adding changes for laptop

feat(debug): More debug for testing in GKE
Signed-off-by: Kris Nova <kris@nivenly.com>
2026-03-20 19:52:08 +00:00 · 2020-06-16 11:17:16 -07:00 · 2020-06-10 21:26:06 -07:00 · 2020-06-10 19:06:24 -07:00
129 changed files with 2298 additions and 4552 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,85 +1,5 @@
 version: 2
 jobs:
-  # Build a statically linked Falco release binary using musl
-  # This build is 100% static, there are no host dependencies
-  "build/musl":
-    docker:
-      - image: alpine:3.12
-    steps:
-      - checkout:
-          path: /source-static/falco
-      - run:
-          name: Update base image
-          command: apk update
-      - run:
-          name: Install build dependencies
-          command: apk add g++ gcc cmake cmake make ncurses-dev git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static patch binutils
-      - run:
-          name: Prepare project
-          command: |
-            mkdir -p /build-static/release
-            cd /build-static/release
-            cmake -DCPACK_GENERATOR=TGZ -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DMUSL_OPTIMIZED_BUILD=On -DFALCO_ETC_DIR=/etc/falco /source-static/falco
-      - run:
-          name: Build
-          command: |
-            cd /build-static/release
-            make -j4 all
-      - run:
-          name: Package
-          command: |
-            cd /build-static/release
-            make -j4 package
-      - run:
-          name: Run unit tests
-          command: |
-            cd /build-static/release
-            make tests
-      - run:
-          name: Prepare artifacts
-          command: |
-            mkdir -p /tmp/packages
-            cp /build-static/release/*.tar.gz /tmp/packages
-      - store_artifacts:
-          path: /tmp/packages
-          destination: /packages
-      - persist_to_workspace:
-          root: /
-          paths:
-            - build-static/release
-            - source-static
-  # Build the minimal Falco
-  # This build only contains the Falco engine and the basic input/output.
-  "build/minimal":
-    docker:
-      - image: ubuntu:focal
-    steps:
-      - checkout
-      - run:
-          name: Update base image
-          command: apt update -y
-      - run:
-          name: Install dependencies
-          command: DEBIAN_FRONTEND=noninteractive apt install libjq-dev libncurses-dev libyaml-cpp-dev libelf-dev cmake build-essential git -y
-      - run:
-          name: Prepare project
-          command: |
-            mkdir build-minimal
-            pushd build-minimal
-            cmake -DMINIMAL_BUILD=On -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release ..
-            popd
-      - run:
-          name: Build
-          command: |
-            pushd build-minimal
-            make -j4 all
-            popd
-      - run:
-          name: Run unit tests
-          command: |
-            pushd build-minimal
-            make tests
-            popd
  # Build using ubuntu LTS
  # This build is dynamic, most dependencies are taken from the OS
  "build/ubuntu-focal":
@@ -144,72 +64,8 @@ jobs:
            pushd build
            make tests
            popd
-  # Build using Ubuntu Bionic Beaver (18.04)
-  # This build is static, dependencies are bundled in the Falco binary
-  "build/ubuntu-bionic":
-    docker:
-      - image: ubuntu:bionic
-    steps:
-      - checkout
-      - run:
-          name: Update base image
-          command: apt update -y
-      - run:
-          name: Install dependencies
-          command: DEBIAN_FRONTEND=noninteractive apt install cmake build-essential clang llvm git linux-headers-generic libncurses-dev pkg-config autoconf libtool libelf-dev -y
-      - run:
-          name: Prepare project
-          command: |
-            mkdir build
-            pushd build
-            cmake -DBUILD_BPF=On -DUSE_BUNDLED_DEPS=On ..
-            popd
-      - run:
-          name: Build
-          command: |
-            pushd build
-            KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
-            popd
-      - run:
-          name: Run unit tests
-          command: |
-            pushd build
-            make tests
-            popd
-  # Build using CentOS 8
-  # This build is static, dependencies are bundled in the Falco binary
-  "build/centos8":
-    docker:
-      - image: centos:8
-    steps:
-      - checkout
-      - run:
-          name: Update base image
-          command: dnf update -y
-      - run:
-          name: Install dependencies
-          command: dnf install gcc gcc-c++ git make cmake autoconf automake pkg-config patch ncurses-devel libtool elfutils-libelf-devel diffutils kernel-devel kernel-headers kernel-core clang llvm which -y
-      - run:
-          name: Prepare project
-          command: |
-            mkdir build
-            pushd build
-            cmake -DBUILD_BPF=On -DUSE_BUNDLED_DEPS=On ..
-            popd
-      - run:
-          name: Build
-          command: |
-            pushd build
-            KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
-            popd
-      - run:
-          name: Run unit tests
-          command: |
-            pushd build
-            make tests
-            popd
  # Build using our own builder base image using centos 7
-  # This build is static, dependencies are bundled in the Falco binary
+  # This build is static, dependencies are bundled in the falco binary
  "build/centos7":
    docker:
      - image: falcosecurity/falco-builder:latest
@@ -246,7 +102,7 @@ jobs:
          path: /tmp/packages
          destination: /packages
  # Debug build using our own builder base image using centos 7
-  # This build is static, dependencies are bundled in the Falco binary
+  # This build is static, dependencies are bundled in the falco binary
  "build/centos7-debug":
    docker:
      - image: falcosecurity/falco-builder:latest
@@ -282,25 +138,6 @@ jobs:
      - run:
          name: Execute integration tests
          command: /usr/bin/entrypoint test
-      - store_test_results:
-          path: /build/release/integration-tests-xunit
-  "tests/integration-static":
-    docker:
-      - image: falcosecurity/falco-tester:latest
-        environment:
-          SOURCE_DIR: "/source-static"
-          BUILD_DIR: "/build-static"
-          BUILD_TYPE: "release"
-          SKIP_PACKAGES_TESTS: "true"
-    steps:
-      - setup_remote_docker
-      - attach_workspace:
-          at: /
-      - run:
-          name: Execute integration tests
-          command: /usr/bin/entrypoint test
-      - store_test_results:
-          path: /build-static/release/integration-tests-xunit
  "tests/driver-loader/integration":
    machine:
      image: ubuntu-1604:202004-01
@@ -310,33 +147,6 @@ jobs:
      - run:
          name: Execute driver-loader integration tests
          command: /tmp/ws/source/falco/test/driver-loader/run_test.sh /tmp/ws/build/release/
-  # Code quality
-  "quality/static-analysis":
-    docker:
-      - image: falcosecurity/falco-builder:latest
-        environment:
-          BUILD_TYPE: "release"
-    steps:
-      - run:
-          name: Install cppcheck
-          command: |
-            yum update -y
-            yum install epel-release -y
-            yum install cppcheck cppcheck-htmlreport -y
-      - checkout:
-          path: /source/falco
-      - run:
-          name: Prepare project
-          command: /usr/bin/entrypoint cmake
-      - run:
-          name: cppcheck
-          command: /usr/bin/entrypoint cppcheck
-      - run:
-          name: cppcheck html report
-          command: /usr/bin/entrypoint cppcheck_htmlreport
-      - store_artifacts:
-          path: /build/release/static-analysis-reports
-          destination: /static-analysis-reports
  # Sign rpm packages
  "rpm/sign":
    docker:
@@ -393,34 +203,10 @@ jobs:
            FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
            jfrog bt u /build/release/falco-${FALCO_VERSION}-x86_64.rpm falcosecurity/rpm-dev/falco/${FALCO_VERSION} --user poiana --key ${BINTRAY_SECRET} --publish --override
      - run:
-          name: Publish bin-dev
+          name: Publish tgz-dev
          command: |
-            FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
-            jfrog bt u /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz falcosecurity/bin-dev/falco/${FALCO_VERSION} x86_64/ --user poiana --key ${BINTRAY_SECRET} --publish --override
-  # Clenup the Falco development release packages
-  "cleanup/packages-dev":
-    docker:
-      - image: docker.bintray.io/jfrog/jfrog-cli-go:latest
-    steps:
-      - checkout:
-          path: /source/falco
-      - run:
-          name: Prepare env
-          command: |
-            apk add --no-cache --update
-            apk add curl jq
-      - run:
-          name: Only keep the 10 most recent Falco development release tarballs
-          command: |
-            /source/falco/scripts/cleanup -p ${BINTRAY_SECRET} -r bin-dev
-      - run:
-          name: Only keep the 50 most recent Falco development release RPMs
-          command: |
-            /source/falco/scripts/cleanup -p ${BINTRAY_SECRET} -r rpm-dev
-      - run:
-          name: Only keep the 50 most recent Falco development release DEBs
-          command: |
-            /source/falco/scripts/cleanup -p ${BINTRAY_SECRET} -r deb-dev
+            FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
+            jfrog bt u /build/release/falco-${FALCO_VERSION}-x86_64.tar.gz falcosecurity/bin-dev/falco/${FALCO_VERSION} x86_64/ --user poiana --key ${BINTRAY_SECRET} --publish --override
  # Publish docker packages
  "publish/docker-dev":
    docker:
@@ -477,10 +263,10 @@ jobs:
            FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
            jfrog bt u /build/release/falco-${FALCO_VERSION}-x86_64.rpm falcosecurity/rpm/falco/${FALCO_VERSION} --user poiana --key ${BINTRAY_SECRET} --publish --override
      - run:
-          name: Publish bin
+          name: Publish tgz
          command: |
-            FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
-            jfrog bt u /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz falcosecurity/bin/falco/${FALCO_VERSION} x86_64/ --user poiana --key ${BINTRAY_SECRET} --publish --override
+            FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
+            jfrog bt u /build/release/falco-${FALCO_VERSION}-x86_64.tar.gz falcosecurity/bin/falco/${FALCO_VERSION} x86_64/ --user poiana --key ${BINTRAY_SECRET} --publish --override
  # Publish docker packages
  "publish/docker":
    docker:
@@ -522,20 +308,13 @@ workflows:
  version: 2
  build_and_test:
    jobs:
-      - "build/musl"
-      - "build/minimal"
      - "build/ubuntu-focal"
      - "build/ubuntu-focal-debug"
-      - "build/ubuntu-bionic"
-      - "build/centos8"
      - "build/centos7"
      - "build/centos7-debug"
      - "tests/integration":
          requires:
            - "build/centos7"
-      - "tests/integration-static":
-          requires:
-            - "build/musl"
      - "tests/driver-loader/integration":
          requires:
            - "build/centos7"
@@ -557,16 +336,6 @@ workflows:
              only: master
          requires:
            - "rpm/sign"
-            - "tests/integration-static"
-      - "cleanup/packages-dev":
-          context: falco
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "publish/packages-dev"
      - "publish/docker-dev":
          context: falco
          filters:
@@ -577,15 +346,8 @@ workflows:
          requires:
            - "publish/packages-dev"
            - "tests/driver-loader/integration"
-      - "quality/static-analysis"
  release:
    jobs:
-      - "build/musl":
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
      - "build/centos7":
          filters:
            tags:
@@ -604,7 +366,6 @@ workflows:
      - "publish/packages":
          context: falco
          requires:
-            - "build/musl"
            - "rpm/sign"
          filters:
            tags:
--- a/.github/stale.yml
+++ b/.github/stale.yml
@@ -0,0 +1,19 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - cncf
+  - roadmap
+  - enhancement
+  - "help wanted"
+# Label to use when marking an issue as stale
+staleLabel: wontfix
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,8 @@ test/.phoronix-test-suite
 test/results*.json.*
 test/build

+userspace/falco/lua/re.lua
+userspace/falco/lua/lpeg.so
 userspace/engine/lua/lyaml
 userspace/engine/lua/lyaml.lua

--- a/.luacheckrc
+++ b/.luacheckrc
@@ -1,6 +1,7 @@
 std = "min"
 cache = true
 include_files = {
+    "userspace/falco/lua/*.lua",
    "userspace/engine/lua/*.lua",
    "userspace/engine/lua/lyaml/*.lua",
    "*.luacheckrc"
--- a/ADOPTERS.md
+++ b/ADOPTERS.md
@@ -8,13 +8,8 @@ This is a list of production adopters of Falco (in alphabetical order):

 * [Frame.io](https://frame.io/) - Frame.io is a cloud-based (SaaS) video review and collaboration platform that enables users to securely upload source media, work-in-progress edits, dailies, and more into private workspaces where they can invite their team and clients to collaborate on projects. Understanding what is running on production servers, and the context around why things are running is even more tricky now that we have further abstractions like Docker and Kubernetes. To get this needed visibility into our system, we rely on Falco. Falco's ability to collect raw system calls such as open, connect, exec, along with their arguments offer key insights on what is happening on the production system and became the foundation of our intrusion detection and alerting system.

