(const std::string &substring, bool enabled, const uint16_t ruleset_id);
 
 	// Like enable_rule, but the rule name must be an exact match.
 	void enable_rule_exact(const std::string &rule_name, bool enabled, const std::string &ruleset = s_default_ruleset);
 
-	// Same as above but providing a ruleset id instead
-	void enable_rule_exact(const std::string &rule_name, bool enabled, const uint16_t ruleset_id);
-
 	//
 	// Enable/Disable any rules with any of the provided tags (set, exact matches only)
 	//
 	void enable_rule_by_tag(const std::set<std::string> &tags, bool enabled, const std::string &ruleset = s_default_ruleset);
 
-	// Same as above but providing a ruleset id instead
-	void enable_rule_by_tag(const std::set<std::string> &tags, bool enabled, const uint16_t ruleset_id);
-
 	//
 	// Must be called after the engine has been configured and all rulesets
 	// have been loaded and enabled/disabled.
@@ -235,31 +234,6 @@ public:
 	// factory for this source.
 	bool is_source_valid(const std::string &source) const;
 
-	//
-	// Given a source, return a formatter factory that can create
-	// filters for events of that source.
-	//
-	std::shared_ptr<gen_event_filter_factory> filter_factory_for_source(const std::string& source);
-	std::shared_ptr<gen_event_filter_factory> filter_factory_for_source(std::size_t source_idx);
-
-	//
-	// Given a source, return a formatter factory that can create
-	// formatters for an event.
-	//
-	std::shared_ptr<gen_event_formatter_factory> formatter_factory_for_source(const std::string& source);
-	std::shared_ptr<gen_event_formatter_factory> formatter_factory_for_source(std::size_t source_idx);
-
-	//
-	// Given a source, return a ruleset factory that can create
-	// rulesets for that source.
-	//
-	std::shared_ptr<filter_ruleset_factory> ruleset_factory_for_source(const std::string& source);
-	std::shared_ptr<filter_ruleset_factory> ruleset_factory_for_source(std::size_t source_idx);
-
-	// Return the filter_ruleset used for a given source.
-	std::shared_ptr<filter_ruleset> ruleset_for_source(const std::string& source);
-	std::shared_ptr<filter_ruleset> ruleset_for_source(std::size_t source_idx);
-
 	//
 	// Given an event source and ruleset, fill in a bitset
 	// containing the event types for which this ruleset can run.
@@ -314,46 +288,17 @@ private:
 	// Throws falco_exception if the file can not be read
 	void read_file(const std::string& filename, std::string& contents);
 
+	// For load_rules methods that throw exceptions on error,
+	// interpret a load_result and throw an exception if needed.
+	void interpret_load_result(std::unique_ptr<falco::load_result>& res,
+				   const std::string& rules_filename,
+				   const std::string& rules_content,
+				   bool verbose);
+
 	indexed_vector<falco_source> m_sources;
 
-	inline const falco_source* find_source(std::size_t index)
-	{
-		const falco_source *source;
-
-		if(index == m_syscall_source_idx)
-		{
-			if(m_syscall_source == NULL)
-			{
-				m_syscall_source = m_sources.at(m_syscall_source_idx);
-				if(!m_syscall_source)
-				{
-					throw falco_exception("Unknown event source index " + std::to_string(index));
-				}
-			}
-
-			source = m_syscall_source;
-		}
-		else
-		{
-			source = m_sources.at(index);
-			if(!source)
-			{
-				throw falco_exception("Unknown event source index " + std::to_string(index));
-			}
-		}
-
-		return source;
-	}
-
-	inline const falco_source* find_source(const std::string& name) const
-	{
-		auto ret = m_sources.at(name);
-		if(!ret)
-		{
-			throw falco_exception("Unknown event source " + name);
-		}
-		return ret;
-	}
+	const falco_source* find_source(std::size_t index) const;
+	const falco_source* find_source(const std::string& name) const;
 
 	// To allow the engine to be extremely fast for syscalls (can
 	// be > 1M events/sec), we save the syscall source/source_idx
@@ -434,3 +379,4 @@ private:
 	std::string m_extra;
 	bool m_replace_container_info;
 };
+

userspace/engine/falco_engine_version.h

@@ -20,7 +20,7 @@ limitations under the License.
 
 // The version of this Falco engine
 #define FALCO_ENGINE_VERSION_MAJOR 0
-#define FALCO_ENGINE_VERSION_MINOR 31
+#define FALCO_ENGINE_VERSION_MINOR 28
 #define FALCO_ENGINE_VERSION_PATCH 0
 
 #define FALCO_ENGINE_VERSION \
@@ -34,4 +34,4 @@ limitations under the License.
 // It represents the fields supported by this version of Falco,
 // the event types, and the underlying driverevent schema. It's used to
 // detetect changes in engine version in our CI jobs.
-#define FALCO_ENGINE_CHECKSUM "7c512927c89f594f024f2ff181077c780c4fe6e9dd4cee3f20a9ef208a356e4e"
+#define FALCO_ENGINE_CHECKSUM "5d488b68856d70300ae37453295383821822d8423af170eb28e1bef52042f0b3"

userspace/engine/falco_load_result.cpp

@@ -66,8 +66,7 @@ static const std::string warning_codes[] = {
 	"LOAD_UNKNOWN_FILTER",
 	"LOAD_UNUSED_MACRO",
 	"LOAD_UNUSED_LIST",
-	"LOAD_UNKNOWN_ITEM",
-	"LOAD_DEPRECATED_ITEM"
+	"LOAD_UNKNOWN_ITEM"
 };
 
 const std::string& falco::load_result::warning_code_str(warning_code wc)
@@ -82,8 +81,7 @@ static const std::string warning_strings[] = {
 	"Unknown field or event-type in condition or output",
 	"Unused macro",
 	"Unused list",
-	"Unknown rules file item",
-	"Used deprecated item"
+	"Unknown rules file item"
 };
 
 const std::string& falco::load_result::warning_str(warning_code wc)
@@ -98,8 +96,7 @@ static const std::string warning_descs[] = {
 	"A rule condition or output refers to a field or evt.type that does not exist. This is normally an error, but if a rule has a skip-if-unknown-filter property, the error is downgraded to a warning.",
 	"A macro is defined in the rules content but is not used by any other macro or rule.",
 	"A list is defined in the rules content but is not used by any other list, macro, or rule.",
-	"An unknown top-level object is in the rules content. It will be ignored.",
-	"A deprecated item is employed by lists, macros, or rules."
+	"An unknown top-level object is in the rules content. It will be ignored."
 };
 
