build: add cmake module for spdlog

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

.circleci/config.yml

@@ -282,6 +282,8 @@ jobs:
       - run:
           name: Execute integration tests
           command: /usr/bin/entrypoint test
+      - store_test_results:
+          path: /build/release/integration-tests-xunit
   "tests/integration-static":
     docker:
       - image: falcosecurity/falco-tester:latest
@@ -297,6 +299,8 @@ jobs:
       - run:
           name: Execute integration tests
           command: /usr/bin/entrypoint test
+      - store_test_results:
+          path: /build-static/release/integration-tests-xunit
   "tests/driver-loader/integration":
     machine:
       image: ubuntu-1604:202004-01

.github/stale.yml

@@ -1,20 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 60
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - cncf
-  - roadmap
-  - "help wanted"
-# Label to use when marking an issue as stale
-staleLabel: wontfix
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-  Issues labeled "cncf", "roadmap" and "help wanted" will not be automatically closed.
-  Please refer to a maintainer to get such label added if you think this should be kept open.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change Log
 
+## v0.26.2
+
+Released on 2020-11-10
+
+### Major Changes
+
+* update: DRIVERS_REPO now defaults to https://download.falco.org/driver [[#1460](https://github.com/falcosecurity/falco/pull/1460)] - [@leodido](https://github.com/leodido)
+
 ## v0.26.1
 
 Released on 2020-10-01

CMakeLists.txt

@@ -60,7 +60,7 @@ if(MUSL_OPTIMIZED_BUILD)
   set(MUSL_FLAGS "-static -Os")
 endif()
 
-set(CMAKE_COMMON_FLAGS "-Wall -pg -ggdb ${DRAIOS_FEATURE_FLAGS} ${MINIMAL_BUILD_FLAGS} ${MUSL_FLAGS}")
+set(CMAKE_COMMON_FLAGS "-Wall -ggdb ${DRAIOS_FEATURE_FLAGS} ${MINIMAL_BUILD_FLAGS} ${MUSL_FLAGS}")
 
 if(BUILD_WARNINGS_AS_ERRORS)
   set(CMAKE_SUPPRESSED_WARNINGS
@@ -83,7 +83,7 @@ include(GetFalcoVersion)
 set(PACKAGE_NAME "falco")
 set(PROBE_NAME "falco")
 set(PROBE_DEVICE_NAME "falco")
-set(DRIVERS_REPO "https://dl.bintray.com/falcosecurity/driver")
+set(DRIVERS_REPO "https://download.falco.org/driver")
 if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
   set(CMAKE_INSTALL_PREFIX
       /usr
@@ -94,6 +94,9 @@ set(CMD_MAKE make)
 
 include(ExternalProject)
 
+# spdlog
+include(spdlog)
+
 # jq
 include(jq)
 
@@ -115,20 +118,8 @@ set(CURSES_NEED_NCURSES TRUE)
 find_package(Curses REQUIRED)
 message(STATUS "Found ncurses: include: ${CURSES_INCLUDE_DIR}, lib: ${CURSES_LIBRARIES}")
 
-# libb64
+# b64
-
+include(b64)
-set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
-message(STATUS "Using bundled b64 in '${B64_SRC}'")
-set(B64_INCLUDE "${B64_SRC}/include")
-set(B64_LIB "${B64_SRC}/src/libb64.a")
-ExternalProject_Add(
-  b64
-  URL "https://github.com/libb64/libb64/archive/ce864b17ea0e24a91e77c7dd3eb2d1ac4175b3f0.tar.gz"
-  URL_HASH "SHA256=d07173e66f435e5c77dbf81bd9313f8d0e4a3b4edd4105a62f4f8132ba932811"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  INSTALL_COMMAND "")
 
 # yaml-cpp
 include(yaml-cpp)
@@ -142,52 +133,16 @@ if(NOT MINIMAL_BUILD)
 endif()
 
 # LuaJIT
-set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
+include(luajit)
-message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
-set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
-set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
-ExternalProject_Add(
-  luajit
-  URL "https://github.com/LuaJIT/LuaJIT/archive/v2.0.3.tar.gz"
-  URL_HASH "SHA256=8da3d984495a11ba1bce9a833ba60e18b532ca0641e7d90d97fafe85ff014baa"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  INSTALL_COMMAND "")
 
 # Lpeg
-set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
+include(lpeg)
-set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
-message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
-set(LPEG_DEPENDENCIES "")
-list(APPEND LPEG_DEPENDENCIES "luajit")
-ExternalProject_Add(
-  lpeg
-  DEPENDS ${LPEG_DEPENDENCIES}
-  URL "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz"
-  URL_HASH "SHA256=48d66576051b6c78388faad09b70493093264588fcd0f258ddaab1cdd4a15ffe"
-  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
-  BUILD_IN_SOURCE 1
-  CONFIGURE_COMMAND ""
-  INSTALL_COMMAND "")
 
 # libyaml
 include(libyaml)
 
 # lyaml
-set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
+include(lyaml)
-set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
-message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
-ExternalProject_Add(
-  lyaml
-  DEPENDS luajit libyaml
-  URL "https://github.com/gvvaughan/lyaml/archive/release-v6.0.tar.gz"
-  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  CONFIGURE_COMMAND ./configure --enable-static CFLAGS=-I${LIBYAML_INSTALL_DIR}/include CPPFLAGS=-I${LIBYAML_INSTALL_DIR}/include LDFLAGS=-L${LIBYAML_INSTALL_DIR}/lib LIBS=-lyaml LUA=${LUAJIT_SRC}/luajit LUA_INCLUDE=-I${LUAJIT_INCLUDE}
-  INSTALL_COMMAND sh -c
-                  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua")
 
 # One TBB
 set(TBB_SRC "${PROJECT_BINARY_DIR}/tbb-prefix/src/tbb")
@@ -220,6 +175,7 @@ if(NOT MINIMAL_BUILD)
     COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/include
     BUILD_IN_SOURCE 1
     BUILD_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" WITH_CPP=1
+    BUILD_BYPRODUCTS ${CIVETWEB_LIB}
     INSTALL_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" install-lib install-headers PREFIX=${CIVETWEB_SRC}/install "WITH_CPP=1")
 endif()
 

README.md

@@ -5,7 +5,9 @@
 
 [![Build Status](https://img.shields.io/circleci/build/github/falcosecurity/falco/master?style=for-the-badge)](https://circleci.com/gh/falcosecurity/falco) [![CII Best Practices Summary](https://img.shields.io/cii/summary/2317?label=CCI%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317) [![GitHub](https://img.shields.io/github/license/falcosecurity/falco?style=for-the-badge)](COPYING)
 
-#### Latest releases
+Want to talk? Join us on the [#falco](https://kubernetes.slack.com/archives/CMWH3EH32) channel in the [Kubernetes Slack](https://slack.k8s.io).
+
+### Latest releases
 
 Read the [change log](CHANGELOG.md).
 
@@ -39,7 +41,7 @@ If you would like to run Falco in **production** please adhere to the [official
 
 Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.
 
-Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/update-readme/userspace/falco/outputs.proto).
+Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/master/userspace/falco/outputs.proto).
 The Falco Project supports various SDKs for this endpoint.
 
 ##### SDKs
@@ -63,6 +65,7 @@ For example, Falco can easily detect incidents including but not limited to:
 - Unexpected read of a sensitive file, such as `/etc/shadow`.
 - A non-device file is written to `/dev`.
 - A standard system binary, such as `ls`, is making an outbound network connection.
+- A privileged pod is started in a Kubernetes cluster.
 
 ### Documentation
 
@@ -72,6 +75,13 @@ The [Official Documentation](https://falco.org/docs/) is the best resource to le
 
 To get involved with The Falco Project please visit [the community repository](https://github.com/falcosecurity/community) to find more.
 
+How to reach out?
+
+ - Join the #falco channel on the [Kubernetes Slack](https://slack.k8s.io)
+ - [Join the Falco mailing list](https://lists.cncf.io/g/cncf-falco-dev)
+ - [Read the Falco documentation](https://falco.org/docs/)
+
+
 ### Contributing
 
 See the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md).

cmake/modules/CPackConfig.cmake

@@ -30,9 +30,15 @@ if(NOT CPACK_GENERATOR)
 endif()
 
 message(STATUS "Using package generators: ${CPACK_GENERATOR}")
-
+message(STATUS "Package architecture: ${CMAKE_SYSTEM_PROCESSOR}")
 set(CPACK_DEBIAN_PACKAGE_SECTION "utils")
-set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
+
+if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
+endif()
+if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "aarch64")
+  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "arm64")
+endif()
 set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "https://www.falco.org")
 set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0)")
 set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA

cmake/modules/b64.cmake

@@ -0,0 +1,27 @@
+#
+# Copyright (C) 2020 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
+message(STATUS "Using bundled b64 in '${B64_SRC}'")
+set(B64_INCLUDE "${B64_SRC}/include")
+set(B64_LIB "${B64_SRC}/src/libb64.a")
+externalproject_add(
+  b64
+  URL "https://github.com/libb64/libb64/archive/ce864b17ea0e24a91e77c7dd3eb2d1ac4175b3f0.tar.gz"
+  URL_HASH "SHA256=d07173e66f435e5c77dbf81bd9313f8d0e4a3b4edd4105a62f4f8132ba932811"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  BUILD_BYPRODUCTS ${B64_LIB}
+  INSTALL_COMMAND ""
+)

cmake/modules/gRPC.cmake

@@ -115,7 +115,7 @@ else()
     grpc
     DEPENDS openssl
     GIT_REPOSITORY https://github.com/grpc/grpc.git
-    GIT_TAG v1.31.1
+    GIT_TAG v1.32.0
     GIT_SUBMODULES "third_party/protobuf third_party/zlib third_party/cares/cares third_party/abseil-cpp third_party/re2"
     BUILD_IN_SOURCE 1
     BUILD_BYPRODUCTS ${GRPC_LIB} ${GRPCPP_LIB}

cmake/modules/libyaml.cmake

@@ -15,12 +15,13 @@ set(LIBYAML_SRC "${PROJECT_BINARY_DIR}/libyaml-prefix/src/libyaml")
 set(LIBYAML_INSTALL_DIR "${LIBYAML_SRC}/target")
 message(STATUS "Using bundled libyaml in '${LIBYAML_SRC}'")
 set(LIBYAML_LIB "${LIBYAML_SRC}/src/.libs/libyaml.a")
-ExternalProject_Add(
+externalproject_add(
-libyaml
+  libyaml
-URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
+  URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
-URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
+  URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
-CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
+  CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
-BUILD_COMMAND ${CMD_MAKE} 
+  BUILD_COMMAND ${CMD_MAKE}
-BUILD_IN_SOURCE 1
+  BUILD_IN_SOURCE 1
-INSTALL_COMMAND ${CMD_MAKE} install)
+  BUILD_BYPRODUCTS ${LIBYAML_LIB}
-
+  INSTALL_COMMAND ${CMD_MAKE} install
+)

cmake/modules/lpeg.cmake

@@ -0,0 +1,28 @@
+#
+# Copyright (C) 2020 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
+set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
+message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
+set(LPEG_DEPENDENCIES "")
+list(APPEND LPEG_DEPENDENCIES "luajit")
+ExternalProject_Add(
+  lpeg
+  DEPENDS ${LPEG_DEPENDENCIES}
+  URL "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz"
+  URL_HASH "SHA256=48d66576051b6c78388faad09b70493093264588fcd0f258ddaab1cdd4a15ffe"
+  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
+  BUILD_IN_SOURCE 1
+  BUILD_BYPRODUCTS ${LPEG_LIB}
+  CONFIGURE_COMMAND ""
+  INSTALL_COMMAND "")