-* [GitLab](https://about.gitlab.com/direction/defend/container_host_security/) - GitLab is a complete DevOps platform, delivered as a single application, fundamentally changing the way Development, Security, and Ops teams collaborate. GitLab Ultimate provides the single tool teams need to find, triage, and fix vulnerabilities in applications, services, and cloud-native environments enabling them to manage their risk. This provides them with repeatable, defensible processes that automate security and compliance policies. GitLab includes a tight integration with Falco, allowing users to defend their containerized applications from attacks while running in production.
-
 * [League](https://league.com/ca/) - League provides health benefits management services to help employees understand and get the most from their benefits, and employers to provide effective, efficient plans. Falco is used to monitor our deployed services on Kubernetes, protecting against malicious access to containerswhich could lead to leaks of PHI or other sensitive data. The Falco alerts are logged in Stackdriver for grouping and further analysis. In the future, we're hoping for integrations with Prometheus and AlertManager as well.

-* [Logz.io](https://logz.io/) - Logz.io is a cloud observability platform for modern engineering teams. The Logz.io platform consists of three products — Log Management, Infrastructure Monitoring, and Cloud SIEM — that work together to unify the jobs of monitoring, troubleshooting, and security. We empower engineers to deliver better software by offering the world's most popular open source observability tools — the ELK Stack, Grafana, and Jaeger — in a single, easy to use, and powerful platform purpose-built for monitoring distributed cloud environments. Cloud SIEM supports data from multiple sources, including Falco's alerts, and offers useful rules and dashboards content to visualize and manage incidents across your systems in a unified UI.
-  * https://logz.io/blog/k8s-security-with-falco-and-cloud-siem/
-
 * [Preferral](https://www.preferral.com) - Preferral is a HIPAA-compliant platform for Referral Management and Online Referral Forms. Preferral streamlines the referral process for patients, specialists and their referral partners. By automating the referral process, referring practices spend less time on the phone, manual efforts are eliminated, and patients get the right care from the right specialist. Preferral leverages Falco to provide a Host Intrusion Detection System to meet their HIPPA compliance requirements.
  * https://hipaa.preferral.com/01-preferral_hipaa_compliance/

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,210 +1,10 @@
 # Change Log

-## v0.26.2
-
-Released on 2020-11-10
-
-### Major Changes
-
-* update: DRIVERS_REPO now defaults to https://download.falco.org/driver [[#1460](https://github.com/falcosecurity/falco/pull/1460)] - [@leodido](https://github.com/leodido)
-
-## v0.26.1
-
-Released on 2020-10-01
-
-### Major Changes
-
-* new: CLI flag `--alternate-lua-dir` to load Lua files from arbitrary paths [[#1419](https://github.com/falcosecurity/falco/pull/1419)] - [@admiral0](https://github.com/admiral0)
-
-
-### Rule Changes
-
-* rule(Delete or rename shell history): fix warnings/FPs + container teardown [[#1423](https://github.com/falcosecurity/falco/pull/1423)] - [@mstemm](https://github.com/mstemm)
-* rule(Write below root): ensure proc_name_exists too [[#1423](https://github.com/falcosecurity/falco/pull/1423)] - [@mstemm](https://github.com/mstemm)
-
-
-## v0.26.0
-
-Released on 2020-24-09
-
-### Major Changes
-
-* new: address several sources of FPs, primarily from GKE environments. [[#1372](https://github.com/falcosecurity/falco/pull/1372)] - [@mstemm](https://github.com/mstemm)
-* new: driver updated to 2aa88dcf6243982697811df4c1b484bcbe9488a2 [[#1410](https://github.com/falcosecurity/falco/pull/1410)] - [@leogr](https://github.com/leogr)
-* new(scripts/falco-driver-loader): detect and try to build the Falco kernel module driver using different GCC versions available in the current environment. [[#1408](https://github.com/falcosecurity/falco/pull/1408)] - [@fntlnz](https://github.com/fntlnz)
-* new: tgz (tarball) containing the statically-linked (musl) binary of Falco is now automatically built and published on bintray [[#1377](https://github.com/falcosecurity/falco/pull/1377)] - [@leogr](https://github.com/leogr)
-
-
-### Minor Changes
-
-* update: bump Falco engine version to 7 [[#1381](https://github.com/falcosecurity/falco/pull/1381)] - [@leogr](https://github.com/leogr)
-* update: the required_engine_version is now on by default [[#1381](https://github.com/falcosecurity/falco/pull/1381)] - [@leogr](https://github.com/leogr)
-* update: falcosecurity/falco-no-driver image now uses the statically-linked Falco [[#1377](https://github.com/falcosecurity/falco/pull/1377)] - [@leogr](https://github.com/leogr)
-* docs(proposals): artifacts storage [[#1375](https://github.com/falcosecurity/falco/pull/1375)] - [@leodido](https://github.com/leodido)
-* docs(proposals): artifacts cleanup [[#1375](https://github.com/falcosecurity/falco/pull/1375)] - [@leodido](https://github.com/leodido)
-
-
-### Rule Changes
-
-* rule(macro inbound_outbound): add brackets to disambiguate operator precedence [[#1373](https://github.com/falcosecurity/falco/pull/1373)] - [@ldegio](https://github.com/ldegio)
-* rule(macro redis_writing_conf): add brackets to disambiguate operator precedence [[#1373](https://github.com/falcosecurity/falco/pull/1373)] - [@ldegio](https://github.com/ldegio)
-* rule(macro run_by_foreman): add brackets to disambiguate operator precedence [[#1373](https://github.com/falcosecurity/falco/pull/1373)] - [@ldegio](https://github.com/ldegio)
-* rule(macro consider_packet_socket_communication): enable "Packet socket created in container" rule by default. [[#1402](https://github.com/falcosecurity/falco/pull/1402)] - [@rung](https://github.com/rung)
-* rule(Delete or rename shell history): skip docker overlay filesystems when considering bash history [[#1393](https://github.com/falcosecurity/falco/pull/1393)] - [@mstemm](https://github.com/mstemm)
-* rule(Disallowed K8s User): quote colons in user names [[#1393](https://github.com/falcosecurity/falco/pull/1393)] - [@mstemm](https://github.com/mstemm)
-* rule(macro falco_sensitive_mount_containers): Adds a trailing slash to avoid repo naming issues [[#1394](https://github.com/falcosecurity/falco/pull/1394)] - [@bgeesaman](https://github.com/bgeesaman)
-* rule: adds user.loginuid to the default Falco rules that also contain user.name [[#1369](https://github.com/falcosecurity/falco/pull/1369)] - [@csschwe](https://github.com/csschwe)
-
-## v0.25.0
-
-Released on 2020-08-25
-
-### Major Changes
-
-* new(userspace/falco): print the Falco and driver versions at the very beginning of the output. [[#1303](https://github.com/falcosecurity/falco/pull/1303)] - [@leogr](https://github.com/leogr)
-* new: libyaml is now bundled in the release process. Users can now avoid installing libyaml directly when getting Falco from the official release. [[#1252](https://github.com/falcosecurity/falco/pull/1252)] - [@fntlnz](https://github.com/fntlnz)
-
-
-### Minor Changes
-
-* docs(test): step-by-step instructions to run integration tests locally [[#1313](https://github.com/falcosecurity/falco/pull/1313)] - [@leodido](https://github.com/leodido)
-* update: renameat2 syscall support [[#1355](https://github.com/falcosecurity/falco/pull/1355)] - [@fntlnz](https://github.com/fntlnz)
-* update: support for 5.8.x kernels [[#1355](https://github.com/falcosecurity/falco/pull/1355)] - [@fntlnz](https://github.com/fntlnz)
-
-
-### Bug Fixes
-
-* fix(userspace/falco): correct the fallback mechanism for loading the kernel module [[#1366](https://github.com/falcosecurity/falco/pull/1366)] - [@leogr](https://github.com/leogr)
-* fix(falco-driver-loader): script crashing when using arguments [[#1330](https://github.com/falcosecurity/falco/pull/1330)] - [@antoinedeschenes](https://github.com/antoinedeschenes)
-
-
-### Rule Changes
-
-* rule(macro user_trusted_containers): add `sysdig/node-image-analyzer` and `sysdig/agent-slim` [[#1321](https://github.com/falcosecurity/falco/pull/1321)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro falco_privileged_images): add `docker.io/falcosecurity/falco` [[#1326](https://github.com/falcosecurity/falco/pull/1326)] - [@nvanheuverzwijn](https://github.com/nvanheuverzwijn)
-* rule(EphemeralContainers Created): add new rule to detect ephemeral container created [[#1339](https://github.com/falcosecurity/falco/pull/1339)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro user_read_sensitive_file_containers): replace endswiths with exact image repo name [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro user_trusted_containers): replace endswiths with exact image repo name [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro user_privileged_containers): replace endswiths with exact image repo name [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro trusted_images_query_miner_domain_dns): replace endswiths with exact image repo name [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro falco_privileged_containers): append "/" to quay.io/sysdig [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(list falco_privileged_images): add images docker.io/sysdig/agent-slim and docker.io/sysdig/node-image-analyzer [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(list falco_sensitive_mount_images): add image docker.io/sysdig/agent-slim [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(list k8s_containers): prepend docker.io to images [[#1349](https://github.com/falcosecurity/falco/pull/1349)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(macro exe_running_docker_save): add better support for centos [[#1350](https://github.com/falcosecurity/falco/pull/1350)] - [@admiral0](https://github.com/admiral0)
-* rule(macro rename): add `renameat2` syscall [[#1359](https://github.com/falcosecurity/falco/pull/1359)] - [@leogr](https://github.com/leogr)
-* rule(Read sensitive file untrusted): add trusted images into whitelist [[#1327](https://github.com/falcosecurity/falco/pull/1327)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(Pod Created in Kube Namespace): add new list k8s_image_list as white list [[#1336](https://github.com/falcosecurity/falco/pull/1336)] - [@Kaizhe](https://github.com/Kaizhe)
-* rule(list allowed_k8s_users): add "kubernetes-admin" user [[#1323](https://github.com/falcosecurity/falco/pull/1323)] - [@leogr](https://github.com/leogr)
-
-## v0.24.0
-
-Released on 2020-07-16
-
-### Major Changes
-
-* new: Falco now supports userspace instrumentation with the -u flag [[#1195](https://github.com/falcosecurity/falco/pull/1195)]
-* BREAKING CHANGE: --stats_interval is now --stats-interval [[#1308](https://github.com/falcosecurity/falco/pull/1308)]
-* new: auto threadiness for gRPC server [[#1271](https://github.com/falcosecurity/falco/pull/1271)]
-* BREAKING CHANGE: server streaming gRPC outputs method is now `falco.outputs.service/get` [[#1241](https://github.com/falcosecurity/falco/pull/1241)]
-* new: new bi-directional async streaming gRPC outputs (`falco.outputs.service/sub`)  [[#1241](https://github.com/falcosecurity/falco/pull/1241)]
-* new: unix socket for the gRPC server [[#1217](https://github.com/falcosecurity/falco/pull/1217)]
-
-
-### Minor Changes
-
-* update: driver version is 85c88952b018fdbce2464222c3303229f5bfcfad now [[#1305](https://github.com/falcosecurity/falco/pull/1305)]
-* update: `SKIP_MODULE_LOAD` renamed to `SKIP_DRIVER_LOADER` [[#1297](https://github.com/falcosecurity/falco/pull/1297)]
-* docs: add leogr to OWNERS [[#1300](https://github.com/falcosecurity/falco/pull/1300)]
-* update: default threadiness to 0 ("auto" behavior) [[#1271](https://github.com/falcosecurity/falco/pull/1271)]
-* update: k8s audit endpoint now defaults to /k8s-audit everywhere [[#1292](https://github.com/falcosecurity/falco/pull/1292)]
-* update(falco.yaml): `webserver.k8s_audit_endpoint` default value changed from `/k8s_audit` to `/k8s-audit` [[#1261](https://github.com/falcosecurity/falco/pull/1261)]
-* docs(test): instructions to run regression test suites locally [[#1234](https://github.com/falcosecurity/falco/pull/1234)]
-
-
-### Bug Fixes
-
-* fix: --stats-interval correctly accepts values >= 999 (ms) [[#1308](https://github.com/falcosecurity/falco/pull/1308)]
-* fix: make the eBPF driver build work on CentOS 8 [[#1301](https://github.com/falcosecurity/falco/pull/1301)]
-* fix(userspace/falco): correct options handling for `buffered_output: false` which was not honored for the `stdout` output [[#1296](https://github.com/falcosecurity/falco/pull/1296)]
-* fix(userspace/falco): honor -M also when using a trace file [[#1245](https://github.com/falcosecurity/falco/pull/1245)]
-* fix: high CPU usage when using server streaming gRPC outputs [[#1241](https://github.com/falcosecurity/falco/pull/1241)]
-* fix: missing newline from some log messages (eg., token bucket depleted) [[#1257](https://github.com/falcosecurity/falco/pull/1257)]
-
-
-### Rule Changes
-
-* rule(Container Drift Detected (chmod)): disabled by default [[#1316](https://github.com/falcosecurity/falco/pull/1316)]
-* rule(Container Drift Detected (open+create)): disabled by default [[#1316](https://github.com/falcosecurity/falco/pull/1316)]
-* rule(Write below etc): allow snapd to write its unit files [[#1289](https://github.com/falcosecurity/falco/pull/1289)]
-* rule(macro remote_file_copy_procs): fix reference to remote_file_copy_binaries [[#1224](https://github.com/falcosecurity/falco/pull/1224)]
-* rule(list allowed_k8s_users): whitelisted kube-apiserver-healthcheck user created by kops >= 1.17.0 for the kube-apiserver-healthcheck sidecar [[#1286](https://github.com/falcosecurity/falco/pull/1286)]
-* rule(Change thread namespace): Allow `protokube`, `dockerd`, `tini` and `aws` binaries to change thread namespace. [[#1222](https://github.com/falcosecurity/falco/pull/1222)]
-* rule(macro exe_running_docker_save): to filter out cmdlines containing `/var/run/docker`. [[#1222](https://github.com/falcosecurity/falco/pull/1222)]
-* rule(macro user_known_cron_jobs): new macro to be overridden to list known cron jobs   [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Schedule Cron Jobs): exclude known cron jobs  [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_update_package_registry): new macro to be overridden to list known package registry update  [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Update Package Registry): exclude known package registry update [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_read_ssh_information_activities): new macro to be overridden to list known activities that read SSH info  [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Read ssh information): do not throw for activities known to read SSH info [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_read_sensitive_files_activities): new macro to be overridden to list activities known to read sensitive files [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Read sensitive file trusted after startup): do not throw for activities known to read sensitive files [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Read sensitive file untrusted): do not throw for activities known to read sensitive files [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_write_rpm_database_activities): new macro to be overridden to list activities known to write RPM database [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Write below rpm database): do not throw for activities known to write RPM database [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_db_spawned_processes): new macro to be overridden to list processes known to spawn DB [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(DB program spawned process): do not throw for processes known to spawn DB [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_modify_bin_dir_activities): new macro to be overridden to list activities known to modify bin directories [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Modify binary dirs): do not throw for activities known to modify bin directories [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_mkdir_bin_dir_activities): new macro to be overridden to list activities known to create directories below bin directories [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Mkdir binary dirs): do not throw for activities known to create directories below bin directories [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_system_user_login): new macro to exclude known system user logins [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(System user interactive): do not throw for known system user logins [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_user_management_activities): new macro to be overridden to list activities known to do user managements activities [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(User mgmt binaries): do not throw for activities known to do user managements activities [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_create_files_below_dev_activities): new macro to be overridden to list activities known to create files below dev [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Create files below dev): do not throw for activities known to create files below dev [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_contact_k8s_api_server_activities): new macro to be overridden to list activities known to contact Kubernetes API server [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Contact K8S API Server From Container): do not throw for activities known to contact Kubernetes API server [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_network_tool_activities): new macro to be overridden to list activities known to spawn/use network tools [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Launch Suspicious Network Tool in Container): do not throw for activities known to spawn/use network tools [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_remove_data_activities): new macro to be overridden to list activities known to perform data remove commands [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Remove Bulk Data from Disk): do not throw for activities known to perform data remove commands [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_create_hidden_file_activities): new macro to be overridden to list activities known to create hidden files [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Create Hidden Files or Directories): do not throw for activities known to create hidden files [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_stand_streams_redirect_activities): new macro to be overridden to list activities known to redirect stream to network connection (in containers) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Redirect STDOUT/STDIN to Network Connection in Container): do not throw for activities known to redirect stream to network connection (in containers) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_container_drift_activities): new macro to be overridden to list activities known to create executables in containers [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Container Drift Detected (chmod)): do not throw for activities known to give execution permissions to files in containers [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Container Drift Detected (open+create)): do not throw for activities known to create executables in containers [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_node_port_service): do not throw for services known to start with a NopePort service type (k8s) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Create NodePort Service): do not throw for services known to start with a NopePort service type (k8s) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro user_known_exec_pod_activities): do not throw for activities known to attach/exec to a pod (k8s) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Attach/Exec Pod): do not throw for activities known to attach/exec to a pod (k8s) [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro trusted_pod): defines trusted pods by an image list  [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Pod Created in Kube Namespace): do not throw for trusted pods [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(macro trusted_sa): define trusted ServiceAccount [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(Service Account Created in Kube Namespace): do not throw for trusted ServiceAccount [[#1294](https://github.com/falcosecurity/falco/pull/1294)]
-* rule(list network_tool_binaries): add zmap to the list [[#1284](https://github.com/falcosecurity/falco/pull/1284)]
-* rule(macro root_dir): correct macro to exactly match the `/root` dir and not other with just `/root` as a prefix [[#1279](https://github.com/falcosecurity/falco/pull/1279)]
-* rule(macro user_expected_terminal_shell_in_container_conditions): allow whitelisting terminals in containers under specific conditions [[#1154](https://github.com/falcosecurity/falco/pull/1154)]
-* rule(macro user_known_write_below_binary_dir_activities): allow writing to a binary dir in some conditions [[#1260](https://github.com/falcosecurity/falco/pull/1260)]
-* rule(macro trusted_logging_images): Add addl fluentd image [[#1230](https://github.com/falcosecurity/falco/pull/1230)]
-* rule(macro trusted_logging_images): Let azure-npm image write to /var/log [[#1230](https://github.com/falcosecurity/falco/pull/1230)]
-* rule(macro lvprogs_writing_conf): Add lvs as a lvm program [[#1230](https://github.com/falcosecurity/falco/pull/1230)]
-* rule(macro user_known_k8s_client_container): Allow hcp-tunnelfront to run kubectl in containers [[#1230](https://github.com/falcosecurity/falco/pull/1230)]
-* rule(list allowed_k8s_users): Add vertical pod autoscaler as known k8s users [[#1230](https://github.com/falcosecurity/falco/pull/1230)]
-* rule(Anonymous Request Allowed): update to checking auth decision equals to allow [[#1267](https://github.com/falcosecurity/falco/pull/1267)]
-* rule(Container Drift Detected (chmod)): new rule to detect if an existing file get exec permissions in a container [[#1254](https://github.com/falcosecurity/falco/pull/1254)]
-* rule(Container Drift Detected (open+create)): new rule to detect if a new file with execution permission is created in a container [[#1254](https://github.com/falcosecurity/falco/pull/1254)]
-* rule(Mkdir binary dirs): correct condition in macro `bin_dir_mkdir` to catch `mkdirat` syscall [[#1250](https://github.com/falcosecurity/falco/pull/1250)]
-* rule(Modify binary dirs): correct condition in macro `bin_dir_rename` to catch `rename`, `renameat`, and `unlinkat` syscalls [[#1250](https://github.com/falcosecurity/falco/pull/1250)]
-* rule(Create files below dev): correct condition to catch `openat` syscall [[#1250](https://github.com/falcosecurity/falco/pull/1250)]
-* rule(macro user_known_set_setuid_or_setgid_bit_conditions): create macro [[#1213](https://github.com/falcosecurity/falco/pull/1213)]
+This file documents all notable changes to Falco. The release numbering uses [semantic versioning](http://semver.org).