 const std::string& falco::load_result::warning_desc(warning_code wc)

userspace/engine/falco_load_result.h

@@ -54,8 +54,7 @@ public:
 		LOAD_UNKNOWN_FILTER,
 		LOAD_UNUSED_MACRO,
 		LOAD_UNUSED_LIST,
-		LOAD_UNKNOWN_ITEM,
-		LOAD_DEPRECATED_ITEM
+		LOAD_UNKNOWN_ITEM
 	};
 
 	virtual ~load_result() = default;

userspace/engine/rule_loader.cpp

@@ -41,8 +41,7 @@ static const std::string item_type_strings[] = {
 	"condition expression",
 	"rule output",
 	"rule output expression",
-	"rule priority",
-	"overrides"
+	"rule priority"
 };
 
 const std::string& rule_loader::context::item_type_as_string(enum item_type it)
@@ -554,11 +553,6 @@ rule_loader::rule_info::rule_info(context &ctx)
 {
 }
 
-rule_loader::rule_update_info::rule_update_info(context &ctx)
-	: ctx(ctx), cond_ctx(ctx)
-{
-}
-
 rule_loader::rule_load_exception::rule_load_exception(falco::load_result::error_code ec, const std::string& msg, const context& ctx)
 	: ec(ec), msg(msg), ctx(ctx)
 {

userspace/engine/rule_loader.h

@@ -19,7 +19,6 @@ limitations under the License.
 
 #include <string>
 #include <vector>
-#include <optional>
 #include <yaml-cpp/yaml.h>
 #include <nlohmann/json.hpp>
 #include "falco_source.h"
@@ -57,8 +56,7 @@ namespace rule_loader
 			CONDITION_EXPRESSION,
 			RULE_OUTPUT,
 			RULE_OUTPUT_EXPRESSION,
-			RULE_PRIORITY,
-			OVERRIDE
+			RULE_PRIORITY
 		};
 
 		static const std::string& item_type_as_string(enum item_type it);
@@ -453,38 +451,4 @@ namespace rule_loader
 		bool warn_evttypes;
 		bool skip_if_unknown_filter;
 	};
-
-	/*!
-		\brief Represents infos about a rule update (append or replace) request
-	*/
-
-	struct rule_update_info
-	{
-		rule_update_info(context &ctx);
-		~rule_update_info() = default;
-		rule_update_info(rule_update_info&&) = default;
-		rule_update_info& operator = (rule_update_info&&) = default;
-		rule_update_info(const rule_update_info&) = default;
-		rule_update_info& operator = (const rule_update_info&) = default;
-
-		bool has_any_value()
-		{
-			return cond.has_value() || output.has_value() || desc.has_value() || tags.has_value() ||
-				   exceptions.has_value() || priority.has_value() || enabled.has_value() ||
-				   warn_evttypes.has_value() || skip_if_unknown_filter.has_value();
-		}
-
-		context ctx;
-		context cond_ctx;
-		std::string name;
-		std::optional<std::string> cond;
-		std::optional<std::string> output;
-		std::optional<std::string> desc;
-		std::optional<std::set<std::string>> tags;
-		std::optional<std::vector<rule_exception_info>> exceptions;
-		std::optional<falco_common::priority_type> priority;
-		std::optional<bool> enabled;
-		std::optional<bool> warn_evttypes;
-		std::optional<bool> skip_if_unknown_filter;
-	};
 };

userspace/engine/rule_loader_collector.cpp

@@ -20,7 +20,6 @@ limitations under the License.
 
 #include "falco_engine.h"
 #include "rule_loader_collector.h"
-#include "rule_loading_messages.h"
 
 #define THROW(cond, err, ctx)    { if ((cond)) { throw rule_loader::rule_load_exception(falco::load_result::LOAD_ERR_VALIDATE, (err), (ctx)); } }
 
@@ -49,14 +48,8 @@ static inline void define_info(indexed_vector<T>& infos, T& info, uint32_t id)
 	}
 }
 
-template <typename T, typename U>
-static inline void append_info(T* prev, U& info, uint32_t id)
-{
-	prev->visibility = id;
-}
-
-template <typename T, typename U>
-static inline void replace_info(T* prev, U& info, uint32_t id)
+template <typename T>
+static inline void append_info(T* prev, T& info, uint32_t id)
 {
 	prev->visibility = id;
 }
@@ -191,7 +184,9 @@ void rule_loader::collector::define(configuration& cfg, list_info& info)
 void rule_loader::collector::append(configuration& cfg, list_info& info)
 {
 	auto prev = m_list_infos.at(info.name);
-	THROW(!prev, ERROR_NO_PREVIOUS_LIST, info.ctx);
+	THROW(!prev,
+	       "List has 'append' key but no list by that name already exists",
+	       info.ctx);
 	prev->items.insert(prev->items.end(), info.items.begin(), info.items.end());
 	append_info(prev, info, m_cur_index++);
 }
@@ -204,7 +199,9 @@ void rule_loader::collector::define(configuration& cfg, macro_info& info)
 void rule_loader::collector::append(configuration& cfg, macro_info& info)
 {
 	auto prev = m_macro_infos.at(info.name);
-	THROW(!prev, ERROR_NO_PREVIOUS_MACRO, info.ctx);
+	THROW(!prev,
+	       "Macro has 'append' key but no macro by that name already exists",
+	       info.ctx);
 	prev->cond += " ";
 	prev->cond += info.cond;
 	append_info(prev, info, m_cur_index++);
@@ -236,14 +233,15 @@ void rule_loader::collector::define(configuration& cfg, rule_info& info)
 	define_info(m_rule_infos, info, m_cur_index++);
 }
 
-void rule_loader::collector::append(configuration& cfg, rule_update_info& info)
+void rule_loader::collector::append(configuration& cfg, rule_info& info)
 {
 	auto prev = m_rule_infos.at(info.name);
 
-	THROW(!prev, ERROR_NO_PREVIOUS_RULE_APPEND, info.ctx);
-	THROW(!info.has_any_value(),
+	THROW(!prev,
+	       "Rule has 'append' key but no rule by that name already exists",
+	       info.ctx);
+	THROW(info.cond.empty() && info.exceptions.empty(),
 	       "Appended rule must have exceptions or condition property",
-	       // "Appended rule must have at least one field that can be appended to", // TODO replace with this and update testing
 	       info.ctx);
 
 	// note: source can be nullptr in case we've collected a
@@ -258,136 +256,43 @@ void rule_loader::collector::append(configuration& cfg, rule_update_info& info)
 	    	info.ctx);
 	}
 