cmake/modules/luajit.cmake

@@ -0,0 +1,27 @@
+#
+# Copyright (C) 2020 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
+message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
+set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
+set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
+externalproject_add(
+  luajit
+  GIT_REPOSITORY "https://github.com/LuaJIT/LuaJIT"
+  GIT_TAG "1d8b747c161db457e032a023ebbff511f5de5ec2"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  BUILD_BYPRODUCTS ${LUAJIT_LIB}
+  INSTALL_COMMAND ""
+)

cmake/modules/lyaml.cmake

@@ -0,0 +1,28 @@
+#
+# Copyright (C) 2020 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
+set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
+message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
+externalproject_add(
+  lyaml
+  DEPENDS luajit libyaml
+  URL "https://github.com/gvvaughan/lyaml/archive/release-v6.0.tar.gz"
+  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  BUILD_BYPRODUCTS ${LYAML_LIB}
+  CONFIGURE_COMMAND ./configure --enable-static CFLAGS=-I${LIBYAML_INSTALL_DIR}/include CPPFLAGS=-I${LIBYAML_INSTALL_DIR}/include LDFLAGS=-L${LIBYAML_INSTALL_DIR}/lib LIBS=-lyaml LUA=${LUAJIT_SRC}/luajit LUA_INCLUDE=-I${LUAJIT_INCLUDE}
+  INSTALL_COMMAND sh -c
+  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua"
+)

cmake/modules/spdlog.cmake

@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2020 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+
+
+set(SPDLOG_PREFIX "${PROJECT_BINARY_DIR}/spdlog-prefix")
+set(SPDLOG_INCLUDE_DIR "${SPDLOG_PREFIX}/src/spdlog/include")
+message(STATUS "Using bundled spdlog in '${SPDLOG_INCLUDE_DIR}'")
+
+ExternalProject_Add(
+  spdlog
+  URL "https://github.com/gabime/spdlog/archive/v1.8.1.tar.gz"
+  URL_HASH "SHA256=5197b3147cfcfaa67dd564db7b878e4a4b3d9f3443801722b3915cdeced656cb"
+  BUILD_COMMAND ""
+  INSTALL_COMMAND ""
+)

cmake/modules/sysdig-repo/CMakeLists.txt

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2019 The Falco Authors.
+# Copyright (C) 2020 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -25,4 +25,4 @@ ExternalProject_Add(
   BUILD_COMMAND ""
   INSTALL_COMMAND ""
   TEST_COMMAND ""
-  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch)
+  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch && patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/luajit.patch)

cmake/modules/sysdig-repo/patch/libscap.patch

@@ -1,8 +1,8 @@
 diff --git a/userspace/libscap/scap.c b/userspace/libscap/scap.c
-index e9faea51..a1b3b501 100644
+index 6f51588e..5f9ea84e 100644
 --- a/userspace/libscap/scap.c
 +++ b/userspace/libscap/scap.c
-@@ -52,7 +52,7 @@ limitations under the License.
+@@ -55,7 +55,7 @@ limitations under the License.
  //#define NDEBUG
  #include <assert.h>
  
@@ -11,7 +11,16 @@ index e9faea51..a1b3b501 100644
  
  //
  // Probe version string size
-@@ -171,7 +171,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
+@@ -114,7 +114,7 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
+ static uint32_t get_max_consumers()
+ {
+ 	uint32_t max;
+-	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers", "r");
++	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers", "r");
+ 	if(pfile != NULL)
+ 	{
+ 		int w = fscanf(pfile, "%"PRIu32, &max);
+@@ -186,7 +186,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
  				return NULL;
  			}
  
@@ -20,7 +29,27 @@ index e9faea51..a1b3b501 100644
  			bpf_probe = buf;
  		}
  	}
-@@ -1808,7 +1808,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
+@@ -344,7 +344,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
+ 				else if(errno == EBUSY)
+ 				{
+ 					uint32_t curr_max_consumers = get_max_consumers();
+-					snprintf(error, SCAP_LASTERR_SIZE, "Too many sysdig instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
++					snprintf(error, SCAP_LASTERR_SIZE, "Too many Falco instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
+ 				}
+ 				else
+ 				{
+@@ -579,8 +579,8 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
+ 	//
+ 	// Map the ppm_ring_buffer_info that contains the buffer pointers
+ 	//
+-	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd), 
+-		&handle->m_devs[0].m_bufinfo, 
++	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd),
++		&handle->m_devs[0].m_bufinfo,
+ 		&handle->m_devs[0].m_bufstatus,
+ 		error) != SCAP_SUCCESS)
+ 	{
+@@ -2175,7 +2175,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
  
  const char* scap_get_host_root()
  {

cmake/modules/sysdig-repo/patch/luajit.patch

@@ -0,0 +1,57 @@
+diff --git a/userspace/libsinsp/chisel.cpp b/userspace/libsinsp/chisel.cpp
+index 0a6e3cf8..0c2e255a 100644
+--- a/userspace/libsinsp/chisel.cpp
++++ b/userspace/libsinsp/chisel.cpp
+@@ -98,7 +98,7 @@ void lua_stackdump(lua_State *L)
+ // Lua callbacks
+ ///////////////////////////////////////////////////////////////////////////////
+ #ifdef HAS_LUA_CHISELS
+-const static struct luaL_reg ll_sysdig [] =
++const static struct luaL_Reg ll_sysdig [] =
+ {
+ 	{"set_filter", &lua_cbacks::set_global_filter},
+ 	{"set_snaplen", &lua_cbacks::set_snaplen},
+@@ -134,7 +134,7 @@ const static struct luaL_reg ll_sysdig [] =
+ 	{NULL,NULL}
+ };
+ 
+-const static struct luaL_reg ll_chisel [] =
++const static struct luaL_Reg ll_chisel [] =
+ {
+ 	{"request_field", &lua_cbacks::request_field},
+ 	{"set_filter", &lua_cbacks::set_filter},
+@@ -146,7 +146,7 @@ const static struct luaL_reg ll_chisel [] =
+ 	{NULL,NULL}
+ };
+ 
+-const static struct luaL_reg ll_evt [] =
++const static struct luaL_Reg ll_evt [] =
+ {
+ 	{"field", &lua_cbacks::field},
+ 	{"get_num", &lua_cbacks::get_num},
+diff --git a/userspace/libsinsp/lua_parser.cpp b/userspace/libsinsp/lua_parser.cpp
+index 0e26617d..78810d96 100644
+--- a/userspace/libsinsp/lua_parser.cpp
++++ b/userspace/libsinsp/lua_parser.cpp
+@@ -32,7 +32,7 @@ extern "C" {
+ #include "lauxlib.h"
+ }
+ 
+-const static struct luaL_reg ll_filter [] =
++const static struct luaL_Reg ll_filter [] =
+ {
+ 	{"rel_expr", &lua_parser_cbacks::rel_expr},
+ 	{"bool_op", &lua_parser_cbacks::bool_op},
+diff --git a/userspace/libsinsp/lua_parser_api.cpp b/userspace/libsinsp/lua_parser_api.cpp
+index c89e9126..c3d8008a 100644
+--- a/userspace/libsinsp/lua_parser_api.cpp
++++ b/userspace/libsinsp/lua_parser_api.cpp
+@@ -266,7 +266,7 @@ int lua_parser_cbacks::rel_expr(lua_State *ls)
+ 					string err = "Got non-table as in-expression operand\n";
+ 					throw sinsp_exception("parser API error");
+ 				}
+-				int n = luaL_getn(ls, 4);  /* get size of table */
++				int n = lua_objlen (ls, 4);  /* get size of table */
+ 				for (i=1; i<=n; i++)
+ 				{
+ 					lua_rawgeti(ls, 4, i);

cmake/modules/sysdig.cmake

@@ -29,8 +29,8 @@ file(MAKE_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
 # default below In case you want to test against another sysdig version just pass the variable - ie., `cmake
 # -DSYSDIG_VERSION=dev ..`
 if(NOT SYSDIG_VERSION)
-  set(SYSDIG_VERSION "2aa88dcf6243982697811df4c1b484bcbe9488a2")
+  set(SYSDIG_VERSION "5c0b863ddade7a45568c0ac97d037422c9efb750")
-  set(SYSDIG_CHECKSUM "SHA256=a737077543a6f3473ab306b424bcf7385d788149829ed1538252661b0f20d0f6")
+  set(SYSDIG_CHECKSUM "SHA256=9de717b3a4b611ea6df56afee05171860167112f74bb7717b394bcc88ac843cd")
 endif()
 set(PROBE_VERSION "${SYSDIG_VERSION}")
 
@@ -57,6 +57,7 @@ add_subdirectory("${SYSDIG_SOURCE_DIR}/driver" "${PROJECT_BINARY_DIR}/driver")
 # Add libscap directory
 add_definitions(-D_GNU_SOURCE)
 add_definitions(-DHAS_CAPTURE)
+add_definitions(-DNOCURSESUI)
 if(MUSL_OPTIMIZED_BUILD)
   add_definitions(-DMUSL_OPTIMIZED)
 endif()

docker/driver-loader/Dockerfile

@@ -3,7 +3,7 @@ FROM falcosecurity/falco:${FALCO_IMAGE_TAG}
 
 LABEL maintainer="cncf-falco-dev@lists.cncf.io"
 
-LABEL usage="docker run -i -t -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
+LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --name NAME IMAGE"
 
 ENV HOST_ROOT /host
 ENV HOME /root

docker/falco/Dockerfile

@@ -2,7 +2,7 @@ FROM debian:stable
 
 LABEL maintainer="cncf-falco-dev@lists.cncf.io"
 
-LABEL usage="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
+LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc --name NAME IMAGE"
 
 ARG FALCO_VERSION=latest
 ARG VERSION_BUCKET=deb

docker/no-driver/Dockerfile

@@ -1,7 +1,5 @@
 FROM ubuntu:18.04 as ubuntu
 
-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-
 ARG FALCO_VERSION
 ARG VERSION_BUCKET=bin
 
@@ -22,6 +20,14 @@ RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/
 
 FROM scratch
 
+LABEL maintainer="cncf-falco-dev@lists.cncf.io"
+
+LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE"
+# NOTE: for the "least privileged" use case, please refer to the official documentation
+
+ENV HOST_ROOT /host
+ENV HOME /root
+
 COPY --from=ubuntu /falco /
 
 CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]

falco.yaml

@@ -28,7 +28,10 @@
 # The files will be read in the order presented here, so make sure if
 # you have overrides they appear in later files.
 rules_file:
-  - /tmp/falco
+  - /etc/falco/falco_rules.yaml
+  - /etc/falco/falco_rules.local.yaml
+  - /etc/falco/k8s_audit_rules.yaml
+  - /etc/falco/rules.d
 
 # If true, the times displayed in log messages and output messages
 # will be in ISO 8601. By default, times are displayed in the local

proposals/20201025-drivers-storage-s3.md

@@ -1,5 +1,9 @@
 # Falco Drivers Storage S3
 
+Supersedes: [20200818-artifacts-storage.md#drivers](20200818-artifacts-storage.md#drivers)
+
+Supersedes: [20200901-artifacts-cleanup.md#drivers](20200901-artifacts-cleanup.md#drivers)
+
 ## Introduction
 
 In the past days, as many people probably noticed, Bintray started rate-limiting our users, effectively preventing them from downloading any kernel module, rpm/deb package or any pre-built dependency we host there.
@@ -55,7 +59,7 @@ We want to propose to move the drivers and the container dependencies to S3.
 