 ## v0.23.0

-Released on 2020-05-18
+Released on 2020-18-05

 ### Major Changes

@@ -246,7 +46,7 @@ Released on 2020-05-18

 ## v0.22.1

-Released on 2020-04-17
+Released on 2020-17-04

 ### Major Changes

@@ -266,7 +66,7 @@ Released on 2020-04-17

 ## v0.22.0

-Released on 2020-04-16
+Released on 2020-16-04

 ### Major Changes

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,8 +16,6 @@ project(falco)

 option(USE_BUNDLED_DEPS "Bundle hard to find dependencies into the Falco binary" OFF)
 option(BUILD_WARNINGS_AS_ERRORS "Enable building with -Wextra -Werror flags" OFF)
-option(MINIMAL_BUILD "Build a minimal version of Falco, containing only the engine and basic input/output (EXPERIMENTAL)" OFF)
-option(MUSL_OPTIMIZED_BUILD "Enable if you want a musl optimized build" OFF)

 # Elapsed time
 # set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE "${CMAKE_COMMAND} -E time") # TODO(fntlnz, leodido): add a flag to enable this
@@ -52,15 +50,7 @@ else()
 endif()
 message(STATUS "Build type: ${CMAKE_BUILD_TYPE}")

-if(MINIMAL_BUILD)
-  set(MINIMAL_BUILD_FLAGS "-DMINIMAL_BUILD")
-endif()
-
-if(MUSL_OPTIMIZED_BUILD)
-  set(MUSL_FLAGS "-static -Os")
-endif()
-
-set(CMAKE_COMMON_FLAGS "-Wall -ggdb ${DRAIOS_FEATURE_FLAGS} ${MINIMAL_BUILD_FLAGS} ${MUSL_FLAGS}")
+set(CMAKE_COMMON_FLAGS "-Wall -ggdb ${DRAIOS_FEATURE_FLAGS}")

 if(BUILD_WARNINGS_AS_ERRORS)
  set(CMAKE_SUPPRESSED_WARNINGS
@@ -83,7 +73,7 @@ include(GetFalcoVersion)
 set(PACKAGE_NAME "falco")
 set(PROBE_NAME "falco")
 set(PROBE_DEVICE_NAME "falco")
-set(DRIVERS_REPO "https://download.falco.org/driver")
+set(DRIVERS_REPO "https://dl.bintray.com/falcosecurity/driver")
 if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
  set(CMAKE_INSTALL_PREFIX
      /usr
@@ -103,7 +93,7 @@ message(STATUS "Using bundled nlohmann-json in '${NJSON_SRC}'")
 set(NJSON_INCLUDE "${NJSON_SRC}/single_include")
 ExternalProject_Add(
  njson
-  URL "https://github.com/nlohmann/json/archive/v3.3.0.tar.gz"
+  URL "https://s3.amazonaws.com/download.draios.com/dependencies/njson-3.3.0.tar.gz"
  URL_HASH "SHA256=2fd1d207b4669a7843296c41d3b6ac5b23d00dec48dba507ba051d14564aa801"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
@@ -115,31 +105,83 @@ set(CURSES_NEED_NCURSES TRUE)
 find_package(Curses REQUIRED)
 message(STATUS "Found ncurses: include: ${CURSES_INCLUDE_DIR}, lib: ${CURSES_LIBRARIES}")

-# b64
-include(b64)
+# libb64
+set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
+message(STATUS "Using bundled b64 in '${B64_SRC}'")
+set(B64_INCLUDE "${B64_SRC}/include")
+set(B64_LIB "${B64_SRC}/src/libb64.a")
+ExternalProject_Add(
+  b64
+  URL "https://s3.amazonaws.com/download.draios.com/dependencies/libb64-1.2.src.zip"
+  URL_HASH "SHA256=343d8d61c5cbe3d3407394f16a5390c06f8ff907bd8d614c16546310b689bfd3"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  INSTALL_COMMAND "")

 # yaml-cpp
 include(yaml-cpp)

-if(NOT MINIMAL_BUILD)
-  # OpenSSL
-  include(OpenSSL)
+# OpenSSL
+include(OpenSSL)

-  # libcurl
-  include(cURL)
-endif()
+# libcurl
+include(cURL)

 # LuaJIT
-include(luajit)
+set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
+message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
+set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
+set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
+ExternalProject_Add(
+  luajit
+  URL "https://s3.amazonaws.com/download.draios.com/dependencies/LuaJIT-2.0.3.tar.gz"
+  URL_HASH "SHA256=55be6cb2d101ed38acca32c5b1f99ae345904b365b642203194c585d27bebd79"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  INSTALL_COMMAND "")

 # Lpeg
-include(lpeg)
+set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
+set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
+message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
+set(LPEG_DEPENDENCIES "")
+list(APPEND LPEG_DEPENDENCIES "luajit")
+ExternalProject_Add(
+  lpeg
+  DEPENDS ${LPEG_DEPENDENCIES}
+  URL "https://s3.amazonaws.com/download.draios.com/dependencies/lpeg-1.0.0.tar.gz"
+  URL_HASH "SHA256=10190ae758a22a16415429a9eb70344cf29cbda738a6962a9f94a732340abf8e"
+  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
+  BUILD_IN_SOURCE 1
+  CONFIGURE_COMMAND ""
+  INSTALL_COMMAND "")