-	if (info.cond.has_value() && !info.cond->empty())
+	if (!info.cond.empty())
 	{
 		prev->cond += " ";
-		prev->cond += *info.cond;
+		prev->cond += info.cond;
 	}
 
-	if (info.output.has_value() && !info.output->empty())
+	for (auto &ex : info.exceptions)
 	{
-		prev->output += " ";
-		prev->output += *info.output;
-	}
-
-	if (info.desc.has_value() && !info.desc->empty())
-	{
-		prev->desc += " ";
-		prev->desc += *info.desc;
-	}
-
-	if (info.tags.has_value())
-	{
-		for (auto &tag: *info.tags)
+		auto prev_ex = find_if(prev->exceptions.begin(), prev->exceptions.end(),
+			[&ex](const rule_loader::rule_exception_info& i)
+				{ return i.name == ex.name; });
+		if (prev_ex == prev->exceptions.end())
 		{
-			prev->tags.insert(tag);
+			THROW(!ex.fields.is_valid(),
+			       "Rule exception must have fields property with a list of fields",
+			       ex.ctx);
+			THROW(ex.values.empty(),
+			       "Rule exception must have values property with a list of values",
+			       ex.ctx);
+			validate_exception_info(source, ex);
+			prev->exceptions.push_back(ex);
+		}
+		else
+		{
+			THROW(ex.fields.is_valid(),
+			       "Can not append exception fields to existing exception, only values",
+			       ex.ctx);
+			THROW(ex.comps.is_valid(),
+			       "Can not append exception comps to existing exception, only values",
+			       ex.ctx);
+			prev_ex->values.insert(
+				prev_ex->values.end(), ex.values.begin(), ex.values.end());
 		}
 	}
-
-	if (info.exceptions.has_value())
-	{
-		for (auto &ex : *info.exceptions)
-		{
-			auto prev_ex = find_if(prev->exceptions.begin(), prev->exceptions.end(),
-				[&ex](const rule_loader::rule_exception_info& i)
-					{ return i.name == ex.name; });
-			if (prev_ex == prev->exceptions.end())
-			{
-				THROW(!ex.fields.is_valid(),
-					"Rule exception must have fields property with a list of fields",
-					ex.ctx);
-				THROW(ex.values.empty(),
-					"Rule exception must have values property with a list of values",
-					ex.ctx);
-				validate_exception_info(source, ex);
-				prev->exceptions.push_back(ex);
-			}
-			else
-			{
-				THROW(ex.fields.is_valid(),
-					"Can not append exception fields to existing exception, only values",
-					ex.ctx);
-				THROW(ex.comps.is_valid(),
-					"Can not append exception comps to existing exception, only values",
-					ex.ctx);
-				prev_ex->values.insert(
-					prev_ex->values.end(), ex.values.begin(), ex.values.end());
-			}
-		}
-	}
-
 	append_info(prev, info, m_cur_index++);
 }
 
-void rule_loader::collector::selective_replace(configuration& cfg, rule_update_info& info)
-{
-	auto prev = m_rule_infos.at(info.name);
-
-	THROW(!prev, ERROR_NO_PREVIOUS_RULE_REPLACE, info.ctx);
-	THROW(!info.has_any_value(),
-	       "The rule must have at least one field that can be replaced",
-	       info.ctx);
-
-	// note: source can be nullptr in case we've collected a
-	// rule for which the source is unknown
-	falco_source* source = nullptr;
-	if (!prev->unknown_source)
-	{
-		// note: if the source is not unknown, this should not return nullptr
-		source = cfg.sources.at(prev->source);
-		THROW(!source,
-	    	std::string("Unknown source ") + prev->source,
-	    	info.ctx);
-	}
-
-	if (info.cond.has_value())
-	{
-		prev->cond = *info.cond;
-	}
-
-	if (info.output.has_value())
-	{
-		prev->output = *info.output;
-	}
-
-	if (info.desc.has_value())
-	{
-		prev->desc = *info.desc;
-	}
-
-	if (info.tags.has_value())
-	{
-		prev->tags = *info.tags;
-	}
-
-	if (info.exceptions.has_value())
-	{
-		prev->exceptions = *info.exceptions;
-	}
-
-	if (info.priority.has_value())
-	{
-		prev->priority = *info.priority;
-	}
-
-	if (info.enabled.has_value())
-	{
-		prev->enabled = *info.enabled;
-	}
-
-	if (info.warn_evttypes.has_value())
-	{
-		prev->warn_evttypes = *info.warn_evttypes;
-	}
-
-	if (info.skip_if_unknown_filter.has_value())
-	{
-		prev->skip_if_unknown_filter = *info.skip_if_unknown_filter;
-	}
-
-	replace_info(prev, info, m_cur_index++);
-}
-
 void rule_loader::collector::enable(configuration& cfg, rule_info& info)
 {
 	auto prev = m_rule_infos.at(info.name);

userspace/engine/rule_loader_collector.h

@@ -85,18 +85,13 @@ public:
 	*/
 	virtual void append(configuration& cfg, list_info& info);
 	virtual void append(configuration& cfg, macro_info& info);
-	virtual void append(configuration& cfg, rule_update_info& info);
+	virtual void append(configuration& cfg, rule_info& info);
 
 	/*!
 		\brief Updates the 'enabled' flag of an existing definition
 	*/
 	virtual void enable(configuration& cfg, rule_info& info);
 
-	/*!
-		\brief Selectively replaces some fields of an existing definition
-	*/
-	virtual void selective_replace(configuration& cfg, rule_update_info& info);
-
 private:
 	uint32_t m_cur_index;
 	indexed_vector<rule_info> m_rule_infos;

userspace/engine/rule_loader_compiler.cpp

@@ -181,7 +181,6 @@ static bool resolve_list(std::string& cnd, const falco_list& list)
 {
 	static std::string blanks = " \t\n\r";
 	static std::string delims = blanks + "(),=";
-	std::string tmp;
 	std::string new_cnd;
 	size_t start, end;
 	bool used = false;
@@ -213,9 +212,7 @@ static bool resolve_list(std::string& cnd, const falco_list& list)
 				{
 					sub += ", ";
 				}
-				tmp = v;
-				quote_item(tmp);
-				sub += tmp;
+				sub += v;
 			}
 			// if substituted list is empty, we need to
 			// remove a comma from the left or the right
@@ -342,6 +339,7 @@ void rule_loader::compiler::compile_list_infos(
 		const collector& col,
 		indexed_vector<falco_list>& out) const
 {
+	std::string tmp;
 	std::list<std::string> used;
 	falco_list v;
 	for (const auto &list : col.lists())
@@ -354,14 +352,17 @@ void rule_loader::compiler::compile_list_infos(
 			if (ref && ref->index < list.visibility)
 			{
 				used.push_back(ref->name);
-				for (const auto &val : ref->items)
+				for (auto val : ref->items)
 				{
+					quote_item(val);
 					v.items.push_back(val);
 				}
 			}
 			else
 			{
-				v.items.push_back(item);
+				tmp = item;
+				quote_item(tmp);
+				v.items.push_back(tmp);
 			}
 		}
 		v.used = false;

userspace/engine/rule_loader_reader.cpp

@@ -17,12 +17,10 @@ limitations under the License.
 