 #### Moving means:
 
-* We create a public S3 bucket with[ stats enabled](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html)
+* We create a public S3 bucket with [stats enabled](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html)
 
 * We attach the bucket to a cloudfront distribution behind the download.falco.org subdomain
 

rules/falco_rules.yaml

@@ -1213,6 +1213,9 @@
        fd.name startswith /etc/ssh/ssh_monitor_config_ or
        fd.name startswith /etc/ssh/ssh_config_))
 
+- macro: multipath_writing_conf
+  condition: (proc.name = multipath and fd.name startswith /etc/multipath/)
+
 # Add conditions to this macro (probably in a separate file,
 # overwriting this macro) to allow for specific combinations of
 # programs writing below specific directories below
@@ -1333,6 +1336,7 @@
     and not automount_using_mtab
     and not mcafee_writing_cma_d
     and not avinetworks_supervisor_writing_ssh
+    and not multipath_writing_conf
 
 - rule: Write below etc
   desc: an attempt to write to any file below /etc
@@ -1866,6 +1870,7 @@
 - list: falco_privileged_images
   items: [
     docker.io/calico/node,
+    calico/node,
     docker.io/cloudnativelabs/kube-router,
     docker.io/docker/ucp-agent,
     docker.io/falcosecurity/falco,
@@ -2314,6 +2319,9 @@
 - macro: user_known_user_management_activities
   condition: (never_true)
 
+- macro: chage_list
+  condition: (proc.name=chage and (proc.cmdline contains "-l" or proc.cmdline contains "--list"))
+
 - rule: User mgmt binaries
   desc: >
     activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded.
@@ -2332,6 +2340,7 @@
     not run_by_yum and
     not run_by_ms_oms and
     not run_by_google_accounts_daemon and
+    not chage_list and
     not user_known_user_management_activities
   output: >
     User management binary command run outside of container
@@ -2863,12 +2872,22 @@
 - list: k8s_client_binaries
   items: [docker, kubectl, crictl]
 
+- list: user_known_k8s_ns_kube_system_images
+  items: [
+      k8s.gcr.io/fluentd-gcp-scaler,
+      k8s.gcr.io/node-problem-detector/node-problem-detector
+  ]
+
+- list: user_known_k8s_images
+  items: [
+      mcr.microsoft.com/aks/hcp/hcp-tunnel-front
+  ]
+
 # Whitelist for known docker client binaries run inside container
 # - k8s.gcr.io/fluentd-gcp-scaler in GCP/GKE
 - macro: user_known_k8s_client_container
   condition: >
-    (k8s.ns.name="kube-system" and container.image.repository=k8s.gcr.io/fluentd-gcp-scaler) or
+    (k8s.ns.name="kube-system" and container.image.repository in (user_known_k8s_ns_kube_system_images)) or container.image.repository in (user_known_k8s_images)
-    container.image.repository=mcr.microsoft.com/aks/hcp/hcp-tunnel-front
 
 - macro: user_known_k8s_client_container_parens
   condition: (user_known_k8s_client_container)
@@ -3041,6 +3060,16 @@
   priority: WARNING
   tags: [network]
 
+- list: white_listed_modules
+  items: []
+    
+- rule: Linux Kernel Module Injection Detected
+  desc: Detect kernel module was injected (from container).
+  condition: spawned_process and container and proc.name=insmod and not proc.args in (white_listed_modules)
+  output: Linux Kernel Module injection using insmod detected (user=%user.name user_loginuid=%user.loginuid parent_process=%proc.pname module=%proc.args)
+  priority: WARNING
+  tags: [process]
+
 # Application rules have moved to application_rules.yaml. Please look
 # there if you want to enable them by adding to
 # falco_rules.local.yaml.

rules/k8s_audit_rules.yaml

@@ -537,7 +537,7 @@
   condition: >
     kevt 
     and non_system_user 
-    and ka.user.name in (admin_k8s_users) 
+    and ka.user.name in (full_admin_k8s_users)
     and not allowed_full_admin_users
   output: K8s Operation performed by full admin user (user=%ka.user.name target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)
   priority: WARNING

scripts/falco-driver-loader

@@ -220,7 +220,7 @@ load_kernel_module() {
 	rmmod "${DRIVER_NAME}" 2>/dev/null
 	WAIT_TIME=0
 	KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
-	while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do
+	while lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do 
 		if rmmod "${DRIVER_NAME}" 2>/dev/null; then
 			echo "* Unloading ${DRIVER_NAME} module succeeded after ${WAIT_TIME}s"
 			break
@@ -232,7 +232,7 @@ load_kernel_module() {
 		sleep 1
 	done
 
-	if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then
+	if lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" > /dev/null 2>&1; then
 		echo "* ${DRIVER_NAME} module seems to still be loaded, hoping the best"
 		exit 0
 	fi

test/run_regression_tests.sh

@@ -104,8 +104,12 @@ function run_tests() {
         suites+=($SCRIPTDIR/falco_tests_package.yaml)
     fi
     
+    XUNIT_DIR="${OPT_BUILD_DIR}/integration-tests-xunit"
+    mkdir -p "${XUNIT_DIR}"
+
     for mult in "${suites[@]}"; do
-        CMD="avocado run --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
+        XUNIT_FILE_NAME="${XUNIT_DIR}/$(basename "${mult}").xml"
+        CMD="avocado run --xunit ${XUNIT_FILE_NAME} --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
         echo "Running $CMD"
         BUILD_DIR=${OPT_BUILD_DIR} $CMD
         RC=$?

userspace/engine/CMakeLists.txt

@@ -38,8 +38,7 @@ if(MINIMAL_BUILD)
       "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp"
       "${SYSDIG_SOURCE_DIR}/userspace/libscap"
       "${SYSDIG_SOURCE_DIR}/userspace/libsinsp"
-      "${PROJECT_BINARY_DIR}/userspace/engine"
+      "${PROJECT_BINARY_DIR}/userspace/engine")
-      "${PROJECT_SOURCE_DIR}/userspace/libhawk")
 else()
   target_include_directories(
     falco_engine
@@ -52,17 +51,11 @@ else()
       "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp"
       "${SYSDIG_SOURCE_DIR}/userspace/libscap"
       "${SYSDIG_SOURCE_DIR}/userspace/libsinsp"
-      "${PROJECT_BINARY_DIR}/userspace/engine"
+      "${PROJECT_BINARY_DIR}/userspace/engine")
-      "${PROJECT_SOURCE_DIR}/userspace/libhawk")
 endif()
 
 target_link_libraries(falco_engine "${FALCO_SINSP_LIBRARY}" "${LPEG_LIB}" "${LYAML_LIB}" "${LIBYAML_LIB}")
 
-if(DEFINED LIBHAWK_LIBRARIES)
-  message(STATUS "Using externally provided libhawk implementations: ${LIBHAWK_LIBRARIES}")
-  target_link_libraries(falco_engine ${LIBHAWK_LIBRARIES})
-endif()
-
 configure_file(config_falco_engine.h.in config_falco_engine.h)
 
 if(DEFINED FALCO_COMPONENT)

userspace/engine/falco_engine.cpp

@@ -26,8 +26,7 @@ limitations under the License.
 
 #include "formats.h"
 
-extern "C"
+extern "C" {
-{
 #include "lpeg.h"
 #include "lyaml.h"
 }
@@ -35,6 +34,7 @@ extern "C"
 #include "utils.h"
 #include "banned.h" // This raises a compilation error when certain functions are used
 
+
 string lua_on_event = "on_event";
 string lua_print_stats = "print_stats";
 
@@ -42,8 +42,8 @@ using namespace std;
 
 nlohmann::json::json_pointer falco_engine::k8s_audit_time = "/stageTimestamp"_json_pointer;
 
-falco_engine::falco_engine(bool seed_rng, const std::string &alternate_lua_dir):
+falco_engine::falco_engine(bool seed_rng, const std::string& alternate_lua_dir)
-	m_rules(NULL), m_next_ruleset_id(0),
+	: m_rules(NULL), m_next_ruleset_id(0),
 	  m_min_priority(falco_common::PRIORITY_DEBUG),
 	  m_sampling_ratio(1), m_sampling_multiplier(0),
 	  m_replace_container_info(false)
@@ -51,15 +51,15 @@ falco_engine::falco_engine(bool seed_rng, const std::string &alternate_lua_dir):
 	luaopen_lpeg(m_ls);
 	luaopen_yaml(m_ls);
 
-	m_alternate_lua_dir = alternate_lua_dir;
 	falco_common::init(m_lua_main_filename.c_str(), alternate_lua_dir.c_str());
 	falco_rules::init(m_ls);
 
-	clear_filters();
+	m_sinsp_rules.reset(new falco_sinsp_ruleset());
+	m_k8s_audit_rules.reset(new falco_ruleset());
 
 	if(seed_rng)
 	{
-		srandom((unsigned)getpid());
+		srandom((unsigned) getpid());
 	}
 
 	m_default_ruleset_id = find_ruleset_id(m_default_ruleset);
@@ -70,24 +70,15 @@ falco_engine::falco_engine(bool seed_rng, const std::string &alternate_lua_dir):
 
 falco_engine::~falco_engine()
 {
-	if(m_rules)
+	if (m_rules)
 	{
 		delete m_rules;
 	}
 }
 
-falco_engine *falco_engine::clone()
-{
-	auto engine = new falco_engine(true, m_alternate_lua_dir);
-	engine->set_inspector(m_inspector);
-	engine->set_extra(m_extra, m_replace_container_info);
-	engine->set_min_priority(m_min_priority);
-	return engine;
-}
-
 uint32_t falco_engine::engine_version()
 {
-	return (uint32_t)FALCO_ENGINE_VERSION;
+	return (uint32_t) FALCO_ENGINE_VERSION;
 }
 
 #define DESCRIPTION_TEXT_START 16
@@ -153,28 +144,17 @@ void falco_engine::list_fields(bool names_only)
 	}
 }
 
-void falco_engine::load_rules_file(const string &rules_filename, bool verbose, bool all_events)
-{
-	ifstream is;
-
-	is.open(rules_filename);
-	if(!is.is_open())
-	{
-		throw falco_exception("Could not open rules filename " +
-				      rules_filename + " " +
-				      "for reading");
-	}
-
-	string rules_content((istreambuf_iterator<char>(is)),
-			     istreambuf_iterator<char>());
-
-	load_rules(rules_content, verbose, all_events);
-}
-
 void falco_engine::load_rules(const string &rules_content, bool verbose, bool all_events)
+{
+	uint64_t dummy;
+
+	return load_rules(rules_content, verbose, all_events, dummy);
+}
+
+void falco_engine::load_rules(const string &rules_content, bool verbose, bool all_events, uint64_t &required_engine_version)
 {
 	// The engine must have been given an inspector by now.
-	if(!m_inspector)
+	if(! m_inspector)
 	{
 		throw falco_exception("No inspector provided");
 	}
@@ -186,52 +166,45 @@ void falco_engine::load_rules(const string &rules_content, bool verbose, bool al
 
 	if(!m_rules)
 	{
-		// Note that falco_formats is added to the lua state used by the falco engine only.
+		m_rules = new falco_rules(m_inspector,
-		// Within the engine, only formats.
+					  this,
-		// Formatter is used, so we can unconditionally set json_output to false.
+					  m_ls);
+	}
+
+	// Note that falco_formats is added to the lua state used
+	// by the falco engine only. Within the engine, only
+	// formats.formatter is used, so we can unconditionally set
+	// json_output to false.
 	bool json_output = false;
 	bool json_include_output_property = false;
 	falco_formats::init(m_inspector, this, m_ls, json_output, json_include_output_property);
-		m_rules = new falco_rules(m_inspector, this, m_ls);
-	}
 