 # libyaml
-include(libyaml)
+find_library(LIBYAML_LIB NAMES libyaml.so)
+if(LIBYAML_LIB)
+  message(STATUS "Found libyaml: lib: ${LIBYAML_LIB}")
+else()
+  message(FATAL_ERROR "Couldn't find system libyaml")
+endif()

 # lyaml
-include(lyaml)
+set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
+set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
+message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
+set(LYAML_DEPENDENCIES "")
+list(APPEND LYAML_DEPENDENCIES "luajit")
+ExternalProject_Add(
+  lyaml
+  DEPENDS ${LYAML_DEPENDENCIES}
+  URL "https://s3.amazonaws.com/download.draios.com/dependencies/lyaml-release-v6.0.tar.gz"
+  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  CONFIGURE_COMMAND ./configure --enable-static LIBS=-lyaml LUA_INCLUDE=-I${LUAJIT_INCLUDE} LUA=${LUAJIT_SRC}/luajit
+  INSTALL_COMMAND sh -c
+                  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua")

 # One TBB
 set(TBB_SRC "${PROJECT_BINARY_DIR}/tbb-prefix/src/tbb")
@@ -158,34 +200,26 @@ ExternalProject_Add(
  BUILD_BYPRODUCTS ${TBB_LIB}
  INSTALL_COMMAND "")

-if(NOT MINIMAL_BUILD)
-  # civetweb
-  set(CIVETWEB_SRC "${PROJECT_BINARY_DIR}/civetweb-prefix/src/civetweb/")
-  set(CIVETWEB_LIB "${CIVETWEB_SRC}/install/lib/libcivetweb.a")
-  set(CIVETWEB_INCLUDE_DIR "${CIVETWEB_SRC}/install/include")
-  message(STATUS "Using bundled civetweb in '${CIVETWEB_SRC}'")
-  ExternalProject_Add(
-    civetweb
-    URL "https://github.com/civetweb/civetweb/archive/v1.11.tar.gz"
-    URL_HASH "SHA256=de7d5e7a2d9551d325898c71e41d437d5f7b51e754b242af897f7be96e713a42"
-    CONFIGURE_COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/lib
-    COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/include
-    BUILD_IN_SOURCE 1
-    BUILD_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" WITH_CPP=1
-    BUILD_BYPRODUCTS ${CIVETWEB_LIB}
-    INSTALL_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" install-lib install-headers PREFIX=${CIVETWEB_SRC}/install "WITH_CPP=1")
-endif()
+# civetweb
+set(CIVETWEB_SRC "${PROJECT_BINARY_DIR}/civetweb-prefix/src/civetweb/")
+set(CIVETWEB_LIB "${CIVETWEB_SRC}/install/lib/libcivetweb.a")
+set(CIVETWEB_INCLUDE_DIR "${CIVETWEB_SRC}/install/include")
+message(STATUS "Using bundled civetweb in '${CIVETWEB_SRC}'")
+ExternalProject_Add(
+  civetweb
+  URL "https://github.com/civetweb/civetweb/archive/v1.11.tar.gz"
+  URL_HASH "SHA256=de7d5e7a2d9551d325898c71e41d437d5f7b51e754b242af897f7be96e713a42"
+  CONFIGURE_COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/lib
+  COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/include
+  BUILD_IN_SOURCE 1
+  BUILD_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" WITH_CPP=1
+  INSTALL_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" install-lib install-headers PREFIX=${CIVETWEB_SRC}/install "WITH_CPP=1")

-# string-view-lite
+#string-view-lite
 include(DownloadStringViewLite)

-# cxxopts
-include(DownloadCxxOpts)
-
-if(NOT MINIMAL_BUILD)
-  # gRPC
-  include(gRPC)
-endif()
+# gRPC
+include(gRPC)

 # sysdig
 include(sysdig)
@@ -193,13 +227,11 @@ include(sysdig)
 # Installation
 install(FILES falco.yaml DESTINATION "${FALCO_ETC_DIR}")

-if(NOT MINIMAL_BUILD)
-  # Coverage
-  include(Coverage)
+# Coverage
+include(Coverage)

-  # Tests
-  add_subdirectory(test)
-endif()
+# Tests
+add_subdirectory(test)

 # Rules
 add_subdirectory(rules)
@@ -210,9 +242,6 @@ add_subdirectory(docker)
 # Clang format
 # add_custom_target(format COMMAND clang-format --style=file -i $<TARGET_PROPERTY:falco,SOURCES> COMMENT "Formatting ..." VERBATIM)

-# Static analysis
-include(static-analysis)
-
 # Shared build variables
 set(FALCO_SINSP_LIBRARY sinsp)
 set(FALCO_SHARE_DIR share/falco)
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,38 @@
+# CNCF Community Code of Conduct v1.0
+
+## Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of fostering
+an open and welcoming community, we pledge to respect all people who contribute
+through reporting issues, posting feature requests, updating documentation,
+submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free experience for
+everyone, regardless of level of experience, gender, gender identity and expression,
+sexual orientation, disability, personal appearance, body size, race, ethnicity, age,
+religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing other's private information, such as physical or electronic addresses,
+ without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are not
+aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers
+commit themselves to fairly and consistently applying these principles to every aspect
+of managing this project. Project maintainers who do not follow or enforce the Code of
+Conduct may be permanently removed from the project team.
+
+This code of conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting a CNCF project maintainer, [Sarah Novotny](mailto:sarahnovotny@google.com), and/or [Dan Kohn](mailto:dan@linuxfoundation.org).
+
+This Code of Conduct is adapted from the [Contributor Covenant](http://contributor-covenant.org), version 1.2.0, available at
+http://contributor-covenant.org/version/1/2/0/
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,150 @@
+# Contributing to Falco
+
+- [Contributing to Falco](#contributing-to-falco)
+  - [Code of Conduct](#code-of-conduct)
+  - [Issues](#issues)
+    - [Triage issues](#triage-issues)
+      - [More about labels](#more-about-labels)
+    - [Slack](#slack)
+  - [Pull Requests](#pull-requests)
+    - [Commit convention](#commit-convention)
+      - [Rule type](#rule-type)
+  - [Coding Guidelines](#coding-guidelines)
+    - [C++](#c)
+    - [Unit testing](/tests/README.md)
+  - [Developer Certificate Of Origin](#developer-certificate-of-origin)
+
+## Code of Conduct
+
+Falco has a
+[Code of Conduct](CODE_OF_CONDUCT.md)
+to which all contributors must adhere, please read it before interacting with the repository or the community in any way.
+
+## Issues
+
+Issues are the heartbeat ❤️ of the Falco project, there are mainly three kinds of issues you can open:
+
+- Bug report: you believe you found a problem in Falco and you want to discuss and get it fixed,
+creating an issue with the **bug report template** is the best way to do so.
+- Enhancement: any kind of new feature need to be discussed in this kind of issue, do you want a new rule or a new feature? This is the kind of issue you want to open. Be very good at explaining your intent, it's always important that others can understand what you mean in order to discuss, be open and collaborative in letting others help you getting this done!
+- Failing tests: you noticed a flaky test or a problem with a build? This is the kind of issue to triage that!
+
+The best way to get **involved** in the project is through issues, you can help in many ways:
+
+- Issues triaging: participating in the discussion and adding details to open issues is always a good thing,
+sometimes issues need to be verified, you could be the one writing a test case to fix a bug!
+- Helping to resolve the issue: you can help in getting it fixed in many ways, more often by opening a pull request.
+
+### Triage issues
+
+We need help in categorizing issues. Thus any help is welcome!
+
+When you triage an issue, you:
+
+* assess whether it has merit or not
+
+* quickly close it by correctly answering a question
+
+* point the reporter to a resource or documentation answering the issue
+
+* tag it via labels, projects, or milestones
+
+* take ownership submitting a PR for it, in case you want 😇
+
+#### More about labels
+
+These guidelines are not set in stone and are subject to change.
+
+Anyway a `kind/*` label for any issue is mandatory.
+
+This is the current [label set](https://github.com/falcosecurity/falco/labels) we have.
+
+You can use commands - eg., `/label <some-label>` to add (or remove) labels or manually do it.
+
+The commands available are the following ones:
+
+```
+/[remove-](area|kind|priority|triage|label)
+```
+
+Some examples:
+
+* `/area rules`
+* `/remove-area rules`
+* `/kind kernel-module`
+* `/label good-first-issue`
+* `/triage duplicate`
+* `/triage unresolved`
+* `/triage not-reproducible`
+* `/triage support`
+* ...
+
+### Slack
+
+Other discussion, and **support requests** should go through the `#falco` channel in the Kubernetes slack, please join [here](https://slack.k8s.io/).
+
+## Pull Requests
+
+Thanks for taking time to make a [pull request](https://help.github.com/articles/about-pull-requests) (hereafter PR).
+
+In the PR body, feel free to add an area label if appropriate by typing `/area <AREA>`, PRs will also
+need a kind, make sure to specify the appropriate one by typing `/kind <KIND>`.
+
+The list of labels is [here](https://github.com/falcosecurity/falco/labels).
+
+Also feel free to suggest a reviewer with `/cc @theirname`, or to assign an assignee using `/assign @nickname`.
+
+Once your reviewer is happy, they will say `/lgtm` which will apply the
+`lgtm` label, and will apply the `approved` label if they are an
+[owner](/OWNERS).
+
+Your PR will be automatically merged once it has the `lgtm` and `approved`
+labels, does not have any `do-not-merge/*` labels, and all status checks (eg., rebase, tests, DCO) are positive.
+
+### Commit convention
+
+As commit convention, we adopt [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/), we have an history
+of commits that do not adopt the convention but any new commit must follow it to be eligible for merge.
+
+#### Rule type
+
+Besides the classic types, we adopt a type for rules, `rule(<scope>):`.
+Example:
+
+```
+rule(Write below monitored dir): make sure monitored dirs are monitored.
+```
+
+Each rule change must be on its own commit, if a change to a macro is done while changing a rule they can go together but only one rule per commit must happen.
+
+If you are changing only a macro, the commit will look like this:
+
+```
+rule(macro user_known_write_monitored_dir_conditions): make sure conditions are great
+```
+
+## Coding Guidelines
+
+### C++
+
+* File `userspace/engine/banned.h` defines some functions as invalid tokens. These functions are not allowed to be used in the codebase. Whenever creating a new cpp file, include the `"banned.h"` headers. This ensures that the banned functions are not compiled.
+
+  A complete list of banned functions can be found [here](./userspace/engine/banned.h).
+
+## Developer Certificate Of Origin
+
+The [Developer Certificate of Origin (DCO)](https://developercertificate.org/) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
+
+Contributors to the Falco project sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
+
+```
+This is my commit message
+
+Signed-off-by: John Poiana <jpoiana@falco.org>
+```
+
+Git even has a `-s` command line option to append this automatically to your commit message:
+
+```
+$ git commit -s -m 'This is my commit message'
+```
--- a/2
+++ b/2
@@ -3,7 +3,6 @@ approvers:
  - kris-nova
  - leodido
  - mstemm
-  - leogr
 reviewers:
  - fntlnz
  - kaizhe
@@ -11,4 +10,3 @@ reviewers:
  - leodido
  - mfdii
  - mstemm
-  - leogr
--- a/README.md
+++ b/README.md
@@ -3,11 +3,11 @@

 <hr>

+# The Falco Project
+
 [![Build Status](https://img.shields.io/circleci/build/github/falcosecurity/falco/master?style=for-the-badge)](https://circleci.com/gh/falcosecurity/falco) [![CII Best Practices Summary](https://img.shields.io/cii/summary/2317?label=CCI%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317) [![GitHub](https://img.shields.io/github/license/falcosecurity/falco?style=for-the-badge)](COPYING)

-Want to talk? Join us on the [#falco](https://kubernetes.slack.com/archives/CMWH3EH32) channel in the [Kubernetes Slack](https://slack.k8s.io).
-
-### Latest releases
+#### Latest releases

 Read the [change log](CHANGELOG.md).

@@ -19,89 +19,66 @@ Read the [change log](CHANGELOG.md).

 ---

-The Falco Project, originally created by [Sysdig](https://sysdig.com), is an incubating [CNCF](https://cncf.io) open source cloud native runtime security tool.
-Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack.
-Falco has a rich rule set of security rules specifically built for Kubernetes, Linux, and cloud-native.
-If a rule is violated in a system, Falco will send an alert notifying the user of the violation and its severity.
+Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Falco audits a system at the most fundamental level, the kernel. Falco then enriches this data with other input streams such as container runtime metrics, and Kubernetes metrics. Falco lets you continuously monitor and detect container, application, host, and network activity—all in one place—from one source of data, with one set of rules.

-### Installing Falco
+Falco is hosted by the Cloud Native Computing Foundation (CNCF) as a sandbox level project. If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details read the [Falco CNCF project proposal](https://github.com/cncf/toc/tree/master/proposals/falco.adoc).