 #include <string>
 #include <vector>
-#include <set>
-#include <sstream>
 
 #include "rule_loader_reader.h"
 #include "falco_engine_version.h"
-#include "rule_loading_messages.h"
+#include "logger.h"
 
 #define THROW(cond, err, ctx)    { if ((cond)) { throw rule_loader::rule_load_exception(falco::load_result::LOAD_ERR_YAML_VALIDATE, (err), (ctx)); } }
 
@@ -47,14 +45,6 @@ static void decode_val_generic(const YAML::Node& item, const char *key, T& out,
 	THROW(!YAML::convert<T>::decode(val, out), "Can't decode YAML scalar value", valctx);
 }
 
-template <typename T>
-static void decode_val_generic(const YAML::Node& item, const char *key, std::optional<T>& out, const rule_loader::context& ctx, bool optional)
-{
-	T decoded;
-	decode_val_generic(item, key, decoded, ctx, optional);
-	out = decoded;
-}
-
 template <typename T>
 static void decode_val(const YAML::Node& item, const char *key, T& out, const rule_loader::context& ctx)
 {
@@ -125,73 +115,6 @@ static void decode_tags(const YAML::Node& item, std::set<T>& out,
 	decode_seq(item, "tags", inserter, ctx, optional);
 }
 
-template <typename T>
-static void decode_tags(const YAML::Node& item, std::optional<std::set<T>>& out,
-		       const rule_loader::context& ctx)
-{
-	std::set<T> decoded;
-	decode_tags(item, decoded, ctx);
-	out = decoded;
-}
-
-static void decode_overrides(const YAML::Node& item,
-				std::set<std::string>& overridable_append,
-				std::set<std::string>& overridable_replace,
-				std::set<std::string>& out_append,
-				std::set<std::string>& out_replace,
-				const rule_loader::context& ctx)
-{
-	const YAML::Node& val = item["override"];
-
-	if(!val.IsDefined())
-	{
-		return;
-	}
-
-	rule_loader::context overridectx(item, rule_loader::context::OVERRIDE, "", ctx);
-
-	for(YAML::const_iterator it=val.begin();it!=val.end();++it)
-	{
-		std::string key = it->first.as<std::string>();
-		std::string operation = it->second.as<std::string>();
-
-		bool is_overridable_append = overridable_append.find(it->first.as<std::string>()) != overridable_append.end();
-		bool is_overridable_replace = overridable_replace.find(it->first.as<std::string>()) != overridable_replace.end();
-
-		if (operation == "append")
-		{
-			rule_loader::context keyctx(it->first, rule_loader::context::OVERRIDE, key, overridectx);
-			THROW(!is_overridable_append, std::string("Key '") + key + std::string("' cannot be appended to, use 'replace' instead"), keyctx);
-
-			out_append.insert(key);
-		}
-		else if (operation == "replace")
-		{
-			rule_loader::context keyctx(it->first, rule_loader::context::OVERRIDE, key, overridectx);
-			THROW(!is_overridable_replace, std::string("Key '") + key + std::string("' cannot be replaced"), keyctx);
-
-			out_replace.insert(key);
-		}
-		else
-		{
-			rule_loader::context operationctx(it->second, rule_loader::context::VALUE_FOR, key, overridectx);
-			std::stringstream err_ss;
-			err_ss << "Invalid override operation for key '" << key << "': '" << operation << "'. "
-				   << "Allowed values are: ";
-			if (is_overridable_append)
-			{
-				err_ss << "append ";
-			}
-			if (is_overridable_replace)
-			{
-				err_ss << "replace ";
-			}
-
-			THROW(true, err_ss.str(), operationctx);
-		}
-	}
-}
-
 // Don't call this directly, call decode_exception_{fields,comps,values} instead
 static void decode_exception_info_entry(
 	const YAML::Node& item,
@@ -264,7 +187,7 @@ static void decode_exception_values(
 
 static void read_rule_exceptions(
 	const YAML::Node& item,
-	std::vector<rule_loader::rule_exception_info>& exceptions,
+	rule_loader::rule_info& v,
 	const rule_loader::context& parent,
 	bool append)
 {
@@ -316,36 +239,10 @@ static void read_rule_exceptions(
 				v_ex.values.push_back(v_ex_val);
 			}
 		}
-		exceptions.push_back(v_ex);
+		v.exceptions.push_back(v_ex);
 	}
 }
 
-static void read_rule_exceptions(
-	const YAML::Node& item,
-	std::optional<std::vector<rule_loader::rule_exception_info>>& exceptions,
-	const rule_loader::context& parent,
-	bool append)
-{
-	std::vector<rule_loader::rule_exception_info> decoded;
-	read_rule_exceptions(item, decoded, parent, append);
-	exceptions = decoded;
-}
-
-inline static bool check_update_expected(std::set<std::string>& expected_keys, const std::set<std::string>& overrides, const std::string& override_type, const std::string& key, const rule_loader::context& ctx)
-{
-	if (overrides.find(key) == overrides.end())
-	{
-		return false;
-	}
-	
-	THROW(expected_keys.find(key) == expected_keys.end(),
-		std::string("An ") + override_type + " override for '" + key + "' was specified but '" + key + "' is not defined", ctx);
-
-	expected_keys.erase(key);
-
-	return true;
-}
-
 static void read_item(
 	rule_loader::configuration& cfg,
 	rule_loader::collector& collector,
@@ -440,21 +337,6 @@ static void read_item(
 		decode_items(item, v.items, ctx);
 