-	uint64_t dummy;
+	m_rules->load_rules(rules_content, verbose, all_events, m_extra, m_replace_container_info, m_min_priority, required_engine_version);
-	// m_sinsp_rules.reset(new falco_sinsp_ruleset());
-	// m_k8s_audit_rules.reset(new falco_ruleset());
-	m_rules->load_rules(rules_content, verbose, all_events, m_extra, m_replace_container_info, m_min_priority, dummy);
-
-	m_is_ready = true;
-
-	return;
-
-	//
-	// auto local_rules = new falco_rules(m_inspector, this, m_ls);
-	// try
-	// {
-	// 	uint64_t dummy;
-	// 	local_rules->load_rules(rules_content, verbose, all_events, m_extra, m_replace_container_info, m_min_priority, dummy);
-
-	// 	// m_rules = local_rules
-	// 	// std::atomic<falco_rules *> lore(m_rules);
-	// 	// std::atomic_exchange(&lore, local_rules);
-	// 	// SCHEDULE LOCAL_RULES AS NEXT RULESET
-	// }
-	// catch(const falco_exception &e)
-	// {
-	// 	// todo
-	// 	printf("IGNORE BECAUSE OF ERROR LOADING RULESET!\n");
-	// }
 }
 
-// // todo(fntlnz): not sure we want this in falco_engine
+void falco_engine::load_rules_file(const string &rules_filename, bool verbose, bool all_events)
-// void falco_engine::watch_rules(bool verbose, bool all_events)
-// {
-// 	hawk_watch_rules((hawk_watch_rules_cb)rules_cb, reinterpret_cast<hawk_engine *>(this));
-// }
-
-bool falco_engine::is_ready()
 {
-	return m_is_ready;
+	uint64_t dummy;
+
+	return load_rules_file(rules_filename, verbose, all_events, dummy);
+}
+
+void falco_engine::load_rules_file(const string &rules_filename, bool verbose, bool all_events, uint64_t &required_engine_version)
+{
+	ifstream is;
+
+	is.open(rules_filename);
+	if (!is.is_open())
+	{
+		throw falco_exception("Could not open rules filename " +
+				      rules_filename + " " +
+				      "for reading");
+	}
+
+	string rules_content((istreambuf_iterator<char>(is)),
+			     istreambuf_iterator<char>());
+
+	load_rules(rules_content, verbose, all_events, required_engine_version);
 }
 
 void falco_engine::enable_rule(const string &substring, bool enabled, const string &ruleset)
@@ -338,7 +311,7 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_sinsp_event(sinsp_ev
 
 		if(lua_pcall(m_ls, 1, 3, 0) != 0)
 		{
-			const char *lerr = lua_tostring(m_ls, -1);
+			const char* lerr = lua_tostring(m_ls, -1);
 			string err = "Error invoking function output: " + string(lerr);
 			throw falco_exception(err);
 		}
@@ -346,7 +319,7 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_sinsp_event(sinsp_ev
 		const char *p =  lua_tostring(m_ls, -3);
 		res->rule = p;
 		res->source = "syscall";
-		res->priority_num = (falco_common::priority_type)lua_tonumber(m_ls, -2);
+		res->priority_num = (falco_common::priority_type) lua_tonumber(m_ls, -2);
 		res->format = lua_tostring(m_ls, -1);
 		lua_pop(m_ls, 3);
 	}
@@ -360,7 +333,6 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_sinsp_event(sinsp_ev
 
 unique_ptr<falco_engine::rule_result> falco_engine::process_sinsp_event(sinsp_evt *ev)
 {
-	// todo(leodido, fntlnz) > pass the last ruleset id
 	return process_sinsp_event(ev, m_default_ruleset_id);
 }
 
@@ -372,7 +344,7 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_k8s_audit_event(json
 	}
 
 	// All k8s audit events have the single tag "1".
-	if(!m_k8s_audit_rules->run((gen_event *)ev, 1, ruleset_id))
+	if(!m_k8s_audit_rules->run((gen_event *) ev, 1, ruleset_id))
 	{
 		return unique_ptr<struct rule_result>();
 	}
@@ -387,7 +359,7 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_k8s_audit_event(json
 
 		if(lua_pcall(m_ls, 1, 3, 0) != 0)
 		{
-			const char *lerr = lua_tostring(m_ls, -1);
+			const char* lerr = lua_tostring(m_ls, -1);
 			string err = "Error invoking function output: " + string(lerr);
 			throw falco_exception(err);
 		}
@@ -395,7 +367,7 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_k8s_audit_event(json
 		const char *p =  lua_tostring(m_ls, -3);
 		res->rule = p;
 		res->source = "k8s_audit";
-		res->priority_num = (falco_common::priority_type)lua_tonumber(m_ls, -2);
+		res->priority_num = (falco_common::priority_type) lua_tonumber(m_ls, -2);
 		res->format = lua_tostring(m_ls, -1);
 		lua_pop(m_ls, 3);
 	}
@@ -421,7 +393,7 @@ bool falco_engine::parse_k8s_audit_json(nlohmann::json &j, std::list<json_event>
 				{
 					// Note we only handle a single top level array, to
 					// avoid excessive recursion.
-					if(!parse_k8s_audit_json(item, evts, false))
+					if(! parse_k8s_audit_json(item, evts, false))
 					{
 						return false;
 					}
@@ -499,7 +471,7 @@ void falco_engine::print_stats()
 	{
 		if(lua_pcall(m_ls, 0, 0, 0) != 0)
 		{
-			const char *lerr = lua_tostring(m_ls, -1);
+			const char* lerr = lua_tostring(m_ls, -1);
 			string err = "Error invoking function print_stats: " + string(lerr);
 			throw falco_exception(err);
 		}
@@ -508,20 +480,21 @@ void falco_engine::print_stats()
 	{
 		throw falco_exception("No function " + lua_print_stats + " found in lua rule loader module");
 	}
+
 }
 
 void falco_engine::add_sinsp_filter(string &rule,
 				    set<uint32_t> &evttypes,
 				    set<uint32_t> &syscalls,
 				    set<string> &tags,
-				    sinsp_filter *filter)
+				    sinsp_filter* filter)
 {
 	m_sinsp_rules->add(rule, evttypes, syscalls, tags, filter);
 }
 
 void falco_engine::add_k8s_audit_filter(string &rule,
 					set<string> &tags,
-					json_event_filter *filter)
+					json_event_filter* filter)
 {
 	// All k8s audit events have a single tag "1".
 	std::set<uint32_t> event_tags = {1};
@@ -563,8 +536,8 @@ inline bool falco_engine::should_drop_evt()
 		return false;
 	}
 
-	double coin = (random() * (1.0 / RAND_MAX));
+	double coin = (random() * (1.0/RAND_MAX));
-	return (coin >= (1.0 / (m_sampling_multiplier * m_sampling_ratio)));
+	return (coin >= (1.0/(m_sampling_multiplier * m_sampling_ratio)));
 }
 
 sinsp_filter_factory &falco_engine::sinsp_factory()

userspace/engine/falco_engine.h

@@ -38,11 +38,6 @@ limitations under the License.
 #include "config_falco_engine.h"
 #include "falco_common.h"
 
-extern "C"
-{
-#include "hawk.h"
-}
-
 //
 // This class acts as the primary interface between a program and the
 // falco rules engine. Falco outputs (writing to files/syslog/etc) are
@@ -52,12 +47,9 @@ extern "C"
 class falco_engine : public falco_common
 {
 public:
-	falco_engine(bool seed_rng = true, const std::string &alternate_lua_dir = FALCO_ENGINE_SOURCE_LUA_DIR);
+	falco_engine(bool seed_rng=true, const std::string& alternate_lua_dir=FALCO_ENGINE_SOURCE_LUA_DIR);
 	virtual ~falco_engine();
 
-	falco_engine(const falco_engine &rhs);
-	falco_engine *clone();
-
 	// A given engine has a version which identifies the fields
 	// and rules file format it supports. This version will change
 	// any time the code that handles rules files, expression
@@ -65,7 +57,7 @@ public:
 	static uint32_t engine_version();
 
 	// Print to stdout (using printf) a description of each field supported by this engine.
-	void list_fields(bool names_only = false);
+	void list_fields(bool names_only=false);
 
 	//
 	// Load rules either directly or from a filename.
@@ -73,8 +65,12 @@ public:
 	void load_rules_file(const std::string &rules_filename, bool verbose, bool all_events);
 	void load_rules(const std::string &rules_content, bool verbose, bool all_events);
 
-	// Watch and live-reload rules using an external ABI interface provided by libhawk
+	//
-	void watch_rules(bool verbose, bool all_events);
+	// Identical to above, but also returns the required engine version for the file/content.
+	// (If no required engine version is specified, returns 0).
+	//
+	void load_rules_file(const std::string &rules_filename, bool verbose, bool all_events, uint64_t &required_engine_version);
+	void load_rules(const std::string &rules_content, bool verbose, bool all_events, uint64_t &required_engine_version);
 
 	//
 	// Enable/Disable any rules matching the provided substring.
@@ -89,6 +85,7 @@ public:
 	// Wrapper that assumes the default ruleset
 	void enable_rule(const std::string &substring, bool enabled);
 
+
 	// Like enable_rule, but the rule name must be an exact match.
 	void enable_rule_exact(const std::string &rule_name, bool enabled, const std::string &ruleset);
 
@@ -157,8 +154,7 @@ public:
 
 	// **Methods Related to k8s audit log events, which are
 	// **represented as json objects.
-	struct rule_result
+	struct rule_result {
-	{
 		gen_event *evt;
 		std::string rule;
 		std::string source;
@@ -174,7 +170,7 @@ public:
 	// Returns true if the json object was recognized as a k8s
 	// audit event(s), false otherwise.
 	//
-	bool parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts, bool top = true);
+	bool parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts, bool top=true);
 
 	//
 	// Given an event, check it against the set of rules in the
@@ -199,7 +195,7 @@ public:
 	//
 	void add_k8s_audit_filter(std::string &rule,
 				  std::set<std::string> &tags,
-				  json_event_filter *filter);
+				  json_event_filter* filter);
 
 	// **Methods Related to Sinsp Events e.g system calls
 	//
@@ -240,14 +236,13 @@ public:
 			      std::set<uint32_t> &evttypes,
 			      std::set<uint32_t> &syscalls,
 			      std::set<std::string> &tags,
-			      sinsp_filter *filter);
+			      sinsp_filter* filter);
 
 	sinsp_filter_factory &sinsp_factory();
 	json_event_filter_factory &json_factory();
 
-	bool is_ready();
-
 private:
+
 	static nlohmann::json::json_pointer k8s_audit_time;
 
 	//
@@ -267,8 +262,6 @@ private:
 	std::unique_ptr<falco_sinsp_ruleset> m_sinsp_rules;
 	std::unique_ptr<falco_ruleset> m_k8s_audit_rules;
 