-If you would like to run Falco in **production** please adhere to the [official installation guide](https://falco.org/docs/installation/).
+#### What kind of behaviors can Falco detect?

-##### Kubernetes
+Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:

-| Tool     | Link                                                                                       | Note                                                               |
-|----------|--------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
-| Helm     | [Chart Repository](https://github.com/falcosecurity/charts/tree/master/falco#introduction) | The Falco community offers regular helm chart releases.            |
-| Minikube | [Tutorial](https://falco.org/docs/third-party/#minikube)                                   | The Falco driver has been baked into minikube for easy deployment. |
-| Kind     | [Tutorial](https://falco.org/docs/third-party/#kind)                                       | Running Falco with kind requires a driver on the host system.      |
-| GKE      | [Tutorial](https://falco.org/docs/third-party/#gke)                                        | We suggest using the eBPF driver for running Falco on GKE.         |
-
-### Developing
-
-Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.
-
-Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/master/userspace/falco/outputs.proto).
-The Falco Project supports various SDKs for this endpoint.
-
-##### SDKs
-
-| Language | Repository                                              |
-|----------|---------------------------------------------------------|
-| Go       | [client-go](https://github.com/falcosecurity/client-go) |
-| Rust     | [client-rs](https://github.com/falcosecurity/client-rs) |
-| Python   | [client-py](https://github.com/falcosecurity/client-py) |
-
-
-### What can Falco detect?
-
-Falco can detect and alert on any behavior that involves making Linux system calls.
-Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process.
-For example, Falco can easily detect incidents including but not limited to:
-
- A shell is running inside a container or pod in Kubernetes.
+- A shell is running inside a container.
 - A container is running in privileged mode, or is mounting a sensitive path, such as `/proc`, from the host.
 - A server process is spawning a child process of an unexpected type.
 - Unexpected read of a sensitive file, such as `/etc/shadow`.
 - A non-device file is written to `/dev`.
 - A standard system binary, such as `ls`, is making an outbound network connection.
- A privileged pod is started in a Kubernetes cluster.

-### Documentation

-The [Official Documentation](https://falco.org/docs/) is the best resource to learn about Falco.
+### Installing Falco

-### Join the Community
+You can find the latest release downloads on the official [release archive](https://bintray.com/falcosecurity)
+
+Furthermore the comprehensive [installation guide](https://falco.org/docs/installation/) for Falco is available in the documentation website.
+
+#### How do you compare Falco with other security tools?
+
+One of the questions we often get when we talk about Falco is “How does Falco differ from other Linux security tools such as SELinux, AppArmor, Auditd, etc.?”. We wrote a [blog post](https://sysdig.com/blog/selinux-seccomp-falco-technical-discussion/) comparing Falco with other tools.
+
+
+Documentation
+---
+
+See [Falco Documentation](https://falco.org/docs/) to quickly get started using Falco.
+
+Join the Community
+---

 To get involved with The Falco Project please visit [the community repository](https://github.com/falcosecurity/community) to find more.

-How to reach out?
+License Terms
+---

- - Join the #falco channel on the [Kubernetes Slack](https://slack.k8s.io)
- - [Join the Falco mailing list](https://lists.cncf.io/g/cncf-falco-dev)
- - [Read the Falco documentation](https://falco.org/docs/)
+Falco is licensed to you under the [Apache 2.0](./COPYING) open source license.

+Contributing
+---

-### Contributing
+See the [CONTRIBUTING.md](./CONTRIBUTING.md).

-See the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md).
+Security
+---

 ### Security Audit

 A third party security audit was performed by Cure53, you can see the full report [here](./audits/SECURITY_AUDIT_2019_07.pdf).

 ### Reporting security vulnerabilities
-
 Please report security vulnerabilities following the community process documented [here](https://github.com/falcosecurity/.github/blob/master/SECURITY.md).

-### License Terms
-
-Falco is licensed to you under the [Apache 2.0](./COPYING) open source license.
-
-
 [1]: https://dl.bintray.com/falcosecurity/rpm-dev
 [2]: https://dl.bintray.com/falcosecurity/rpm
 [3]: https://dl.bintray.com/falcosecurity/deb-dev/stable
 [4]: https://dl.bintray.com/falcosecurity/deb/stable
 [5]: https://dl.bintray.com/falcosecurity/bin-dev/x86_64
-[6]: https://dl.bintray.com/falcosecurity/bin/x86_64
+[6]: https://dl.bintray.com/falcosecurity/bin/x86_64
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -2,43 +2,39 @@

 Our release process is mostly automated, but we still need some manual steps to initiate and complete it.

-Changes and new features are grouped in [milestones](https://github.com/falcosecurity/falco/milestones), the milestone with the next version represents what is going to be released.
+Changes and new features are grouped in [milestones](https://github.com/falcosecurity/falco/milestones), the milestone with the next version represents what is going to be released. 

-A release happens every two months ([as per community discussion](https://github.com/falcosecurity/community/blob/master/meeting-notes/2020-09-30.md#agenda)), and we need to assign owners for each (usually we pair a new person with an experienced one). Assignees and the due date are proposed during the [weekly community call](https://github.com/falcosecurity/community). Note that hotfix releases can happen as soon as it is needed.
+Releases happen on a monthly cadence, towards the 16th of the on-going month, and we need to assign owners for each (usually we pair a new person with an experienced one). Assignees and the due date are proposed during the [weekly community call](https://github.com/falcosecurity/community). Note that hotfix releases can happen as soon as it is needed.

 Finally, on the proposed due date the assignees for the upcoming release proceed with the processes described below.

 ## Pre-Release Checklist

-Before cutting a release we need to do some homework in the Falco repository. This should take 5 minutes using the GitHub UI.
-
 ### 1. Release notes
- Find the LAST release (-1) and use `YYYY-MM-DD` as the day before of the [latest release](https://github.com/falcosecurity/falco/releases)
+- Let `YYYY-MM-DD` the day before of the [latest release](https://github.com/falcosecurity/falco/releases)
 - Check the release note block of every PR matching the `is:pr is:merged closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+closed%3A%3EYYYY-MM-DD)
    - Ensure the release note block follows the [commit convention](https://github.com/falcosecurity/falco/blob/master/CONTRIBUTING.md#commit-convention), otherwise fix its content
    - If the PR has no milestone, assign it to the milestone currently undergoing release
- Check issues without a milestone (using [is:pr is:merged no:milestone closed:>YYYY-MM-DD](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD) filter) and add them to the milestone currently undergoing release
- Double-check that there are no more merged PRs without the target milestone assigned with the `is:pr is:merged no:milestone closed:>YYYY-MM-DD` [filters](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD), if any, fix them
+- Check issues without a milestone (using [is:pr is:merged no:milestone closed:>YYYT-MM-DD](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYT-MM-DD) filter) and add them to the milestone currently undergoing release
+- Double-check that there are no more merged PRs without the target milestone assigned with the `is:pr is:merged no:milestone closed:>YYYT-MM-DD` [filters](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYT-MM-DD), if any, fix them

 ### 2. Milestones
-
 - Move the [tasks not completed](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Aopen) to a new minor milestone
-
+- Close the completed milestone
+    
 ### 3. Release PR

 - Double-check if any hard-coded version number is present in the code, it should be not present anywhere:
    - If any, manually correct it then open an issue to automate version number bumping later
    - Versions table in the `README.md` update itself automatically
- Generate the change log https://github.com/leodido/rn2md, or https://fs.fntlnz.wtf/falco/milestones-changelog.txt for the lazy people (it updates every 5 minutes)
-    - If you review timeout errors with `rn2md` try to generate an GitHub Oauth access token and use `-t`
- Add the latest changes on top the previous `CHANGELOG.md`
+- Generate the change log https://github.com/leodido/rn2md, or https://fs.fntlnz.wtf/falco/milestones-changelog.txt for the lazy people (it updates every 5 minutes) 
+- Add the lastest changes on top the previous `CHANGELOG.md`
 - Submit a PR with the above modifications
 - Await PR approval
- Close the completed milestone as soon as the PR is merged

 ## Release

-Now assume `x.y.z` is the new version.
+Let `x.y.z` the new version.

 ### 1. Create a tag

@@ -56,50 +52,25 @@ Now assume `x.y.z` is the new version.
 - Wait for the CI to complete

 ### 2. Update the GitHub release
-
 - [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
 - Use `x.y.z` both as tag version and release title
 - Use the following template to fill the release description:
    ```
-    <!-- Substitute x.y.z with the current release version -->
-
-    | Packages | Download                                                                                                                                               |
-    | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-    | rpm      | [![rpm](https://img.shields.io/badge/Falco-x.y.z-%2300aec7?style=flat-square)](https://dl.bintray.com/falcosecurity/rpm/falco-x.y.z-x86_64.rpm)        |
-    | deb      | [![deb](https://img.shields.io/badge/Falco-x.y.z-%2300aec7?style=flat-square)](https://dl.bintray.com/falcosecurity/deb/stable/falco-x.y.z-x86_64.deb) |
-    | tgz      | [![tgz](https://img.shields.io/badge/Falco-x.y.z-%2300aec7?style=flat-square)](https://dl.bintray.com/falcosecurity/bin/x86_64/falco-x.y.z-x86_64.deb) |
-
-    | Images                                                          |
-    | --------------------------------------------------------------- |
-    | `docker pull docker.io/falcosecurity/falco:_tag_`               |
-    | `docker pull docker.io/falcosecurity/falco-driver-loader:_tag_` |
-    | `docker pull docker.io/falcosecurity/falco-no-driver:_tag_`     |
-
    <!-- Copy the relevant part of the changelog here -->

    ### Statistics

-    | Merged PRs      | Number |
-    | --------------- | ------ |
-    | Not user-facing | x      |
-    | Release note    | x      |
-    | Total           | x      |
+    | Merged PRs        | Number  |
+    |-------------------|---------|
+    | Not user-facing   | x       |
+    | Release note      | x       |
+    | Total             | x       |

    <!-- Calculate stats and fill the above table -->
    ```

 - Finally, publish the release!

-### 3. Update the meeting notes
-
-For each release we archive the meeting notes in git for historical purposes.
-
- - The notes from the Falco meetings can be [found here](https://hackmd.io/6sEAlInlSaGnLz2FnFz21A).
-    - Note: There may be other notes from working groups that can optionally be added as well as needed.
- - Add the entire content of the document to a new file in [github.com/falcosecurity/community/tree/master/meeting-notes](https://github.com/falcosecurity/community/tree/master/meeting-notes) as a new file labeled `release-x.y.z.md`
- - Open up a pull request with the new change.
-
-
 ## Post-Release tasks

 Announce the new release to the world!
--- a/brand/README.md
+++ b/brand/README.md
@@ -15,21 +15,6 @@ There are 3 logos available for use in this directory. Use the primary logo unle

 The Falco logo is Apache 2 licensed and free to use in media and publication for the CNCF Falco project.