 		decode_optional_val(item, "append", append, ctx);
-		if(append)
-		{
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
-		}
-
-		std::set<std::string> override_append, override_replace;
-		std::set<std::string> overridable {"items"};
-		decode_overrides(item, overridable, overridable, override_append, override_replace, ctx);
-		bool has_overrides = !override_append.empty() || !override_replace.empty();
-
-		THROW(append && has_overrides, ERROR_OVERRIDE_APPEND, ctx);
-
-		// Since a list only has items, if we have chosen to append them we can append the entire object
-		// otherwise we just want to redefine the list.
-		append |= override_append.find("items") != override_append.end();
 
 		if(append)
 		{
@@ -483,21 +365,6 @@ static void read_item(
 		v.cond_ctx = rule_loader::context(item["condition"], rule_loader::context::MACRO_CONDITION, "", ctx);
 
 		decode_optional_val(item, "append", append, ctx);
-		if(append)
-		{
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
-		}
-
-		std::set<std::string> override_append, override_replace;
-		std::set<std::string> overridable {"condition"};
-		decode_overrides(item, overridable, overridable, override_append, override_replace, ctx);
-		bool has_overrides = !override_append.empty() || !override_replace.empty();
-
-		THROW((append && has_overrides), ERROR_OVERRIDE_APPEND, ctx);
-
-		// Since a macro only has a condition, if we have chosen to append to it we can append the entire object
-		// otherwise we just want to redefine the macro.
-		append |= override_append.find("condition") != override_append.end();
 
 		if(append)
 		{
@@ -517,172 +384,28 @@ static void read_item(
 		decode_val(item, "rule", name, tmp);
 
 		rule_loader::context ctx(item, rule_loader::context::RULE, name, parent);
+		rule_loader::rule_info v(ctx);
+		v.name = name;
 
-		bool has_append_flag = false;
-		decode_optional_val(item, "append", has_append_flag, ctx);
-		if(has_append_flag)
+		bool append = false;
+		v.enabled = true;
+		v.warn_evttypes = true;
+		v.skip_if_unknown_filter = false;
+
+		decode_optional_val(item, "append", append, ctx);
+
+		if(append)
 		{
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
-		}
-
-		std::set<std::string> override_append, override_replace;
-		std::set<std::string> overridable_append {"condition", "output", "desc", "tags", "exceptions"};
-		std::set<std::string> overridable_replace {
-			"condition", "output", "desc", "priority", "tags", "exceptions", "enabled", "warn_evttypes", "skip-if-unknown-filter"};
-		decode_overrides(item, overridable_append, overridable_replace, override_append, override_replace, ctx);
-		bool has_overrides_append = !override_append.empty();
-		bool has_overrides_replace = !override_replace.empty();
-		bool has_overrides = has_overrides_append || has_overrides_replace;
-
-		THROW((has_append_flag && has_overrides), ERROR_OVERRIDE_APPEND, ctx);
-
-		if(has_overrides)
-		{
-			std::set<std::string> expected_keys;
-			for (auto& key : overridable_append)
-			{
-				if (item[key].IsDefined())
-				{
-					expected_keys.insert(key);
-				}
-			}
-
-			for (auto& key : overridable_replace)
-			{
-				if (item[key].IsDefined())
-				{
-					expected_keys.insert(key);
-				}
-			}
-
-			// expected_keys is (appendable U replaceable) ^ (defined)
-			
-			if (has_overrides_append)
-			{
-				rule_loader::rule_update_info v(ctx);
-				v.name = name;
-				if (check_update_expected(expected_keys, override_append, "append", "condition", ctx))
-				{
-					decode_val(item, "condition", v.cond, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_append, "append", "exceptions", ctx))
-				{
-					read_rule_exceptions(item, v.exceptions, ctx, true);
-				}
-
-				if (check_update_expected(expected_keys, override_append, "append", "output", ctx))
-				{
-					decode_val(item, "output", v.output, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_append, "append", "desc", ctx))
-				{
-					decode_val(item, "desc", v.desc, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_append, "append", "tags", ctx))
-				{
-					decode_tags(item, v.tags, ctx);
-				}
-				
-				collector.append(cfg, v);
-			}
-
-			if (has_overrides_replace)
-			{
-				rule_loader::rule_update_info v(ctx);
-				v.name = name;
-				if (check_update_expected(expected_keys, override_replace, "replace", "condition", ctx))
-				{
-					decode_val(item, "condition", v.cond, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "exceptions", ctx))
-				{
-					read_rule_exceptions(item, v.exceptions, ctx, true);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "output", ctx))
-				{
-					decode_val(item, "output", v.output, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "desc", ctx))
-				{
-					decode_val(item, "desc", v.desc, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "tags", ctx))
-				{
-					decode_tags(item, v.tags, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "priority", ctx))
-				{
-					std::string priority;
-					decode_val(item, "priority", priority, ctx);
-					rule_loader::context prictx(item["priority"], rule_loader::context::RULE_PRIORITY, "", ctx);
-					falco_common::priority_type parsed_priority;
-					THROW(!falco_common::parse_priority(priority, parsed_priority), "Invalid priority", prictx);
-					v.priority = parsed_priority;
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "enabled", ctx))
-				{
-					decode_val(item, "enabled", v.enabled, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "warn_evttypes", ctx))
-				{
-					decode_val(item, "warn_evttypes", v.warn_evttypes, ctx);
-				}
-
-				if (check_update_expected(expected_keys, override_replace, "replace", "skip-if-unknown-filter", ctx))
-				{
-					decode_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
-				}
-
-				collector.selective_replace(cfg, v);
-			}
-
-			// if any expected key has not been defined throw an error
-			for (auto &key : expected_keys) {
-				rule_loader::context keyctx(item[key], rule_loader::context::OVERRIDE, key, ctx);
-				THROW(true, "Unexpected key '" + key + "': no corresponding entry under 'override' is defined.", keyctx);
-			}
-		}
-		else if(has_append_flag)
-		{
-			rule_loader::rule_update_info v(ctx);
-			v.name = name;
-
+			decode_optional_val(item, "condition", v.cond, ctx);
 			if(item["condition"].IsDefined())
 			{
 				v.cond_ctx = rule_loader::context(item["condition"], rule_loader::context::RULE_CONDITION, "", ctx);
-				decode_val(item, "condition", v.cond, ctx);
 			}
-
-			if(item["exceptions"].IsDefined())
-			{
-				read_rule_exceptions(item, v.exceptions, ctx, true);
-			}
-
-			// TODO restore this error and update testing
-			//THROW((!v.cond.has_value() && !v.exceptions.has_value()),
-			//       "Appended rule must have exceptions or condition property",
-			//       v.ctx);
-
+			read_rule_exceptions(item, v, ctx, append);
 			collector.append(cfg, v);
 		}
 		else
 		{
-			rule_loader::rule_info v(ctx);
-			v.name = name;
-			v.enabled = true;
-			v.warn_evttypes = true;
-			v.skip_if_unknown_filter = false;
-
 			// If the rule does *not* have any of
 			// condition/output/desc/priority, it *must*
 			// have an enabled property. Use the enabled
@@ -694,7 +417,6 @@ static void read_item(
 			    !item["priority"].IsDefined())
 			{
 				decode_val(item, "enabled", v.enabled, ctx);
-				cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_ENABLED, ctx);
 				collector.enable(cfg, v);
 			}
 			else
@@ -721,7 +443,7 @@ static void read_item(
 				decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx);
 				decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
 				decode_tags(item, v.tags, ctx);
-				read_rule_exceptions(item, v.exceptions, ctx, has_append_flag);
+				read_rule_exceptions(item, v, ctx, append);
 				collector.define(cfg, v);
 			}
 		}