-	std::string m_alternate_lua_dir;
-
 	//
 	// Here's how the sampling ratio and multiplier influence
 	// whether or not an event is dropped in
@@ -298,6 +291,5 @@ private:
 
 	std::string m_extra;
 	bool m_replace_container_info;
-
-	bool m_is_ready = false;
 };
+

userspace/engine/formats.cpp

@@ -26,7 +26,7 @@ bool falco_formats::s_json_output = false;
 bool falco_formats::s_json_include_output_property = true;
 std::unique_ptr<sinsp_evt_formatter_cache> falco_formats::s_formatters = NULL;
 
-const static struct luaL_reg ll_falco[] =
+const static struct luaL_Reg ll_falco[] =
 	{
 		{"formatter", &falco_formats::lua_formatter},
 		{"free_formatter", &falco_formats::lua_free_formatter},

userspace/engine/rules.cpp

@@ -26,15 +26,14 @@ extern "C" {
 #include "falco_engine.h"
 #include "banned.h" // This raises a compilation error when certain functions are used
 
-const static struct luaL_reg ll_falco_rules [] =
+const static struct luaL_Reg ll_falco_rules[] =
-{
+	{
 		{"clear_filters", &falco_rules::clear_filters},
 		{"add_filter", &falco_rules::add_filter},
 		{"add_k8s_audit_filter", &falco_rules::add_k8s_audit_filter},
 		{"enable_rule", &falco_rules::enable_rule},
 		{"engine_version", &falco_rules::engine_version},
-	{NULL,NULL}
+		{NULL, NULL}};
-};
 
 falco_rules::falco_rules(sinsp* inspector,
 			 falco_engine *engine,

userspace/falco/CMakeLists.txt

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2019 The Falco Authors.
+# Copyright (C) 2020 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -11,7 +11,130 @@
 # specific language governing permissions and limitations under the License.
 #
 
-configure_file("${SYSDIG_SOURCE_DIR}/userspace/sysdig/config_sysdig.h.in" config_sysdig.h)
+configure_file(config_falco.h.in config_falco.h)
+
+set(
+  FALCO_SOURCES
+  configuration.cpp
+  logger.cpp
+  falco_outputs.cpp
+  outputs_file.cpp
+  outputs_program.cpp
+  outputs_stdout.cpp
+  outputs_syslog.cpp
+  event_drops.cpp
+  statsfilewriter.cpp
+  falco.cpp
+  "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/fields_info.cpp"
+)
+
+set(
+  FALCO_INCLUDE_DIRECTORIES
+  "${PROJECT_SOURCE_DIR}/userspace/engine"
+  "${PROJECT_BINARY_DIR}/userspace/falco"
+  "${PROJECT_BINARY_DIR}/driver/src"
+  "${SPDLOG_INCLUDE_DIR}"
+  "${STRING_VIEW_LITE_INCLUDE}"
+  "${YAMLCPP_INCLUDE_DIR}"
+  "${CMAKE_CURRENT_BINARY_DIR}"
+  "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include"
+)
+
+set(
+  FALCO_DEPENDENCIES
+  spdlog
+  string-view-lite
+  libyaml
+  b64
+  luajit
+  lpeg
+  lyaml
+)
+
+set(
+  FALCO_LIBRARIES
+  falco_engine
+  sinsp
+  "${LIBYAML_LIB}"
+  "${YAMLCPP_LIB}"
+)
+
+if(USE_BUNDLED_DEPS)
+  list(APPEND FALCO_DEPENDENCIES yamlcpp)
+endif()
+
+if(NOT MINIMAL_BUILD)
+  list(
+    APPEND FALCO_SOURCES
+    outputs_grpc.cpp
+    outputs_http.cpp
+    webserver.cpp
+    grpc_context.cpp
+    grpc_server_impl.cpp
+    grpc_request_context.cpp
+    grpc_server.cpp
+    grpc_context.cpp
+    grpc_server_impl.cpp
+    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
+  )
+
+  list(
+    APPEND FALCO_INCLUDE_DIRECTORIES
+    "${CIVETWEB_INCLUDE_DIR}"
+    "${OPENSSL_INCLUDE_DIR}"
+    "${GRPC_INCLUDE}"
+    "${GRPCPP_INCLUDE}"
+    "${PROTOBUF_INCLUDE}"
+  )
+
+  list(APPEND FALCO_DEPENDENCIES civetweb)
+
+  list(
+    APPEND FALCO_LIBRARIES
+    "${GPR_LIB}"
+    "${GRPC_LIB}"
+    "${GRPCPP_LIB}"
+    "${PROTOBUF_LIB}"
+    "${OPENSSL_LIBRARY_SSL}"
+    "${OPENSSL_LIBRARY_CRYPTO}"
+    "${LIBYAML_LIB}"
+    "${YAMLCPP_LIB}"
+    "${CIVETWEB_LIB}"
+  )
+endif()
+
+add_executable(
+  falco
+  ${FALCO_SOURCES}
+)
+
+add_dependencies(falco ${FALCO_DEPENDENCIES})
+
+target_link_libraries(
+  falco
+  ${FALCO_LIBRARIES}
+)
+
+target_include_directories(
+  falco
+  PUBLIC
+  ${FALCO_INCLUDE_DIRECTORIES}
+)
+
+if(NOT MINIMAL_BUILD)
+  add_custom_command(
+    TARGET falco
+    COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/verify_engine_fields.sh ${CMAKE_SOURCE_DIR}
+    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+    COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields"
+  )
+else()
+  message(STATUS "Skipping engine fields checksum when building the minimal Falco.")
+endif()
 
 if(NOT MINIMAL_BUILD)
   add_custom_command(
@@ -38,121 +161,8 @@ if(NOT MINIMAL_BUILD)
     ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
     COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
     ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-endif()
+  )
-
-if(MINIMAL_BUILD)
-add_executable(
-  falco
-  configuration.cpp
-  logger.cpp
-  falco_outputs.cpp
-  outputs_file.cpp
-  outputs_program.cpp
-  outputs_stdout.cpp
-  outputs_syslog.cpp
-  event_drops.cpp
-  statsfilewriter.cpp
-  falco.cpp
-  "${SYSDIG_SOURCE_DIR}/userspace/sysdig/fields_info.cpp")
-else()
-  add_executable(
-    falco
-    configuration.cpp
-    logger.cpp
-    falco_outputs.cpp
-    outputs_file.cpp
-    outputs_grpc.cpp
-    outputs_http.cpp
-    outputs_program.cpp
-    outputs_stdout.cpp
-    outputs_syslog.cpp
-    event_drops.cpp
-    statsfilewriter.cpp
-    falco.cpp
-    "${SYSDIG_SOURCE_DIR}/userspace/sysdig/fields_info.cpp"
-    webserver.cpp
-    grpc_context.cpp
-    grpc_server_impl.cpp
-    grpc_request_context.cpp
-    grpc_server.cpp
-    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc)
-
-    add_dependencies(falco civetweb)
-endif()
-
-add_dependencies(falco string-view-lite)
-
-if(USE_BUNDLED_DEPS)
-  add_dependencies(falco yamlcpp)
-endif()
-
-if(MINIMAL_BUILD)
-  target_include_directories(
-    falco
-    PUBLIC
-      "${SYSDIG_SOURCE_DIR}/userspace/sysdig"
-      "${PROJECT_SOURCE_DIR}/userspace/engine"
-      "${PROJECT_BINARY_DIR}/userspace/falco"
-      "${PROJECT_BINARY_DIR}/driver/src"
-      "${STRING_VIEW_LITE_INCLUDE}"
-      "${YAMLCPP_INCLUDE_DIR}"
-      "${CMAKE_CURRENT_BINARY_DIR}"
-      "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include")
-
-  target_link_libraries(
-    falco
-    falco_engine
-    sinsp
-    "${LIBYAML_LIB}"
-    "${YAMLCPP_LIB}")
-else()
-  target_include_directories(
-    falco
-    PUBLIC
-      "${SYSDIG_SOURCE_DIR}/userspace/sysdig"
-      "${PROJECT_SOURCE_DIR}/userspace/engine"
-      "${PROJECT_BINARY_DIR}/userspace/falco"
-      "${PROJECT_BINARY_DIR}/driver/src"
-      "${STRING_VIEW_LITE_INCLUDE}"
-      "${YAMLCPP_INCLUDE_DIR}"
-      "${CIVETWEB_INCLUDE_DIR}"
-      "${OPENSSL_INCLUDE_DIR}"
-      "${GRPC_INCLUDE}"
-      "${GRPCPP_INCLUDE}"
-      "${PROTOBUF_INCLUDE}"
-      "${CMAKE_CURRENT_BINARY_DIR}"
-      "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include")
-
-  target_link_libraries(
-    falco
-    falco_engine
-    sinsp
-    "${GPR_LIB}"
-    "${GRPC_LIB}"
-    "${GRPCPP_LIB}"
-    "${PROTOBUF_LIB}"
-    "${OPENSSL_LIBRARY_SSL}"
-    "${OPENSSL_LIBRARY_CRYPTO}"
-    "${LIBYAML_LIB}"
-    "${YAMLCPP_LIB}"
-    "${CIVETWEB_LIB}")
-endif()
-
-configure_file(config_falco.h.in config_falco.h)
-
-if(NOT MINIMAL_BUILD)
-  # add_custom_command(
-  #   TARGET falco
-  #   COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/verify_engine_fields.sh ${CMAKE_SOURCE_DIR}
-  #   WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-  #   COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields")
-else()
-  MESSAGE(STATUS "Skipping engine fields checksum when building the minimal Falco.")
 endif()
 
 # strip the Falco binary when releasing using musl
@@ -161,7 +171,8 @@ if(MUSL_OPTIMIZED_BUILD AND CMAKE_BUILD_TYPE STREQUAL "release")
     TARGET falco
     POST_BUILD
     COMMAND ${CMAKE_STRIP} --strip-unneeded falco
-    COMMENT "Strip the Falco binary when releasing the musl build")
+    COMMENT "Strip the Falco binary when releasing the musl build"
+  )
 endif()
 
 install(TARGETS falco DESTINATION ${FALCO_BIN_DIR})

userspace/falco/configuration.cpp

@@ -68,6 +68,16 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 
 	m_config->get_sequence<list<string>>(rules_files, string("rules_file"));
 
+	for(auto &file : rules_files)
+	{
+		// Here, we only include files that exist
+		struct stat buffer;
+		if(stat(file.c_str(), &buffer) == 0)
+		{
+			read_rules_file_directory(file, m_rules_filenames);
+		}
+	}
+
 	m_json_output = m_config->get_scalar<bool>("json_output", false);
 	m_json_include_output_property = m_config->get_scalar<bool>("json_include_output_property", true);
 
@@ -232,6 +242,69 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 	m_syscall_evt_simulate_drops = m_config->get_scalar<bool>("syscall_event_drops", "simulate_drops", false);
 }
 