-### Colors
-
-| Name      | PMS  | RGB         |
-|-----------|------|-------------|
-| Teal      | 3125 |   0 174 199 |
-| Cool Gray |   11 |  83  86  90 |
-| Black     |      |   0   0   0 |
-| Blue-Gray | 7700 |  22 92 125  |
-| Gold      | 1375 | 255 158  27 |
-| Orange    |  171 | 255  92  57 |
-| Emerald   | 3278 |   0 155 119 |
-| Green     |  360 | 108 194  74 |
-
-The primary colors are those in the first two rows.
-
 ### Slogan

 > Cloud Native Runtime Security
--- a/brand/teal-logo.png
+++ b/brand/teal-logo.png
--- a/cmake/modules/CPackConfig.cmake
+++ b/cmake/modules/CPackConfig.cmake
@@ -25,29 +25,19 @@ set(CPACK_PROJECT_CONFIG_FILE "${PROJECT_SOURCE_DIR}/cmake/cpack/CMakeCPackOptio
 set(CPACK_STRIP_FILES "ON")
 set(CPACK_PACKAGE_RELOCATABLE "OFF")

-if(NOT CPACK_GENERATOR)
-    set(CPACK_GENERATOR DEB RPM TGZ)
-endif()
+set(CPACK_GENERATOR DEB RPM TGZ)

-message(STATUS "Using package generators: ${CPACK_GENERATOR}")
-message(STATUS "Package architecture: ${CMAKE_SYSTEM_PROCESSOR}")
 set(CPACK_DEBIAN_PACKAGE_SECTION "utils")
-
-if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86_64")
-  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
-endif()
-if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "aarch64")
-  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "arm64")
-endif()
+set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
 set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "https://www.falco.org")
-set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0)")
+set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0), libyaml-0-2")
 set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
    "${CMAKE_BINARY_DIR}/scripts/debian/postinst;${CMAKE_BINARY_DIR}/scripts/debian/prerm;${CMAKE_BINARY_DIR}/scripts/debian/postrm;${PROJECT_SOURCE_DIR}/cmake/cpack/debian/conffiles"
 )

 set(CPACK_RPM_PACKAGE_LICENSE "Apache v2.0")
 set(CPACK_RPM_PACKAGE_URL "https://www.falco.org")
-set(CPACK_RPM_PACKAGE_REQUIRES "dkms, kernel-devel, ncurses")
+set(CPACK_RPM_PACKAGE_REQUIRES "dkms, kernel-devel, libyaml, ncurses")
 set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/postinstall")
 set(CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/preuninstall")
 set(CPACK_RPM_POST_UNINSTALL_SCRIPT_FILE "${CMAKE_BINARY_DIR}/scripts/rpm/postuninstall")
--- a/cmake/modules/DownloadCxxOpts.cmake
+++ b/cmake/modules/DownloadCxxOpts.cmake
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-include(ExternalProject)
-
-set(CXXOPTS_PREFIX ${CMAKE_BINARY_DIR}/cxxopts-prefix)
-set(CXXOPTS_INCLUDE ${CXXOPTS_PREFIX}/include)
-message(STATUS "Using bundled cxxopts in ${CXXOPTS_INCLUDE}")
-
-ExternalProject_Add(
-  cxxopts
-  PREFIX ${CXXOPTS_PREFIX}
-  GIT_REPOSITORY "https://github.com/jarro2783/cxxopts.git"
-  GIT_TAG "master"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ${CMAKE_COMMAND} -E copy ${CXXOPTS_PREFIX}/src/cxxopts/include/cxxopts.hpp
-                  ${CXXOPTS_INCLUDE}/cxxopts.hpp)
--- a/cmake/modules/DownloadStringViewLite.cmake
+++ b/cmake/modules/DownloadStringViewLite.cmake
@@ -15,7 +15,7 @@ include(ExternalProject)

 set(STRING_VIEW_LITE_PREFIX ${CMAKE_BINARY_DIR}/string-view-lite-prefix)
 set(STRING_VIEW_LITE_INCLUDE ${STRING_VIEW_LITE_PREFIX}/include)
-message(STATUS "Using bundled string-view-lite in ${STRING_VIEW_LITE_INCLUDE}")
+message(STATUS "Found string-view-lite: include: ${STRING_VIEW_LITE_INCLUDE}")

 ExternalProject_Add(
  string-view-lite
--- a/cmake/modules/OpenSSL.cmake
+++ b/cmake/modules/OpenSSL.cmake
@@ -32,10 +32,10 @@ else()
  ExternalProject_Add(
    openssl
    # START CHANGE for CVE-2017-3735, CVE-2017-3731, CVE-2017-3737, CVE-2017-3738, CVE-2017-3736
-    URL "https://github.com/openssl/openssl/archive/OpenSSL_1_0_2n.tar.gz"
-    URL_HASH "SHA256=4f4bc907caff1fee6ff8593729e5729891adcee412049153a3bb4db7625e8364"
+    URL "https://s3.amazonaws.com/download.draios.com/dependencies/openssl-1.0.2n.tar.gz"
+    URL_HASH "SHA256=370babb75f278c39e0c50e8c4e7493bc0f18db6867478341a832a982fd15a8fe"
    # END CHANGE for CVE-2017-3735, CVE-2017-3731, CVE-2017-3737, CVE-2017-3738, CVE-2017-3736
-    CONFIGURE_COMMAND ./config no-shared --prefix=${OPENSSL_INSTALL_DIR}
+    CONFIGURE_COMMAND ./config shared --prefix=${OPENSSL_INSTALL_DIR}
    BUILD_COMMAND ${CMD_MAKE}
    BUILD_IN_SOURCE 1
    INSTALL_COMMAND ${CMD_MAKE} install)
--- a/cmake/modules/b64.cmake
+++ b/cmake/modules/b64.cmake
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
-message(STATUS "Using bundled b64 in '${B64_SRC}'")
-set(B64_INCLUDE "${B64_SRC}/include")
-set(B64_LIB "${B64_SRC}/src/libb64.a")
-externalproject_add(
-  b64
-  URL "https://github.com/libb64/libb64/archive/ce864b17ea0e24a91e77c7dd3eb2d1ac4175b3f0.tar.gz"
-  URL_HASH "SHA256=d07173e66f435e5c77dbf81bd9313f8d0e4a3b4edd4105a62f4f8132ba932811"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${B64_LIB}
-  INSTALL_COMMAND ""
-)
--- a/cmake/modules/cURL.cmake
+++ b/cmake/modules/cURL.cmake
@@ -19,15 +19,19 @@ else()
  set(CURL_INCLUDE_DIR "${CURL_BUNDLE_DIR}/include/")
  set(CURL_LIBRARIES "${CURL_BUNDLE_DIR}/lib/.libs/libcurl.a")

-  set(CURL_SSL_OPTION "--with-ssl=${OPENSSL_INSTALL_DIR}")
-  message(STATUS "Using bundled curl in '${CURL_BUNDLE_DIR}'")
-  message(STATUS "Using SSL for curl in '${CURL_SSL_OPTION}'")
+  if(NOT USE_BUNDLED_OPENSSL)
+    set(CURL_SSL_OPTION "--with-ssl")
+  else()
+    set(CURL_SSL_OPTION "--with-ssl=${OPENSSL_INSTALL_DIR}")
+    message(STATUS "Using bundled curl in '${CURL_BUNDLE_DIR}'")
+    message(STATUS "Using SSL for curl in '${CURL_SSL_OPTION}'")
+  endif()

  externalproject_add(
    curl
    DEPENDS openssl
    # START CHANGE for CVE-2017-8816, CVE-2017-8817, CVE-2017-8818, CVE-2018-1000007
-    URL "https://github.com/curl/curl/releases/download/curl-7_61_0/curl-7.61.0.tar.bz2"
+    URL "https://s3.amazonaws.com/download.draios.com/dependencies/curl-7.61.0.tar.bz2"
    URL_HASH "SHA256=5f6f336921cf5b84de56afbd08dfb70adeef2303751ffb3e570c936c6d656c9c"
    # END CHANGE for CVE-2017-8816, CVE-2017-8817, CVE-2017-8818, CVE-2018-1000007
    CONFIGURE_COMMAND
--- a/cmake/modules/gRPC.cmake
+++ b/cmake/modules/gRPC.cmake
@@ -96,17 +96,12 @@ else()
  # that zlib will be very outdated
  set(ZLIB_INCLUDE "${GRPC_SRC}/third_party/zlib")
  set(ZLIB_LIB "${GRPC_LIBS_ABSOLUTE}/libz.a")
-  # we tell gRPC to compile c-ares for us because when a gRPC package is not available, like on CentOS, it's very likely
-  # that c-ares will be very outdated
-  set(CARES_INCLUDE "${GRPC_SRC}/third_party/cares" "${GRPC_SRC}/third_party/cares/cares")
-  set(CARES_LIB "${GRPC_LIBS_ABSOLUTE}/libares.a")

  message(STATUS "Using bundled gRPC in '${GRPC_SRC}'")
  message(
    STATUS
      "Bundled gRPC comes with protobuf: compiler: ${PROTOC}, include: ${PROTOBUF_INCLUDE}, lib: ${PROTOBUF_LIB}")
  message(STATUS "Bundled gRPC comes with zlib: include: ${ZLIB_INCLUDE}, lib: ${ZLIB_LIB}}")
-  message(STATUS "Bundled gRPC comes with cares: include: ${CARES_INCLUDE}, lib: ${CARES_LIB}}")
  message(STATUS "Bundled gRPC comes with gRPC C++ plugin: include: ${GRPC_CPP_PLUGIN}")