userspace/engine/rule_loading_messages.h

@@ -1,23 +0,0 @@
-#pragma once
-
-////////////////
-// Warnings
-////////////////
-
-#define WARNING_APPEND "'append' key is deprecated. Add an 'append' entry (e.g. 'condition: append') under 'override' instead."
-
-#define WARNING_ENABLED "The standalone 'enabled' key usage is deprecated. The correct approach requires also a 'replace' entry under the 'override' key (i.e. 'enabled: replace')."
-
-////////////////
-// Errors
-////////////////
-
-#define ERROR_OVERRIDE_APPEND "Keys 'override' and 'append: true' cannot be used together. Add an 'append' entry (e.g. 'condition: append') under 'override' instead."
-
-#define ERROR_NO_PREVIOUS_MACRO "Macro uses 'append' or 'override.condition: append' but no macro by that name already exists"
-
-#define ERROR_NO_PREVIOUS_LIST "List uses 'append' or 'override.items: append' but no list by that name already exists"
-
-#define ERROR_NO_PREVIOUS_RULE_APPEND "Rule uses 'append' or 'override.<key>: append' but no rule by that name already exists"
-
-#define ERROR_NO_PREVIOUS_RULE_REPLACE "An 'override.<key>: replace' to a rule was requested but no rule by that name already exists"

userspace/falco/app/actions/load_config.cpp

@@ -79,17 +79,17 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s)
 	if(s.config->m_syscall_drop_failed_exit != DEFAULT_DROP_FAILED_EXIT)
 	{
 		falco_logger::log(falco_logger::level::WARNING,
-				"DEPRECATION NOTICE: 'syscall_drop_failed_exit' config is deprecated and will be removed in Falco 0.38! Use 'engine.<driver>.drop_failed_exit' config instead\n");
+				"DEPRECATION NOTICE: 'syscall_drop_failed_exit' config is deprecated and will be removed in Falco 0.38! Use `engine.<driver>.drop_failed_exit' config instead\n");
 	}
 	if(s.config->m_syscall_buf_size_preset != DEFAULT_BUF_SIZE_PRESET)
 	{
 		falco_logger::log(falco_logger::level::WARNING,
-				"DEPRECATION NOTICE: 'syscall_buf_size_preset' config is deprecated and will be removed in Falco 0.38! Use 'engine.<driver>.buf_size_preset' config instead\n");
+				"DEPRECATION NOTICE: 'syscall_buf_size_preset' config is deprecated and will be removed in Falco 0.38! Use `engine.<driver>.buf_size_preset' config instead\n");
 	}
 	if(s.config->m_cpus_for_each_syscall_buffer != DEFAULT_CPUS_FOR_EACH_SYSCALL_BUFFER)
 	{
 		falco_logger::log(falco_logger::level::WARNING,
-				"DEPRECATION NOTICE: 'modern_bpf.cpus_for_each_syscall_buffer' config is deprecated and will be removed in Falco 0.38! Use 'engine.modern_ebpf.cpus_for_each_buffer' config instead\n");
+				"DEPRECATION NOTICE: 'modern_bpf.cpus_for_each_syscall_buffer' config is deprecated and will be removed in Falco 0.38! Use `engine.modern_ebpf.cpus_for_each_buffer' config instead\n");
 	}
 
 	// Replace the kmod default values in case the engine was open with the kmod.
@@ -102,7 +102,7 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s)
 	// use the requested driver.
 	if (getenv(FALCO_BPF_ENV_VARIABLE))
 	{
-		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the 'FALCO_BPF_PROBE' environment variable is deprecated and will be removed in Falco 0.38! Set 'engine.kind: ebpf' and use 'engine.ebpf' config instead in falco.yaml\n");
+		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the 'FALCO_BPF_PROBE' environment variable is deprecated and will be removed in Falco 0.38!\n");
 		s.config->m_engine_mode = engine_kind_t::EBPF;
 		s.config->m_ebpf.m_probe_path = getenv(FALCO_BPF_ENV_VARIABLE);
 		s.config->m_ebpf.m_drop_failed_exit = s.config->m_syscall_drop_failed_exit;
@@ -110,7 +110,7 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s)
 	}
 	else if (s.options.modern_bpf)
 	{
-		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--modern-bpf' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: modern_ebpf' and use 'engine.modern_ebpf' config instead in falco.yaml\n");
+		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--modern-bpf' command line option is deprecated and will be removed in Falco 0.38!\n");
 		s.config->m_engine_mode = engine_kind_t::MODERN_EBPF;
 		s.config->m_modern_ebpf.m_drop_failed_exit = s.config->m_syscall_drop_failed_exit;
 		s.config->m_modern_ebpf.m_buf_size_preset = s.config->m_syscall_buf_size_preset;
@@ -118,19 +118,19 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s)
 	}
 	if (!s.options.gvisor_config.empty())
 	{
-		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '-g,--gvisor-config' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: gvisor' and use 'engine.gvisor' config instead in falco.yaml\n");
+		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '-g,--gvisor-config' command line option is deprecated and will be removed in Falco 0.38!\n");
 		s.config->m_engine_mode =  engine_kind_t::GVISOR;
 		s.config->m_gvisor.m_config = s.options.gvisor_config;
 		s.config->m_gvisor.m_root = s.options.gvisor_root;
 	}
 	if (s.options.nodriver)
 	{
-		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--nodriver' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: nodriver' instead in falco.yaml\n");
-		s.config->m_engine_mode =  engine_kind_t::NODRIVER;
+		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--nodriver' command line option is deprecated and will be removed in Falco 0.38!\n");
+		s.config->m_engine_mode =  engine_kind_t::NONE;
 	}
 	if (!s.options.capture_file.empty())
 	{
-		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '-e' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: replay' and use 'engine.replay' config instead in falco.yaml\n");
+		falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '-e' command line option is deprecated and will be removed in Falco 0.38!\n");
 		s.config->m_engine_mode = engine_kind_t::REPLAY;
 		s.config->m_replay.m_capture_file = s.options.capture_file;
 	}

userspace/falco/app/actions/load_rules_files.cpp

@@ -79,9 +79,10 @@ falco::app::run_result falco::app::actions::load_rules_files(falco::app::state&
 			break;
 		}
 