+void falco_configuration::read_rules_file_directory(const string &path, list<string> &rules_filenames)
+{
+	struct stat st;
+
+	int rc = stat(path.c_str(), &st);
+
+	if(rc != 0)
+	{
+		std::cerr << "Could not get info on rules file " << path << ": " << strerror(errno) << std::endl;
+		exit(-1);
+	}
+
+	if(st.st_mode & S_IFDIR)
+	{
+		// It's a directory. Read the contents, sort
+		// alphabetically, and add every path to
+		// rules_filenames
+		vector<string> dir_filenames;
+
+		DIR *dir = opendir(path.c_str());
+
+		if(!dir)
+		{
+			std::cerr << "Could not get read contents of directory " << path << ": " << strerror(errno) << std::endl;
+			exit(-1);
+		}
+
+		for(struct dirent *ent = readdir(dir); ent; ent = readdir(dir))
+		{
+			string efile = path + "/" + ent->d_name;
+
+			rc = stat(efile.c_str(), &st);
+
+			if(rc != 0)
+			{
+				std::cerr << "Could not get info on rules file " << efile << ": " << strerror(errno) << std::endl;
+				exit(-1);
+			}
+
+			if(st.st_mode & S_IFREG)
+			{
+				dir_filenames.push_back(efile);
+			}
+		}
+
+		closedir(dir);
+
+		std::sort(dir_filenames.begin(),
+			  dir_filenames.end());
+
+		for(string &ent : dir_filenames)
+		{
+			rules_filenames.push_back(ent);
+		}
+	}
+	else
+	{
+		// Assume it's a file and just add to
+		// rules_filenames. If it can't be opened/etc that
+		// will be reported later..
+		rules_filenames.push_back(path);
+	}
+}
 
 static bool split(const string &str, char delim, pair<string, string> &parts)
 {

userspace/falco/configuration.h

@@ -190,6 +190,9 @@ public:
 	void init(std::string conf_filename, std::list<std::string>& cmdline_options);
 	void init(std::list<std::string>& cmdline_options);
 
+	static void read_rules_file_directory(const string& path, list<string>& rules_filenames);
+
+	std::list<std::string> m_rules_filenames;
 	bool m_json_output;
 	bool m_json_include_output_property;
 	std::string m_log_level;

userspace/falco/falco.cpp

@@ -30,15 +30,13 @@ limitations under the License.
 #include <sys/stat.h>
 #include <unistd.h>
 #include <getopt.h>
-#include <condition_variable>
-#include <tuple>
 
 #include <sinsp.h>
 
 #include "logger.h"
 #include "utils.h"
 #include "chisel.h"
-#include "sysdig.h"
+#include "fields_info.h"
 
 #include "event_drops.h"
 #include "configuration.h"
@@ -51,17 +49,13 @@ limitations under the License.
 #endif
 #include "banned.h" // This raises a compilation error when certain functions are used
 
-typedef function<void(sinsp *inspector)> open_t;
+typedef function<void(sinsp* inspector)> open_t;
 
 bool g_terminate = false;
 bool g_reopen_outputs = false;
 bool g_restart = false;
 bool g_daemonized = false;
 
-std::mutex engine_ready;
-std::condition_variable engine_cv;
-bool is_engine_ready = false;
-
 //
 // Helper functions
 //
@@ -151,6 +145,8 @@ static void usage()
 	   "                               Additionally, specifying -pc/-pk/-pm will change the interpretation\n"
 	   "                               of %%container.info in rule output fields.\n"
 	   " -P, --pidfile <pid_file>      When run as a daemon, write pid to specified file\n"
+       " -r <rules_file>               Rules file/directory (defaults to value set in configuration file, or /etc/falco_rules.yaml).\n"
+       "                               Can be specified multiple times to read from multiple files/directories.\n"
 	   " -s <stats_file>               If specified, append statistics related to Falco's reading/processing of events\n"
 	   "                               to this file (only useful in live mode).\n"
 	   " --stats-interval <msec>       When using -s <stats_file>, write statistics every <msec> ms.\n"
@@ -160,7 +156,7 @@ static void usage()
 	   "                               Capture the first <len> bytes of each I/O buffer.\n"
 	   "                               By default, the first 80 bytes are captured. Use this\n"
 	   "                               option with caution, it can generate huge trace files.\n"
-		" --support                     Print support information including version, etc. and exit.\n"
+	   " --support                     Print support information including version, rules files used, etc. and exit.\n"
 	   " -T <tag>                      Disable any rules with a tag=<tag>. Can be specified multiple times.\n"
 	   "                               Can not be specified with -t.\n"
 	   " -t <tag>                      Only run those rules with a tag=<tag>. Can be specified multiple times.\n"
@@ -175,7 +171,8 @@ static void usage()
 	   "                               Can be specified multiple times to validate multiple files.\n"
 	   " -v                            Verbose output.\n"
        " --version                     Print version number.\n"
-		"\n");
+	   "\n"
+    );
 }
 
 static void display_fatal_err(const string &msg)
@@ -186,7 +183,7 @@ static void display_fatal_err(const string &msg)
 	 * If stderr logging is not enabled, also log to stderr. When
 	 * daemonized this will simply write to /dev/null.
 	 */
-	if(!falco_logger::log_stderr)
+	if (! falco_logger::log_stderr)
 	{
 		std::cerr << msg;
 	}
@@ -238,8 +235,9 @@ static std::string read_file(std::string filename)
 //
 // Event processing loop
 //
-uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
+uint64_t do_inspect(falco_engine *engine,
-		    sinsp *inspector,
+			falco_outputs *outputs,
+			sinsp* inspector,
 			falco_configuration &config,
 			syscall_evt_drop_mgr &sdropmgr,
 			uint64_t duration_to_tot_ns,
@@ -248,10 +246,9 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 			bool all_events,
 			int &result)
 {
-
 	uint64_t num_evts = 0;
 	int32_t rc;
-	sinsp_evt *ev;
+	sinsp_evt* ev;
 	StatsFileWriter writer;
 	uint64_t duration_start = 0;
 
@@ -262,31 +259,22 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 		      config.m_syscall_evt_drop_max_burst,
 		      config.m_syscall_evt_simulate_drops);
 
-	if(stats_filename != "")
+	if (stats_filename != "")
 	{
 		string errstr;
 
-		if(!writer.init(inspector, stats_filename, stats_interval, errstr))
+		if (!writer.init(inspector, stats_filename, stats_interval, errstr))
 		{
 			throw falco_exception(errstr);
 		}
 	}
 
-	{
-		// wait for the first engine to be ready
-		std::unique_lock<std::mutex> lk(engine_ready);
-		engine_cv.wait(lk, [] { return is_engine_ready; });
-	}
-
 	//
 	// Loop through the events
 	//
-	std::atomic<falco_engine *> e;
-	falco_engine *engine_to_use = nullptr;
-
-	e.compare_exchange_strong(engine_to_use, *engine);
 	while(1)
 	{
+
 		rc = inspector->next(&ev);
 
 		writer.handle();
@@ -302,7 +290,7 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 			falco_logger::log(LOG_INFO, "SIGINT received, exiting...\n");
 			break;
 		}
-		else if(g_restart)
+		else if (g_restart)
 		{
 			falco_logger::log(LOG_INFO, "SIGHUP received, restarting...\n");
 			break;
@@ -325,11 +313,10 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 			throw sinsp_exception(inspector->getlasterr().c_str());
 		}
 
-		if(duration_start == 0)
+		if (duration_start == 0)
 		{
 			duration_start = ev->get_ts();
-		}
+		} else if(duration_to_tot_ns > 0)
-		else if(duration_to_tot_ns > 0)
 		{
 			if(ev->get_ts() - duration_start >= duration_to_tot_ns)
 			{
@@ -349,16 +336,11 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 		}
 
 		// As the inspector has no filter at its level, all
-		// events are returned here. Pass them to the Falco
+		// events are returned here. Pass them to the falco
 		// engine, which will match the event against the set
 		// of rules. If a match is found, pass the event to
 		// the outputs.
-		bool engine_cmp_res = e.compare_exchange_strong(engine_to_use, *engine);
+		unique_ptr<falco_engine::rule_result> res = engine->process_sinsp_event(ev);
-		if(engine_cmp_res == false)
-		{
-			falco_logger::log(LOG_INFO, "Using new engine with new ruleset\n");
-		}
-		unique_ptr<falco_engine::rule_result> res = e.load()->process_sinsp_event(ev);
 		if(res)
 		{
 			outputs->handle_event(res->evt, res->rule, res->source, res->priority_num, res->format);
@@ -372,9 +354,9 @@ uint64_t do_inspect(falco_engine **engine, falco_outputs *outputs,
 
 static void print_all_ignored_events(sinsp *inspector)
 {
-	sinsp_evttables *einfo = inspector->get_event_info_tables();
+	sinsp_evttables* einfo = inspector->get_event_info_tables();
-	const struct ppm_event_info *etable = einfo->m_event_info;
+	const struct ppm_event_info* etable = einfo->m_event_info;
-	const struct ppm_syscall_desc *stable = einfo->m_syscall_info_table;
+	const struct ppm_syscall_desc* stable = einfo->m_syscall_info_table;
 
 	std::set<string> ignored_event_names;
 	for(uint32_t j = 0; j < PPM_EVENT_MAX; j++)
@@ -428,34 +410,15 @@ static void list_source_fields(falco_engine *engine, bool verbose, bool names_on
 	}
 }
 
-static void rules_cb(char *rules_content, hawk_engine *engine)
-{
-	falco_engine *engine_replacement = (*reinterpret_cast<falco_engine **>(engine))->clone();
-	engine_replacement->load_rules(rules_content, false, true);
-
-	*engine = std::ref(engine_replacement);
-
-	// This mutex is only needed for the first synchronization
-	// it can be discarded the second time rules_cb is needed
-	// since the main engine loop is already started.
-	if(!is_engine_ready)
-	{
-		std::lock_guard<std::mutex> lk(engine_ready);
-		is_engine_ready = true;
-		engine_cv.notify_all();
-	}
-}
-
 //
 // ARGUMENT PARSING AND PROGRAM SETUP
 //
 int falco_init(int argc, char **argv)
 {
 	int result = EXIT_SUCCESS;
-	sinsp *inspector = NULL;
+	sinsp* inspector = NULL;
 	sinsp_evt::param_fmt event_buffer_format = sinsp_evt::PF_NORMAL;
-	falco_engine *engine_blueprint;
+	falco_engine *engine = NULL;
-	std::thread watchrules_thread;
 	falco_outputs *outputs = NULL;
 	syscall_evt_drop_mgr sdropmgr;
 	int op;
@@ -476,9 +439,9 @@ int falco_init(int argc, char **argv)
 	bool names_only = false;
 	bool all_events = false;
 #ifndef MINIMAL_BUILD
-	string *k8s_api = 0;
+	string* k8s_api = 0;
-	string *k8s_api_cert = 0;
+	string* k8s_api_cert = 0;
-	string *mesos_api = 0;
+	string* mesos_api = 0;
 #endif
 	string output_format = "";
 	uint32_t snaplen = 0;
@@ -503,7 +466,7 @@ int falco_init(int argc, char **argv)
 	bool compress = false;
 	bool buffered_outputs = true;
 	bool buffered_cmdline = false;
-	std::map<string, uint64_t> required_engine_versions;
+	std::map<string,uint64_t> required_engine_versions;
 