  get_filename_component(PROTOC_DIR ${PROTOC} PATH)
@@ -115,8 +110,8 @@ else()
    grpc
    DEPENDS openssl
    GIT_REPOSITORY https://github.com/grpc/grpc.git
-    GIT_TAG v1.32.0
-    GIT_SUBMODULES "third_party/protobuf third_party/zlib third_party/cares/cares third_party/abseil-cpp third_party/re2"
+    GIT_TAG v1.25.0
+    GIT_SUBMODULES "third_party/protobuf third_party/zlib third_party/cares/cares"
    BUILD_IN_SOURCE 1
    BUILD_BYPRODUCTS ${GRPC_LIB} ${GRPCPP_LIB}
    INSTALL_COMMAND ""
@@ -126,8 +121,6 @@ else()
      HAS_SYSTEM_ZLIB=false
      HAS_SYSTEM_PROTOBUF=false
      HAS_SYSTEM_CARES=false
-      HAS_EMBEDDED_OPENSSL_ALPN=false
-      HAS_SYSTEM_OPENSSL_ALPN=true
      PKG_CONFIG_PATH=${OPENSSL_BUNDLE_DIR}
      PKG_CONFIG=${PKG_CONFIG_EXECUTABLE}
      PATH=${PROTOC_DIR}:$ENV{PATH}
--- a/cmake/modules/jq.cmake
+++ b/cmake/modules/jq.cmake
@@ -10,44 +10,26 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 #
-if (NOT USE_BUNDLED_DEPS)
-    find_path(JQ_INCLUDE jq.h PATH_SUFFIXES jq)
-    find_library(JQ_LIB NAMES jq)
-    if (JQ_INCLUDE AND JQ_LIB)
-        message(STATUS "Found jq: include: ${JQ_INCLUDE}, lib: ${JQ_LIB}")
-    else ()
-        message(FATAL_ERROR "Couldn't find system jq")
-    endif ()
-else ()
-    set(JQ_SRC "${PROJECT_BINARY_DIR}/jq-prefix/src/jq")
-    message(STATUS "Using bundled jq in '${JQ_SRC}'")
-    set(JQ_INCLUDE "${JQ_SRC}/target/include")
-    set(JQ_INSTALL_DIR "${JQ_SRC}/target")
-    set(JQ_LIB "${JQ_INSTALL_DIR}/lib/libjq.a")
-    set(ONIGURUMA_LIB "${JQ_INSTALL_DIR}/lib/libonig.a")
-    message(STATUS "Bundled jq: include: ${JQ_INCLUDE}, lib: ${JQ_LIB}")
-
-    # Why we mirror jq here?
-    #
-    # In their readme, jq claims that you don't have
-    # to do autoreconf -fi when downloading a released tarball.
-    #
-    # However, they forgot to push the released makefiles
-    # into their release tarbal.
-    #
-    # For this reason, we have to mirror their release after
-    # doing the configuration ourselves.
-    #
-    # This is needed because many distros do not ship the right
-    # version of autoreconf, making virtually impossible to build Falco on them.
-    # Read more about it here:
-    #   https://github.com/stedolan/jq/issues/2061#issuecomment-593445920
-    ExternalProject_Add(
-            jq
-            URL "https://dl.bintray.com/falcosecurity/dependencies/jq-1.6.tar.gz"
-            URL_HASH "SHA256=787518068c35e244334cc79b8e56b60dbab352dff175b7f04a94f662b540bfd9"
-            CONFIGURE_COMMAND ./configure --disable-maintainer-mode --enable-all-static --disable-dependency-tracking --with-oniguruma=builtin --prefix=${JQ_INSTALL_DIR}
-            BUILD_COMMAND ${CMD_MAKE} LDFLAGS=-all-static
-            BUILD_IN_SOURCE 1
-            INSTALL_COMMAND ${CMD_MAKE} install)
-endif ()
+if(NOT USE_BUNDLED_DEPS)
+  find_path(JQ_INCLUDE jq.h PATH_SUFFIXES jq)
+  find_library(JQ_LIB NAMES jq)
+  if(JQ_INCLUDE AND JQ_LIB)
+    message(STATUS "Found jq: include: ${JQ_INCLUDE}, lib: ${JQ_LIB}")
+  else()
+    message(FATAL_ERROR "Couldn't find system jq")
+  endif()
+else()
+  set(JQ_SRC "${PROJECT_BINARY_DIR}/jq-prefix/src/jq")
+  message(STATUS "Using bundled jq in '${JQ_SRC}'")
+  set(JQ_INCLUDE "${JQ_SRC}")
+  set(JQ_LIB "${JQ_SRC}/.libs/libjq.a")
+  ExternalProject_Add(
+    jq
+    URL "https://github.com/stedolan/jq/releases/download/jq-1.5/jq-1.5.tar.gz"
+    URL_HASH "SHA256=c4d2bfec6436341113419debf479d833692cc5cdab7eb0326b5a4d4fbe9f493c"
+    CONFIGURE_COMMAND ./configure --disable-maintainer-mode --enable-all-static --disable-dependency-tracking
+    BUILD_COMMAND ${CMD_MAKE} LDFLAGS=-all-static
+    BUILD_IN_SOURCE 1
+    PATCH_COMMAND curl -L https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd.patch | patch
+    INSTALL_COMMAND "")
+endif()
--- a/cmake/modules/libyaml.cmake
+++ b/cmake/modules/libyaml.cmake
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LIBYAML_SRC "${PROJECT_BINARY_DIR}/libyaml-prefix/src/libyaml")
-set(LIBYAML_INSTALL_DIR "${LIBYAML_SRC}/target")
-message(STATUS "Using bundled libyaml in '${LIBYAML_SRC}'")
-set(LIBYAML_LIB "${LIBYAML_SRC}/src/.libs/libyaml.a")
-externalproject_add(
-  libyaml
-  URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
-  URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
-  CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LIBYAML_LIB}
-  INSTALL_COMMAND ${CMD_MAKE} install
-)
--- a/cmake/modules/lpeg.cmake
+++ b/cmake/modules/lpeg.cmake
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
-set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
-message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
-set(LPEG_DEPENDENCIES "")
-list(APPEND LPEG_DEPENDENCIES "luajit")
-ExternalProject_Add(
-  lpeg
-  DEPENDS ${LPEG_DEPENDENCIES}
-  URL "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz"
-  URL_HASH "SHA256=48d66576051b6c78388faad09b70493093264588fcd0f258ddaab1cdd4a15ffe"
-  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LPEG_LIB}
-  CONFIGURE_COMMAND ""
-  INSTALL_COMMAND "")
--- a/cmake/modules/luajit.cmake
+++ b/cmake/modules/luajit.cmake
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
-message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
-set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
-set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
-externalproject_add(
-  luajit
-  GIT_REPOSITORY "https://github.com/LuaJIT/LuaJIT"
-  GIT_TAG "1d8b747c161db457e032a023ebbff511f5de5ec2"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LUAJIT_LIB}
-  INSTALL_COMMAND ""
-)
--- a/cmake/modules/lyaml.cmake
+++ b/cmake/modules/lyaml.cmake
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
-set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
-message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
-externalproject_add(
-  lyaml
-  DEPENDS luajit libyaml
-  URL "https://github.com/gvvaughan/lyaml/archive/release-v6.0.tar.gz"
-  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LYAML_LIB}
-  CONFIGURE_COMMAND ./configure --enable-static CFLAGS=-I${LIBYAML_INSTALL_DIR}/include CPPFLAGS=-I${LIBYAML_INSTALL_DIR}/include LDFLAGS=-L${LIBYAML_INSTALL_DIR}/lib LIBS=-lyaml LUA=${LUAJIT_SRC}/luajit LUA_INCLUDE=-I${LUAJIT_INCLUDE}
-  INSTALL_COMMAND sh -c
-  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua"
-)
--- a/cmake/modules/static-analysis.cmake
+++ b/cmake/modules/static-analysis.cmake
@@ -1,42 +0,0 @@
-# create the reports folder
-file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports)
-file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck)
-
-# cppcheck
-find_program(CPPCHECK cppcheck)
-find_program(CPPCHECK_HTMLREPORT cppcheck-htmlreport)
-
-if(NOT CPPCHECK)
-  message(STATUS "cppcheck command not found, static code analysis using cppcheck will not be available.")
-else()
-  message(STATUS "cppcheck found at: ${CPPCHECK}")
-  # we are aware that cppcheck can be run
-  # along with the software compilation in a single step
-  # using the CMAKE_CXX_CPPCHECK variables.
-  # However, for practical needs we want to keep the
-  # two things separated and have a specific target for it.
-  # Our cppcheck target reads the compilation database produced by CMake
-  set(CMAKE_EXPORT_COMPILE_COMMANDS On)
-  add_custom_target(
-      cppcheck
-      COMMAND ${CPPCHECK}
-      "--enable=all"
-      "--force"
-      "--inconclusive"
-      "--inline-suppr" # allows to specify suppressions directly in source code
-      "--project=${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json" # use the compilation database as source
-      "--quiet"
-      "--xml" # we want to generate a report
-      "--output-file=${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck/cppcheck.xml" # generate the report under the reports folder in the build folder
-      "-i${CMAKE_CURRENT_BINARY_DIR}"# exclude the build folder
-  )
-endif() # CPPCHECK
-
-if(NOT CPPCHECK_HTMLREPORT)
-  message(STATUS "cppcheck-htmlreport command not found, will not be able to produce html reports for cppcheck results")
-else()
-  message(STATUS "cppcheck-htmlreport found at: ${CPPCHECK_HTMLREPORT}")
-  add_custom_target(
-    cppcheck_htmlreport
-    COMMAND ${CPPCHECK_HTMLREPORT} --title=${CMAKE_PROJECT_NAME} --report-dir=${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck --file=static-analysis-reports/cppcheck/cppcheck.xml)
-endif() # CPPCHECK_HTMLREPORT
--- a/cmake/modules/sysdig-repo/CMakeLists.txt
+++ b/cmake/modules/sysdig-repo/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -25,4 +25,4 @@ ExternalProject_Add(
  BUILD_COMMAND ""
  INSTALL_COMMAND ""
  TEST_COMMAND ""
-  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch && patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/luajit.patch)
+  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch)
--- a/cmake/modules/sysdig-repo/patch/libscap.patch
+++ b/cmake/modules/sysdig-repo/patch/libscap.patch
@@ -1,8 +1,8 @@
 diff --git a/userspace/libscap/scap.c b/userspace/libscap/scap.c
-index 6f51588e..5f9ea84e 100644
+index e9faea51..a1b3b501 100644
 --- a/userspace/libscap/scap.c
 +++ b/userspace/libscap/scap.c
-@@ -55,7 +55,7 @@ limitations under the License.
+@@ -52,7 +52,7 @@ limitations under the License.
 //#define NDEBUG
 #include <assert.h>
 
@@ -11,16 +11,7 @@ index 6f51588e..5f9ea84e 100644
 
 //
 // Probe version string size
-@@ -114,7 +114,7 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
- static uint32_t get_max_consumers()
- {
- 	uint32_t max;
-	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers", "r");
-+	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers", "r");
- 	if(pfile != NULL)
- 	{
- 		int w = fscanf(pfile, "%"PRIu32, &max);
-@@ -186,7 +186,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
+@@ -171,7 +171,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
 				return NULL;
 			}
 
@@ -29,27 +20,7 @@ index 6f51588e..5f9ea84e 100644
 			bpf_probe = buf;
 		}
 	}
-@@ -344,7 +344,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
- 				else if(errno == EBUSY)
- 				{
- 					uint32_t curr_max_consumers = get_max_consumers();
-					snprintf(error, SCAP_LASTERR_SIZE, "Too many sysdig instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
-+					snprintf(error, SCAP_LASTERR_SIZE, "Too many Falco instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
- 				}
- 				else
- 				{
-@@ -579,8 +579,8 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
- 	//
- 	// Map the ppm_ring_buffer_info that contains the buffer pointers
- 	//
-	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd), 
-		&handle->m_devs[0].m_bufinfo, 
-+	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd),
-+		&handle->m_devs[0].m_bufinfo,
- 		&handle->m_devs[0].m_bufstatus,
- 		error) != SCAP_SUCCESS)
- 	{
-@@ -2175,7 +2175,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
+@@ -1808,7 +1808,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
 
 const char* scap_get_host_root()
 {
--- a/cmake/modules/sysdig-repo/patch/luajit.patch
+++ b/cmake/modules/sysdig-repo/patch/luajit.patch
@@ -1,57 +0,0 @@
-diff --git a/userspace/libsinsp/chisel.cpp b/userspace/libsinsp/chisel.cpp
-index 0a6e3cf8..0c2e255a 100644
--- a/userspace/libsinsp/chisel.cpp
-+++ b/userspace/libsinsp/chisel.cpp
-@@ -98,7 +98,7 @@ void lua_stackdump(lua_State *L)
- // Lua callbacks
- ///////////////////////////////////////////////////////////////////////////////
- #ifdef HAS_LUA_CHISELS
-const static struct luaL_reg ll_sysdig [] =
-+const static struct luaL_Reg ll_sysdig [] =
- {
- 	{"set_filter", &lua_cbacks::set_global_filter},
- 	{"set_snaplen", &lua_cbacks::set_snaplen},
-@@ -134,7 +134,7 @@ const static struct luaL_reg ll_sysdig [] =
- 	{NULL,NULL}
- };
- 
-const static struct luaL_reg ll_chisel [] =
-+const static struct luaL_Reg ll_chisel [] =
- {
- 	{"request_field", &lua_cbacks::request_field},
- 	{"set_filter", &lua_cbacks::set_filter},
-@@ -146,7 +146,7 @@ const static struct luaL_reg ll_chisel [] =
- 	{NULL,NULL}
- };
- 
-const static struct luaL_reg ll_evt [] =
-+const static struct luaL_Reg ll_evt [] =
- {
- 	{"field", &lua_cbacks::field},
- 	{"get_num", &lua_cbacks::get_num},
-diff --git a/userspace/libsinsp/lua_parser.cpp b/userspace/libsinsp/lua_parser.cpp
-index 0e26617d..78810d96 100644
--- a/userspace/libsinsp/lua_parser.cpp
-+++ b/userspace/libsinsp/lua_parser.cpp
-@@ -32,7 +32,7 @@ extern "C" {
- #include "lauxlib.h"
- }
- 
-const static struct luaL_reg ll_filter [] =
-+const static struct luaL_Reg ll_filter [] =
- {
- 	{"rel_expr", &lua_parser_cbacks::rel_expr},
- 	{"bool_op", &lua_parser_cbacks::bool_op},
-diff --git a/userspace/libsinsp/lua_parser_api.cpp b/userspace/libsinsp/lua_parser_api.cpp
-index c89e9126..c3d8008a 100644
--- a/userspace/libsinsp/lua_parser_api.cpp
-+++ b/userspace/libsinsp/lua_parser_api.cpp
-@@ -266,7 +266,7 @@ int lua_parser_cbacks::rel_expr(lua_State *ls)
- 					string err = "Got non-table as in-expression operand\n";
- 					throw sinsp_exception("parser API error");
- 				}
-				int n = luaL_getn(ls, 4);  /* get size of table */
-+				int n = lua_objlen (ls, 4);  /* get size of table */
- 				for (i=1; i<=n; i++)
- 				{
- 					lua_rawgeti(ls, 4, i);
--- a/cmake/modules/sysdig.cmake
+++ b/cmake/modules/sysdig.cmake
@@ -17,26 +17,23 @@ set(SYSDIG_CMAKE_WORKING_DIR "${CMAKE_BINARY_DIR}/sysdig-repo")
 # this needs to be here at the top
 if(USE_BUNDLED_DEPS)
  # explicitly force this dependency to use the bundled OpenSSL
-  if(NOT MINIMAL_BUILD)
-    set(USE_BUNDLED_OPENSSL ON)
-  endif()
-  set(USE_BUNDLED_JQ ON)
+  set(USE_BUNDLED_OPENSSL ON)
 endif()

 file(MAKE_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})

-# The sysdig git reference (branch name, commit hash, or tag) To update sysdig version for the next release, change the
-# default below In case you want to test against another sysdig version just pass the variable - ie., `cmake
-# -DSYSDIG_VERSION=dev ..`
+# The sysdig git reference (branch name, commit hash, or tag)
+# To update sysdig version for the next release, change the default below
+# In case you want to test against another sysdig version just pass the variable - ie., `cmake -DSYSDIG_VERSION=dev ..`
 if(NOT SYSDIG_VERSION)
-  set(SYSDIG_VERSION "5c0b863ddade7a45568c0ac97d037422c9efb750")
-  set(SYSDIG_CHECKSUM "SHA256=9de717b3a4b611ea6df56afee05171860167112f74bb7717b394bcc88ac843cd")
+  set(SYSDIG_VERSION "96bd9bc560f67742738eb7255aeb4d03046b8045")
+  set(SYSDIG_CHECKSUM "SHA256=766e8952a36a4198fd976b9d848523e6abe4336612188e4fc911e217d8e8a00d")
 endif()
 set(PROBE_VERSION "${SYSDIG_VERSION}")

 # cd /path/to/build && cmake /path/to/source
-execute_process(COMMAND "${CMAKE_COMMAND}" -DSYSDIG_VERSION=${SYSDIG_VERSION} -DSYSDIG_CHECKSUM=${SYSDIG_CHECKSUM}
-                        ${SYSDIG_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
+execute_process(COMMAND "${CMAKE_COMMAND}" -DSYSDIG_VERSION=${SYSDIG_VERSION} -DSYSDIG_CHECKSUM=${SYSDIG_CHECKSUM} ${SYSDIG_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
+