-		if(res->has_warnings())
+		// If verbose is true, also print any warnings
+		if(s.options.verbose && res->has_warnings())
 		{
-			falco_logger::log(falco_logger::level::WARNING,res->as_string(true, rc) + "\n");
+			fprintf(stderr, "%s\n", res->as_string(true, rc).c_str());
 		}
 	}
 

userspace/falco/app/actions/validate_rules_files.cpp

@@ -114,7 +114,12 @@ falco::app::run_result falco::app::actions::validate_rules_files(falco::app::sta
 				// file was ok with warnings, without actually
 				// printing the warnings.
 				summary += filename + ": Ok, with warnings";
-				falco_logger::log(falco_logger::level::WARNING, res->as_string(true, rc) + "\n");
+
+				// If verbose is true, print the warnings now.
+				if(s.options.verbose)
+				{
+					fprintf(stderr, "%s\n", res->as_string(true, rc).c_str());
+				}
 			}
 		}
 

userspace/falco/app/restart_handler.cpp

@@ -60,7 +60,7 @@ bool falco::app::restart_handler::start(std::string& err)
 
     for (const auto& f : m_watched_files)
     {
-        auto wd = inotify_add_watch(m_inotify_fd, f.c_str(), IN_CLOSE_WRITE | IN_MOVE_SELF | IN_DELETE_SELF);
+        auto wd = inotify_add_watch(m_inotify_fd, f.c_str(), IN_CLOSE_WRITE);
         if (wd < 0)
         {
             err = "could not watch file: " + f;
@@ -71,7 +71,7 @@ bool falco::app::restart_handler::start(std::string& err)
 
     for (const auto &f : m_watched_dirs)
     {
-        auto wd = inotify_add_watch(m_inotify_fd, f.c_str(), IN_CREATE | IN_DELETE | IN_MOVE);
+        auto wd = inotify_add_watch(m_inotify_fd, f.c_str(), IN_CREATE | IN_DELETE);
         if (wd < 0)
         {
             err = "could not watch directory: " + f;

userspace/falco/app/state.h

@@ -168,7 +168,7 @@ struct state
 
     inline bool is_nodriver() const
     {
-        return config->m_engine_mode == engine_kind_t::NODRIVER;
+        return config->m_engine_mode == engine_kind_t::NONE;
     }
 
     inline bool is_source_enabled(const std::string& src) const

userspace/falco/configuration.cpp

@@ -109,7 +109,7 @@ void falco_configuration::load_engine_config(const std::string& config_name, con
 		{"modern_ebpf",engine_kind_t::MODERN_EBPF},
 		{"replay",engine_kind_t::REPLAY},
 		{"gvisor",engine_kind_t::GVISOR},
-		{"nodriver",engine_kind_t::NODRIVER},
+		{"none",engine_kind_t::NONE},
 	};
 
 	auto driver_mode_str = config.get_scalar<std::string>("engine.kind", "kmod");
@@ -172,7 +172,7 @@ void falco_configuration::load_engine_config(const std::string& config_name, con
 		}
 		m_gvisor.m_root = config.get_scalar<std::string>("engine.gvisor.root", "");
 		break;
-	case engine_kind_t::NODRIVER:
+	case engine_kind_t::NONE:
 	default:
 		break;
 	}
@@ -309,14 +309,6 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
 		client_key = config.get_scalar<std::string>("http_output.client_key", "/etc/ssl/certs/client.key");
 		http_output.options["client_key"] = client_key;
 
-		bool compress_uploads;
-		compress_uploads = config.get_scalar<bool>("http_output.compress_uploads", false);
-		http_output.options["compress_uploads"] = compress_uploads? std::string("true") : std::string("false");
-
-		bool keep_alive;
-		keep_alive = config.get_scalar<bool>("http_output.keep_alive", false);
-		http_output.options["keep_alive"] = keep_alive? std::string("true") : std::string("false");
-
 		m_outputs.push_back(http_output);
 	}
 

userspace/falco/configuration.h

@@ -49,7 +49,7 @@ enum class engine_kind_t : uint8_t
 	MODERN_EBPF,
 	REPLAY,
 	GVISOR,
-	NODRIVER
+	NONE
 };
 
 class falco_configuration

userspace/falco/outputs_http.cpp

@@ -97,16 +97,6 @@ bool falco::outputs::output_http::init(const config& oc, bool buffered, const st
 		CHECK_RES(curl_easy_setopt(m_curl, CURLOPT_WRITEFUNCTION, noop_write_callback));
 	}
 
-	if(m_oc.options["compress_uploads"] == std::string("true"))
-	{
-		CHECK_RES(curl_easy_setopt(m_curl, CURLOPT_TRANSFER_ENCODING, 1L));
-	}
-
-	if(m_oc.options["keep_alive"] == std::string("true"))
-	{
-		CHECK_RES(curl_easy_setopt(m_curl, CURLOPT_TCP_KEEPALIVE, 1L));
-	}
-
 	if(res != CURLE_OK)
 	{
 		err = "libcurl error: " + std::string(curl_easy_strerror(res));

userspace/falco/stats_writer.cpp

@@ -366,16 +366,9 @@ void stats_writer::collector::get_metrics_output_fields_additional(
 	sinsp_thread_manager* thread_manager = inspector->m_thread_manager;
 	const scap_stats_v2* sinsp_stats_v2_snapshot = libsinsp::stats::get_sinsp_stats_v2(flags, agent_info, thread_manager, sinsp_stats_v2, buffer, &nstats, &rc);
 