 	// Used for stats
 	double duration;
@@ -555,7 +518,7 @@ int falco_init(int argc, char **argv)
 		// Parse the args
 		//
 		while((op = getopt_long(argc, argv,
-					"hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:S:s:T:t:UuvV:w:",
+                                        "hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:r:S:s:T:t:UuvV:w:",
                                         long_options, &long_index)) != -1)
 		{
 			switch(op)
@@ -649,6 +612,9 @@ int falco_init(int argc, char **argv)
 					replace_container_info = false;
 				}
 				break;
+			case 'r':
+				falco_configuration::read_rules_file_directory(string(optarg), rules_filenames);
+				break;
 			case 'S':
 				snaplen = atoi(optarg);
 				break;
@@ -688,18 +654,18 @@ int falco_init(int argc, char **argv)
 					printf("Driver version: %s\n", DRIVER_VERSION);
 					return EXIT_SUCCESS;
 				}
-				else if(string(long_options[long_index].name) == "cri")
+				else if (string(long_options[long_index].name) == "cri")
 				{
 					if(optarg != NULL)
 					{
 						cri_socket_path = optarg;
 					}
 				}
-				else if(string(long_options[long_index].name) == "disable-cri-async")
+				else if (string(long_options[long_index].name) == "disable-cri-async")
 				{
 				  cri_async = false;
 				}
-				else if(string(long_options[long_index].name) == "list")
+				else if (string(long_options[long_index].name) == "list")
 				{
 					list_flds = true;
 					if(optarg != NULL)
@@ -707,28 +673,27 @@ int falco_init(int argc, char **argv)
 						list_flds_source = optarg;
 					}
 				}
-				else if(string(long_options[long_index].name) == "stats-interval")
+				else if (string(long_options[long_index].name) == "stats-interval")
 				{
 					stats_interval = atoi(optarg);
 				}
-				else if(string(long_options[long_index].name) == "support")
+				else if (string(long_options[long_index].name) == "support")
 				{
 					print_support = true;
 				}
-				else if(string(long_options[long_index].name) == "disable-source")
+				else if (string(long_options[long_index].name) == "disable-source")
 				{
 					if(optarg != NULL)
 					{
 						disable_sources.insert(optarg);
 					}
 				}
-				else if(string(long_options[long_index].name) == "alternate-lua-dir")
+				else if (string(long_options[long_index].name)== "alternate-lua-dir")
 				{
 					if(optarg != NULL)
 					{
 						alternate_lua_dir = optarg;
-						if(alternate_lua_dir.back() != '/')
+						if (alternate_lua_dir.back() != '/') {
-						{
 							alternate_lua_dir += '/';
 						}
 					}
@@ -738,6 +703,7 @@ int falco_init(int argc, char **argv)
 			default:
 				break;
 			}
+
 		}
 
 		inspector = new sinsp();
@@ -767,15 +733,15 @@ int falco_init(int argc, char **argv)
 			return EXIT_SUCCESS;
 		}
 
-		engine_blueprint = new falco_engine(true, alternate_lua_dir);
+		engine = new falco_engine(true, alternate_lua_dir);
-		engine_blueprint->set_inspector(inspector);
+		engine->set_inspector(inspector);
-		engine_blueprint->set_extra(output_format, replace_container_info);
+		engine->set_extra(output_format, replace_container_info);
 
-		// if(list_flds)
+		if(list_flds)
-		// {
+		{
-		// 	list_source_fields(engine, verbose, names_only, list_flds_source);
+			list_source_fields(engine, verbose, names_only, list_flds_source);
-		// 	return EXIT_SUCCESS;
+			return EXIT_SUCCESS;
-		// }
+		}
 
 		if(disable_sources.size() > 0)
 		{
@@ -791,8 +757,7 @@ int falco_init(int argc, char **argv)
 			}
 			disable_syscall = disable_sources.count("syscall") > 0;
 			disable_k8s_audit = disable_sources.count("k8s_audit") > 0;
-			if(disable_syscall && disable_k8s_audit)
+			if (disable_syscall && disable_k8s_audit) {
-			{
 				throw std::invalid_argument("The event source \"syscall\" and \"k8s_audit\" can not be disabled together");
 			}
 		}
@@ -800,16 +765,15 @@ int falco_init(int argc, char **argv)
 		outputs = new falco_outputs();
 
 		// Some combinations of arguments are not allowed.
-		if(daemon && pidfilename == "")
+		if (daemon && pidfilename == "") {
-		{
 			throw std::invalid_argument("If -d is provided, a pid file must also be provided");
 		}
 
 		ifstream conf_stream;
-		if(conf_filename.size())
+		if (conf_filename.size())
 		{
 			conf_stream.open(conf_filename);
-			if(!conf_stream.is_open())
+			if (!conf_stream.is_open())
 			{
 				throw std::runtime_error("Could not find configuration file at " + conf_filename);
 			}
@@ -817,14 +781,14 @@ int falco_init(int argc, char **argv)
 		else
 		{
 			conf_stream.open(FALCO_SOURCE_CONF_FILE);
-			if(conf_stream.is_open())
+			if (conf_stream.is_open())
 			{
 				conf_filename = FALCO_SOURCE_CONF_FILE;
 			}
 			else
 			{
 				conf_stream.open(FALCO_INSTALL_CONF_FILE);
-				if(conf_stream.is_open())
+				if (conf_stream.is_open())
 				{
 					conf_filename = FALCO_INSTALL_CONF_FILE;
 				}
@@ -835,35 +799,33 @@ int falco_init(int argc, char **argv)
 			}
 		}
 
-		// validate the rules files and exit
+		if(validate_rules_filenames.size() > 0)
-		// if(validate_rules_filenames.size() > 0)
+		{
-		// {
+			falco_logger::log(LOG_INFO, "Validating rules file(s):\n");
-		// 	falco_logger::log(LOG_INFO, "Validating rules file(s):\n");
+			for(auto file : validate_rules_filenames)
-		// 	for(auto file : validate_rules_filenames)
+			{
-		// 	{
+				falco_logger::log(LOG_INFO, "   " + file + "\n");
-		// 		falco_logger::log(LOG_INFO, "   " + file + "\n");
+			}
-		// 	}
+			for(auto file : validate_rules_filenames)
-		// 	for(auto file : validate_rules_filenames)
+			{
-		// 	{
+				// Only include the prefix if there is more than one file
-		// 		// Only include the prefix if there is more than one file
+				std::string prefix = (validate_rules_filenames.size() > 1 ? file + ": " : "");
-		// 		std::string prefix = (validate_rules_filenames.size() > 1 ? file + ": " : "");
+				try {
-		// 		try
+					engine->load_rules_file(file, verbose, all_events);
-		// 		{
+				}
-		// 			engine->load_rules_file(file, verbose, all_events);
+				catch(falco_exception &e)
-		// 		}
+				{
-		// 		catch(falco_exception &e)
+					printf("%s%s\n", prefix.c_str(), e.what());
-		// 		{
+					throw;
-		// 			printf("%s%s\n", prefix.c_str(), e.what());
+				}
-		// 			throw;
+				printf("%sOk\n", prefix.c_str());
-		// 		}
+			}
-		// 		printf("%sOk\n", prefix.c_str());
+			falco_logger::log(LOG_INFO, "Ok\n");
-		// 	}
+			goto exit;
-		// 	falco_logger::log(LOG_INFO, "Ok\n");
+		}
-		// 	goto exit;
-		// }
 
 		falco_configuration config;
-		if(conf_filename.size())
+		if (conf_filename.size())
 		{
 			config.init(conf_filename, cmdline_options);
 			falco_logger::set_time_format_iso_8601(config.m_time_format_iso_8601);
@@ -882,55 +844,71 @@ int falco_init(int argc, char **argv)
 			falco_logger::log(LOG_INFO, "Falco initialized. No configuration file found, proceeding with defaults\n");
 		}
 
-		engine_blueprint->set_min_priority(config.m_min_priority);
+		if (rules_filenames.size())
+		{
+			config.m_rules_filenames = rules_filenames;
+		}
+
+		engine->set_min_priority(config.m_min_priority);
 
 		if(buffered_cmdline)
 		{
 			config.m_buffered_outputs = buffered_outputs;
 		}
 
-		hawk_init();
+		if(config.m_rules_filenames.size() == 0)
-		watchrules_thread = std::thread([&] {
+		{
-			// todo: pass verbose, and all_events
+			throw std::invalid_argument("You must specify at least one rules file/directory via -r or a rules_file entry in falco.yaml");
-			hawk_watch_rules((hawk_watch_rules_cb)rules_cb, reinterpret_cast<hawk_engine *>(&engine_blueprint));
+		}
-		});
 
-		// todo(fntlnz): make this a callback to watch_rules?
+		falco_logger::log(LOG_DEBUG, "Configured rules filenames:\n");
-		// This needs to be done for every load
+		for (auto filename : config.m_rules_filenames)
-		//
+		{
-		// // You can't both disable and enable rules
+			falco_logger::log(LOG_DEBUG, string("   ") + filename + "\n");
-		// if((disabled_rule_substrings.size() + disabled_rule_tags.size() > 0) &&
+		}
-		//     enabled_rule_tags.size() > 0) {
-		// 	throw std::invalid_argument("You can not specify both disabled (-D/-T) and enabled (-t) rules");
-		// }
 
-		// for (auto substring : disabled_rule_substrings)
+		for (auto filename : config.m_rules_filenames)
-		// {
+		{
-		// 	falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");
+			falco_logger::log(LOG_INFO, "Loading rules from file " + filename + ":\n");
-		// 	engine->enable_rule(substring, false);
+			uint64_t required_engine_version;
-		// }
 
-		// if(disabled_rule_tags.size() > 0)
+			engine->load_rules_file(filename, verbose, all_events, required_engine_version);
-		// {
+			required_engine_versions[filename] = required_engine_version;
-		// 	for(auto tag : disabled_rule_tags)
+		}
-		// 	{
-		// 		falco_logger::log(LOG_INFO, "Disabling rules with tag: " + tag + "\n");
-		// 	}
-		// 	engine->enable_rule_by_tag(disabled_rule_tags, false);
-		// }
 
-		// if(enabled_rule_tags.size() > 0)
+		// You can't both disable and enable rules
-		// {
+		if((disabled_rule_substrings.size() + disabled_rule_tags.size() > 0) &&
+		    enabled_rule_tags.size() > 0) {
+			throw std::invalid_argument("You can not specify both disabled (-D/-T) and enabled (-t) rules");
+		}
 
-		// 	// Since we only want to enable specific
+		for (auto substring : disabled_rule_substrings)
-		// 	// rules, first disable all rules.
+		{
-		// 	engine->enable_rule(all_rules, false);
+			falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");
-		// 	for(auto tag : enabled_rule_tags)
+			engine->enable_rule(substring, false);
-		// 	{
+		}
-		// 		falco_logger::log(LOG_INFO, "Enabling rules with tag: " + tag + "\n");
+
-		// 	}
+		if(disabled_rule_tags.size() > 0)
-		// 	engine->enable_rule_by_tag(enabled_rule_tags, true);
+		{
-		// }
+			for(auto tag : disabled_rule_tags)
+			{
+				falco_logger::log(LOG_INFO, "Disabling rules with tag: " + tag + "\n");
+			}
+			engine->enable_rule_by_tag(disabled_rule_tags, false);
+		}
+
+		if(enabled_rule_tags.size() > 0)
+		{
+
+			// Since we only want to enable specific
+			// rules, first disable all rules.
+			engine->enable_rule(all_rules, false);
+			for(auto tag : enabled_rule_tags)
+			{
+				falco_logger::log(LOG_INFO, "Enabling rules with tag: " + tag + "\n");
+			}
+			engine->enable_rule_by_tag(enabled_rule_tags, true);
+		}
 
 		if(print_support)
 		{
@@ -960,14 +938,24 @@ int falco_init(int argc, char **argv)
 			support["system_info"]["machine"] = sysinfo.machine;
 			support["cmdline"] = cmdline;
 			support["config"] = read_file(conf_filename);
-			support["rules_source"] = "external"; // todo(fntlnz): do we want to let libhawk pass an identifier and maybe more dump info for this?
+			support["rules_files"] = nlohmann::json::array();
+			for(auto filename : config.m_rules_filenames)
+			{
+				nlohmann::json finfo;
+				finfo["name"] = filename;
+				nlohmann::json variant;
+				variant["required_engine_version"] = required_engine_versions[filename];
+				variant["content"] = read_file(filename);
+				finfo["variants"].push_back(variant);
+				support["rules_files"].push_back(finfo);
+			}
 			printf("%s\n", support.dump().c_str());
 			goto exit;
 		}
 