-	uint32_t base_stat = 0;
-	// todo @incertum this needs to become better with the next proper stats refactor in libs 0.15.0
-	if ((flags & PPM_SCAP_STATS_STATE_COUNTERS) && !(flags & PPM_SCAP_STATS_RESOURCE_UTILIZATION))
-	{
-		base_stat = SINSP_STATS_V2_N_THREADS;
-	}
-
 	if (sinsp_stats_v2_snapshot && rc == 0 && nstats > 0)
 	{
-		for(uint32_t stat = base_stat; stat < nstats; stat++)
+		for(uint32_t stat = 0; stat < nstats; stat++)
 		{
 			if (sinsp_stats_v2_snapshot[stat].name[0] == '\0')
 			{
@@ -383,12 +376,6 @@ void stats_writer::collector::get_metrics_output_fields_additional(
 			}
 			char metric_name[STATS_NAME_MAX] = "falco.";
 			strlcat(metric_name, sinsp_stats_v2_snapshot[stat].name, sizeof(metric_name));
-			// todo @incertum temporary fix for n_fds and n_threads, type assignment was missed in libs, will be fixed in libs 0.15.0
-			if (strncmp(sinsp_stats_v2_snapshot[stat].name, "n_fds", 6) == 0 || strncmp(sinsp_stats_v2_snapshot[stat].name, "n_threads", 10) == 0)
-			{
-				output_fields[metric_name] = sinsp_stats_v2_snapshot[stat].value.u64;
-			}
-
 			switch(sinsp_stats_v2_snapshot[stat].type)
 			{
 			case STATS_VALUE_TYPE_U64:

userspace/falco/yaml_helper.h

@@ -37,40 +37,6 @@ limitations under the License.
 #include "event_drops.h"
 #include "falco_outputs.h"
 
-class yaml_helper;
-
-class yaml_visitor {
-private:
-	using Callback = std::function<void(YAML::Node&)>;
-	yaml_visitor(Callback cb): seen(), cb(std::move(cb)) {}
-
-	void operator()(YAML::Node &cur) {
-		seen.push_back(cur);
-		if (cur.IsMap()) {
-			for (YAML::detail::iterator_value pair : cur) {
-				descend(pair.second);
-			}
-		} else if (cur.IsSequence()) {
-			for (YAML::detail::iterator_value child : cur) {
-				descend(child);
-			}
-		} else if (cur.IsScalar()) {
-			cb(cur);
-		}
-	}
-
-	void descend(YAML::Node &target) {
-		if (std::find(seen.begin(), seen.end(), target) == seen.end()) {
-			(*this)(target);
-		}
-	}
-
-	std::vector<YAML::Node> seen;
-	Callback cb;
-
-	friend class yaml_helper;
-};
-
 /**
  * @brief An helper class for reading and editing YAML documents
  */
@@ -83,7 +49,6 @@ public:
 	void load_from_string(const std::string& input)
 	{
 		m_root = YAML::Load(input);
-		pre_process_env_vars();
 	}
 
 	/**
@@ -92,7 +57,6 @@ public:
 	void load_from_file(const std::string& path)
 	{
 		m_root = YAML::LoadFile(path);
-		pre_process_env_vars();
 	}
 
 	/**
@@ -113,8 +77,44 @@ public:
 		get_node(node, key);
 		if(node.IsDefined())
 		{
-			return node.as<T>(default_value);
+			std::string value = node.as<std::string>();
+
+			// Helper function to convert string to the desired type T
+			auto convert_str_to_t = [&default_value](const std::string& str) -> T {
+				std::stringstream ss(str);
+				T result;
+				if (ss >> result) return result;
+				return default_value;
+			};
+
+			// If the value starts with `$$`, check for a subsequent `{...}`
+			if (value.size() >= 3 && value[0] == '$' && value[1] == '$')
+			{
+				// If after stripping the first `$`, the string format is like `${VAR}`, treat it as a plain string and don't resolve.
+				if (value[2] == '{' && value[value.size() - 1] == '}')
+				{
+					value = value.substr(1);
+					return convert_str_to_t(value);
+				}
+				else return convert_str_to_t(value);
+			}
+
+			// Check if the value is an environment variable reference
+			if(value.size() >= 2 && value[0] == '$' && value[1] == '{' && value[value.size() - 1] == '}')
+			{
+				// Format: ${ENV_VAR_NAME}
+				std::string env_var = value.substr(2, value.size() - 3);
+
+				const char* env_value = std::getenv(env_var.c_str()); // Get the environment variable value
+				if(env_value) return convert_str_to_t(env_value);
+
+				return default_value;
+			}
+
+			// If it's not an environment variable reference, return the value as is
+			return node.as<T>();
 		}
+
 		return default_value;
 	}
 
@@ -153,71 +153,6 @@ public:
 private:
 	YAML::Node m_root;
 
-	/*
-	 * When loading a yaml file,
-	 * we immediately pre process all scalar values through a visitor private API,
-	 * and resolve any "${env_var}" to its value;
-	 * moreover, any "$${str}" is resolved to simply "${str}".
-	 */
-	void pre_process_env_vars()
-	{
-		yaml_visitor([](YAML::Node &scalar) {
-				auto value = scalar.as<std::string>();
-				auto start_pos = value.find('$');
-				while (start_pos != std::string::npos)
-				{
-					auto substr = value.substr(start_pos);
-					// Case 1 -> ${}
-					if (substr.rfind("${", 0) == 0)
-					{
-						auto end_pos = substr.find('}');
-						if (end_pos != std::string::npos)
-						{
-							// Eat "${" and "}" when getting the env var name
-							auto env_str = substr.substr(2, end_pos - 2);
-							const char* env_value = std::getenv(env_str.c_str()); // Get the environment variable value
-							if(env_value)
-							{
-								// env variable name + "${}"
-								value.replace(start_pos, env_str.length() + 3, env_value);
-							}
-							else
-							{
-								value.erase(start_pos, env_str.length() + 3);
-							}
-						}
-						else
-						{
-							// There are no "}" chars anymore; just break leaving rest of value untouched.
-							break;
-						}
-					}
-					// Case 2 -> $${}
-					else if (substr.rfind("$${", 0) == 0)
-					{
-						auto end_pos = substr.find('}');
-						if (end_pos != std::string::npos)
-						{
-							// Consume first "$" token
-							value.erase(start_pos, 1);
-						}
-						else
-						{
-							// There are no "}" chars anymore; just break leaving rest of value untouched.
-							break;
-						}
-						start_pos++; // consume the second '$' token
-					}
-					else
-					{
-						start_pos += substr.length();
-					}
-					start_pos = value.find("$", start_pos);
-				}
-				scalar = value;
-			})(m_root);
-	}
-
 	/**
 	 * Key is a string representing a node in the YAML document.
 	 * The provided key string can navigate the document in its