 		// read hostname
 		string hostname;
-		if(char *env_hostname = getenv("FALCO_GRPC_HOSTNAME"))
+		if(char* env_hostname = getenv("FALCO_GRPC_HOSTNAME"))
 		{
 			hostname = env_hostname;
 		}
@@ -994,15 +982,15 @@ int falco_init(int argc, char **argv)
 			inspector->set_drop_event_flags(EF_DROP_SIMPLE_CONS);
 		}
 
-		if(describe_all_rules)
+		if (describe_all_rules)
 		{
-			// engine->describe_rule(NULL);
+			engine->describe_rule(NULL);
 			goto exit;
 		}
 
-		if(describe_rule != "")
+		if (describe_rule != "")
 		{
-			// engine->describe_rule(&describe_rule);
+			engine->describe_rule(&describe_rule);
 			goto exit;
 		}
 
@@ -1043,25 +1031,21 @@ int falco_init(int argc, char **argv)
 
 		// If daemonizing, do it here so any init errors will
 		// be returned in the foreground process.
-		if(daemon && !g_daemonized)
+		if (daemon && !g_daemonized) {
-		{
 			pid_t pid, sid;
 
 			pid = fork();
-			if(pid < 0)
+			if (pid < 0) {
-			{
 				// error
 				falco_logger::log(LOG_ERR, "Could not fork. Exiting.\n");
 				result = EXIT_FAILURE;
 				goto exit;
-			}
+			} else if (pid > 0) {
-			else if(pid > 0)
-			{
 				// parent. Write child pid to pidfile and exit
 				std::ofstream pidfile;
 				pidfile.open(pidfilename);
 
-				if(!pidfile.good())
+				if (!pidfile.good())
 				{
 					falco_logger::log(LOG_ERR, "Could not write pid to pid file " + pidfilename + ". Exiting.\n");
 					result = EXIT_FAILURE;
@@ -1075,8 +1059,7 @@ int falco_init(int argc, char **argv)
 
 			// Become own process group.
 			sid = setsid();
-			if(sid < 0)
+			if (sid < 0) {
-			{
 				falco_logger::log(LOG_ERR, "Could not set session id. Exiting.\n");
 				result = EXIT_FAILURE;
 				goto exit;
@@ -1086,8 +1069,7 @@ int falco_init(int argc, char **argv)
 			umask(027);
 
 			// Change working directory to '/'
-			if((chdir("/")) < 0)
+			if ((chdir("/")) < 0) {
-			{
 				falco_logger::log(LOG_ERR, "Could not change working directory to '/'. Exiting.\n");
 				result = EXIT_FAILURE;
 				goto exit;
@@ -1108,15 +1090,14 @@ int falco_init(int argc, char **argv)
 		{
 			// Try to open the trace file as a sysdig
 			// capture file first.
-			try
+			try {
-			{
 				inspector->open(trace_filename);
 				falco_logger::log(LOG_INFO, "Reading system call events from file: " + trace_filename + "\n");
 			}
 			catch(sinsp_exception &e)
 			{
 				falco_logger::log(LOG_DEBUG, "Could not read trace file \"" + trace_filename + "\": " + string(e.what()));
-				trace_is_scap = false;
+				trace_is_scap=false;
 			}
 
 			if(!trace_is_scap)
@@ -1127,8 +1108,7 @@ int falco_init(int argc, char **argv)
 				result = EXIT_FAILURE;
 				goto exit;
 #else
-				try
+				try {
-				{
 					string line;
 					nlohmann::json j;
 
@@ -1140,13 +1120,13 @@ int falco_init(int argc, char **argv)
 
 					falco_logger::log(LOG_INFO, "Reading k8s audit events from file: " + trace_filename + "\n");
 				}
-				catch(nlohmann::json::parse_error &e)
+				catch (nlohmann::json::parse_error& e)
 				{
 					fprintf(stderr, "Trace filename %s not recognized as system call events or k8s audit events\n", trace_filename.c_str());
 					result = EXIT_FAILURE;
 					goto exit;
 				}
-				catch(exception &e)
+				catch (exception &e)
 				{
 					fprintf(stderr, "Could not open trace filename %s for reading: %s\n", trace_filename.c_str(), e.what());
 					result = EXIT_FAILURE;
@@ -1157,7 +1137,8 @@ int falco_init(int argc, char **argv)
 		}
 		else
 		{
-			open_t open_cb = [&userspace](sinsp *inspector) {
+			open_t open_cb = [&userspace](sinsp* inspector)
+			{
 				if(userspace)
 				{
 					// open_udig() is the underlying method used in the capture code to parse userspace events from the kernel.
@@ -1169,22 +1150,19 @@ int falco_init(int argc, char **argv)
 				}
 				inspector->open();
 			};
-			open_t open_nodriver_cb = [](sinsp *inspector) {
+			open_t open_nodriver_cb = [](sinsp* inspector) {
 				inspector->open_nodriver();
 			};
 			open_t open_f;
 
 			// Default mode: both event sources enabled
-			if(!disable_syscall && !disable_k8s_audit)
+			if (!disable_syscall && !disable_k8s_audit) {
-			{
 				open_f = open_cb;
 			}
-			if(disable_syscall)
+			if (disable_syscall) {
-			{
 				open_f = open_nodriver_cb;
 			}
-			if(disable_k8s_audit)
+			if (disable_k8s_audit) {
-			{
 				open_f = open_cb;
 			}
 
@@ -1195,7 +1173,7 @@ int falco_init(int argc, char **argv)
 			catch(sinsp_exception &e)
 			{
 				// If syscall input source is enabled and not through userspace instrumentation
-				if(!disable_syscall && !userspace)
+				if (!disable_syscall && !userspace)
 				{
 					// Try to insert the Falco kernel module
 					if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
@@ -1233,7 +1211,7 @@ int falco_init(int argc, char **argv)
 		{
 			if(!k8s_api_cert)
 			{
-				if(char *k8s_cert_env = getenv("FALCO_K8S_API_CERT"))
+				if(char* k8s_cert_env = getenv("FALCO_K8S_API_CERT"))
 				{
 					k8s_api_cert = new string(k8s_cert_env);
 				}
@@ -1242,13 +1220,13 @@ int falco_init(int argc, char **argv)
 			k8s_api = 0;
 			k8s_api_cert = 0;
 		}
-		else if(char *k8s_api_env = getenv("FALCO_K8S_API"))
+		else if(char* k8s_api_env = getenv("FALCO_K8S_API"))
 		{
 			if(k8s_api_env != NULL)
 			{
 				if(!k8s_api_cert)
 				{
-					if(char *k8s_cert_env = getenv("FALCO_K8S_API_CERT"))
+					if(char* k8s_cert_env = getenv("FALCO_K8S_API_CERT"))
 					{
 						k8s_api_cert = new string(k8s_cert_env);
 					}
@@ -1272,7 +1250,7 @@ int falco_init(int argc, char **argv)
 		{
 			inspector->init_mesos_client(mesos_api, verbose);
 		}
-		else if(char *mesos_api_env = getenv("FALCO_MESOS_API"))
+		else if(char* mesos_api_env = getenv("FALCO_MESOS_API"))
 		{
 			if(mesos_api_env != NULL)
 			{
@@ -1285,10 +1263,10 @@ int falco_init(int argc, char **argv)
 
 		if(trace_filename.empty() && config.m_webserver_enabled && !disable_k8s_audit)
 		{
-			// std::string ssl_option = (config.m_webserver_ssl_enabled ? " (SSL)" : "");
+			std::string ssl_option = (config.m_webserver_ssl_enabled ? " (SSL)" : "");
-			// falco_logger::log(LOG_INFO, "Starting internal webserver, listening on port " + to_string(config.m_webserver_listen_port) + ssl_option + "\n");
+			falco_logger::log(LOG_INFO, "Starting internal webserver, listening on port " + to_string(config.m_webserver_listen_port) + ssl_option + "\n");
-			// webserver.init(&config, engine_future.get().get(), outputs);
+			webserver.init(&config, engine, outputs);
-			// webserver.start();
+			webserver.start();
 		}
 
 		// gRPC server
@@ -1303,7 +1281,8 @@ int falco_init(int argc, char **argv)
 				config.m_grpc_private_key,
 				config.m_grpc_cert_chain,
 				config.m_grpc_root_certs,
-				config.m_log_level);
+				config.m_log_level
+			);
 			grpc_server_thread = std::thread([&grpc_server] {
 				grpc_server.run();
 			});
@@ -1313,20 +1292,21 @@ int falco_init(int argc, char **argv)
 		if(!trace_filename.empty() && !trace_is_scap)
 		{
 #ifndef MINIMAL_BUILD			
-			// read_k8s_audit_trace_file(engine.get(),
+			read_k8s_audit_trace_file(engine,
-			// 			  outputs,
+						  outputs,
-			// 			  trace_filename);
+						  trace_filename);
 #endif
 		}
 		else
 		{
 			uint64_t num_evts;
 
-			num_evts = do_inspect(&engine_blueprint, outputs,
+			num_evts = do_inspect(engine,
+					      outputs,
 					      inspector,
 					      config,
 					      sdropmgr,
-					      uint64_t(duration_to_tot * ONE_SECOND_IN_NS),
+					      uint64_t(duration_to_tot*ONE_SECOND_IN_NS),
 					      stats_filename,
 					      stats_interval,
 					      all_events,
@@ -1347,24 +1327,20 @@ int falco_init(int argc, char **argv)
 					num_evts,
 					num_evts / duration);
 			}
+
 		}
 
 		// Honor -M also when using a trace file.
 		// Since inspection stops as soon as all events have been consumed
 		// just await the given duration is reached, if needed.
-		if(!trace_filename.empty() && duration_to_tot > 0)
+		if(!trace_filename.empty() && duration_to_tot>0)
 		{
 			std::this_thread::sleep_for(std::chrono::seconds(duration_to_tot));
 		}
 
 		inspector->close();
-		// engine->print_stats();
+		engine->print_stats();
 		sdropmgr.print_stats();
-		if(watchrules_thread.joinable())
-		{
-			hawk_destroy();
-			watchrules_thread.join();
-		}
 #ifndef MINIMAL_BUILD
 		webserver.stop();
 		if(grpc_server_thread.joinable())
@@ -1380,11 +1356,6 @@ int falco_init(int argc, char **argv)
 
 		result = EXIT_FAILURE;
 
-		if(watchrules_thread.joinable())
-		{
-			hawk_destroy();
-			watchrules_thread.join();
-		}
 #ifndef MINIMAL_BUILD
 		webserver.stop();
 		if(grpc_server_thread.joinable())
@@ -1398,7 +1369,7 @@ int falco_init(int argc, char **argv)
 exit:
 
 	delete inspector;
-	delete engine_blueprint;
+	delete engine;
 	delete outputs;
 
 	return result;

userspace/libhawk/hawk.h

@@ -1,10 +0,0 @@
-#ifndef HAWK_H
-#define HAWK_H
-extern void hawk_init();
-extern void hawk_destroy();
-
-typedef void* hawk_engine;
-typedef void (*hawk_watch_rules_cb)(char* rules_content, hawk_engine* engine);
-extern void hawk_watch_rules(hawk_watch_rules_cb cb, hawk_engine* engine);
-
-#endif //HAWK_H