 # todo(leodido, fntlnz) > use the following one when CMake version will be >= 3.13

@@ -57,10 +54,6 @@ add_subdirectory("${SYSDIG_SOURCE_DIR}/driver" "${PROJECT_BINARY_DIR}/driver")
 # Add libscap directory
 add_definitions(-D_GNU_SOURCE)
 add_definitions(-DHAS_CAPTURE)
-add_definitions(-DNOCURSESUI)
-if(MUSL_OPTIMIZED_BUILD)
-  add_definitions(-DMUSL_OPTIMIZED)
-endif()
 add_subdirectory("${SYSDIG_SOURCE_DIR}/userspace/libscap" "${PROJECT_BINARY_DIR}/userspace/libscap")

 # Add libsinsp directory
@@ -71,8 +64,5 @@ add_dependencies(sinsp tbb b64 luajit)
 set(CREATE_TEST_TARGETS OFF)

 if(USE_BUNDLED_DEPS)
-  add_dependencies(scap jq)
-  if(NOT MINIMAL_BUILD)
-    add_dependencies(scap curl grpc)
-  endif()
+  add_dependencies(scap grpc curl jq)
 endif()
--- a/docker/build/install-falco.yaml
+++ b/docker/build/install-falco.yaml
@@ -0,0 +1,45 @@
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: falco
+  namespace: falco
+  labels:
+    app: falco
+spec:
+  selector:
+    matchLabels:
+      app: falco
+  template:
+    metadata:
+      labels:
+        app: falco
+    spec:
+      tolerations:
+        - operator: Exists
+      hostPID: true
+      hostNetwork: true
+containers:
+  - name: falco-init
+    image: alpine
+    imagePullPolicy: Always
+    securityContext:
+      privileged: true
+lifecycle:
+  preStop:
+    exec:
+      command:
+        - "nsenter"
+        - "-t"
+        - "1"
+        - "-m"
+        - "--"
+        - "/bin/sh"
+        - "-c"
+        - |
+          #!/bin/bash
+          curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
+          echo "deb https://dl.bintray.com/falcosecurity/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
+          apt-get update -y
+          apt-get -y install linux-headers-$(uname -r)
+          apt-get install -y falco
+          exit 0
--- a/docker/builder/root/usr/bin/entrypoint
+++ b/docker/builder/root/usr/bin/entrypoint
@@ -34,7 +34,6 @@ case "$CMD" in
    -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
    -DCMAKE_INSTALL_PREFIX=/usr \
    -DBUILD_DRIVER="$BUILD_DRIVER" \
-    -DMINIMAL_BUILD="$MINIMAL_BUILD" \
    -DBUILD_BPF="$BUILD_BPF" \
    -DBUILD_WARNINGS_AS_ERRORS="$BUILD_WARNINGS_AS_ERRORS" \
    -DFALCO_VERSION="$FALCO_VERSION" \
--- a/docker/driver-loader/Dockerfile
+++ b/docker/driver-loader/Dockerfile
@@ -3,7 +3,7 @@ FROM falcosecurity/falco:${FALCO_IMAGE_TAG}

 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

-LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --name NAME IMAGE"
+LABEL usage="docker run -i -t -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"

 ENV HOST_ROOT /host
 ENV HOME /root
--- a/docker/falco/Dockerfile
+++ b/docker/falco/Dockerfile
@@ -2,7 +2,7 @@ FROM debian:stable

 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

-LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc --name NAME IMAGE"
+LABEL usage="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"

 ARG FALCO_VERSION=latest
 ARG VERSION_BUCKET=deb
--- a/docker/falco/docker-entrypoint.sh
+++ b/docker/falco/docker-entrypoint.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,14 +16,10 @@
 # limitations under the License.
 #

-# todo(leogr): remove deprecation notice within a couple of releases
-if [[ ! -z "${SKIP_MODULE_LOAD}" ]]; then
-    echo "* SKIP_MODULE_LOAD is deprecated and will be removed soon, use SKIP_DRIVER_LOADER instead"
-fi

-# Set the SKIP_DRIVER_LOADER variable to skip loading the driver
+# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module

-if [[ -z "${SKIP_DRIVER_LOADER}" ]] && [[ -z "${SKIP_MODULE_LOAD}" ]]; then
+if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
    echo "* Setting up /usr/src links from host"

    for i in "$HOST_ROOT/usr/src"/*
--- a/docker/local/docker-entrypoint.sh
+++ b/docker/local/docker-entrypoint.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -17,9 +17,9 @@
 #


-# Set the SKIP_DRIVER_LOADER variable to skip loading the driver
+# Set the SKIP_MODULE_LOAD variable to skip loading the kernel module

-if [[ -z "${SKIP_DRIVER_LOADER}" ]]; then
+if [[ -z "${SKIP_MODULE_LOAD}" ]]; then
    echo "* Setting up /usr/src links from host"

    for i in "$HOST_ROOT/usr/src"/*
--- a/docker/no-driver/Dockerfile
+++ b/docker/no-driver/Dockerfile
@@ -1,5 +1,7 @@
 FROM ubuntu:18.04 as ubuntu

+LABEL maintainer="cncf-falco-dev@lists.cncf.io"
+
 ARG FALCO_VERSION
 ARG VERSION_BUCKET=bin

@@ -10,23 +12,49 @@ WORKDIR /

 ADD https://bintray.com/api/ui/download/falcosecurity/${VERSION_BUCKET}/x86_64/falco-${FALCO_VERSION}-x86_64.tar.gz /

-RUN tar -xvf falco-${FALCO_VERSION}-x86_64.tar.gz && \
+RUN apt-get update -y && \
+    apt-get install -y libyaml-0-2 binutils && \
+    tar -xvf falco-${FALCO_VERSION}-x86_64.tar.gz && \
    rm -f falco-${FALCO_VERSION}-x86_64.tar.gz && \
    mv falco-${FALCO_VERSION}-x86_64 falco && \
-    rm -rf falco/usr/src/falco-* falco/usr/bin/falco-driver-loader
+    strip falco/usr/bin/falco && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*

 RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \
    && mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml

 FROM scratch

-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
+COPY --from=ubuntu /lib/x86_64-linux-gnu/libanl.so.1 \
+    /lib/x86_64-linux-gnu/libc.so.6 \
+    /lib/x86_64-linux-gnu/libdl.so.2 \
+    /lib/x86_64-linux-gnu/libgcc_s.so.1 \
+    /lib/x86_64-linux-gnu/libm.so.6 \
+    /lib/x86_64-linux-gnu/libnsl.so.1 \
+    /lib/x86_64-linux-gnu/libnss_compat.so.2 \
+    /lib/x86_64-linux-gnu/libnss_files.so.2 \
+    /lib/x86_64-linux-gnu/libnss_nis.so.2 \
+    /lib/x86_64-linux-gnu/libpthread.so.0 \
+    /lib/x86_64-linux-gnu/librt.so.1 \
+    /lib/x86_64-linux-gnu/libz.so.1 \
+    /lib/x86_64-linux-gnu/

-LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE"
-# NOTE: for the "least privileged" use case, please refer to the official documentation
+COPY --from=ubuntu /usr/lib/x86_64-linux-gnu/libstdc++.so.6 \
+    /usr/lib/x86_64-linux-gnu/libstdc++.so.6

-ENV HOST_ROOT /host
-ENV HOME /root
+COPY --from=ubuntu /usr/lib/x86_64-linux-gnu/libyaml-0.so.2.0.5 \
+    /usr/lib/x86_64-linux-gnu/libyaml-0.so.2
+
+COPY --from=ubuntu /etc/ld.so.cache \
+    /etc/nsswitch.conf \
+    /etc/ld.so.cache \
+    /etc/passwd \
+    /etc/group \
+    /etc/
+
+COPY --from=ubuntu /etc/default/nss /etc/default/nss
+COPY --from=ubuntu /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2

 COPY --from=ubuntu /falco /

--- a/docker/tester/Dockerfile
+++ b/docker/tester/Dockerfile
@@ -1,20 +1,16 @@
 FROM fedora:31

 LABEL name="falcosecurity/falco-tester"
-LABEL usage="docker run -v /boot:/boot:ro -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/..:/source -v $PWD/build:/build --name <name> falcosecurity/falco-tester test"
+LABEL usage="docker run -v /boot:/boot:ro -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/..:/source -v $PWD/build:/build -e FALCO_VERSION=<current_falco_version> --name <name> falcosecurity/falco-tester test"
 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

 ENV FALCO_VERSION=
 ENV BUILD_TYPE=release

-ADD https://github.com/fullstorydev/grpcurl/releases/download/v1.6.0/grpcurl_1.6.0_linux_x86_64.tar.gz /
 RUN dnf install -y python-pip python docker findutils jq unzip && dnf clean all
 ENV PATH="/root/.local/bin/:${PATH}"
 RUN pip install --user avocado-framework==69.0
 RUN pip install --user avocado-framework-plugin-varianter-yaml-to-mux==69.0
-RUN pip install --user watchdog==0.10.2
-RUN pip install --user pathtools==0.1.2
-RUN tar -C /usr/bin -xvf grpcurl_1.6.0_linux_x86_64.tar.gz

 COPY ./root /

--- a/docker/tester/root/runners/deb.Dockerfile
+++ b/docker/tester/root/runners/deb.Dockerfile
@@ -6,7 +6,7 @@ RUN test -n FALCO_VERSION
 ENV FALCO_VERSION ${FALCO_VERSION}

 RUN apt update -y
-RUN apt install dkms -y
+RUN apt install dkms libyaml-0-2 -y

 ADD falco-${FALCO_VERSION}-x86_64.deb /
 RUN dpkg -i /falco-${FALCO_VERSION}-x86_64.deb
--- a/docker/tester/root/runners/tar.gz.Dockerfile
+++ b/docker/tester/root/runners/tar.gz.Dockerfile
@@ -6,7 +6,7 @@ RUN test -n FALCO_VERSION
 ENV FALCO_VERSION ${FALCO_VERSION}

 RUN apt update -y
-RUN apt install dkms curl -y
+RUN apt install dkms libyaml-0-2 curl -y

 ADD falco-${FALCO_VERSION}-x86_64.tar.gz /
 RUN cp -R /falco-${FALCO_VERSION}-x86_64/* /
--- a/docker/tester/root/usr/bin/entrypoint
+++ b/docker/tester/root/usr/bin/entrypoint
@@ -1,15 +1,12 @@
 #!/usr/bin/env bash

-BUILD_DIR=${BUILD_DIR:-/build}
-SOURCE_DIR=${SOURCE_DIR:-/source}
-SKIP_PACKAGES_TESTS=${SKIP_PACKAGES_TESTS:-false}
+set -eu -o pipefail

+SOURCE_DIR=/source
+BUILD_DIR=/build
 CMD=${1:-test}
 shift

-# Stop the execution if a command in the pipeline has an error, from now on
-set -e -u -o pipefail
-
 # build type can be "debug" or "release", fallbacks to "release" by default
 BUILD_TYPE=$(echo "$BUILD_TYPE" | tr "[:upper:]" "[:lower:]")
 case "$BUILD_TYPE" in
@@ -50,8 +47,7 @@ case "$CMD" in
 "test")
    if [ -z "$FALCO_VERSION" ]; then
        echo "Automatically figuring out Falco version."
-        FALCO_VERSION_FULL=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version)
-        FALCO_VERSION=$(echo "$FALCO_VERSION_FULL" | head -n 1 | cut -d' ' -f3  | tr -d '\r')
+        FALCO_VERSION=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version | head -n 1 | cut -d' ' -f3 | tr -d '\r')
        echo "Falco version: $FALCO_VERSION"
    fi
    if [ -z "$FALCO_VERSION" ]; then
@@ -60,11 +56,9 @@ case "$CMD" in
    fi

    # build docker images
-    if [ "$SKIP_PACKAGES_TESTS" = false ] ; then
-        build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "deb"
-        build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "rpm"
-        build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "tar.gz"
-    fi
+    build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "deb"
+    build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "rpm"
+    build_image "$BUILD_DIR" "$BUILD_TYPE" "$FALCO_VERSION" "tar.gz"

    # check that source directory contains Falco
    if [ ! -d "$SOURCE_DIR/falco/test" ]; then
@@ -75,14 +69,12 @@ case "$CMD" in
    # run tests
    echo "Running regression tests ..."
    cd "$SOURCE_DIR/falco/test"
-    SKIP_PACKAGES_TESTS=$SKIP_PACKAGES_TESTS ./run_regression_tests.sh -d "$BUILD_DIR/$BUILD_TYPE"
+    ./run_regression_tests.sh "$BUILD_DIR/$BUILD_TYPE"

    # clean docker images
-    if [ "$SKIP_PACKAGES_TESTS" = false ] ; then
-        clean_image "deb"
-        clean_image "rpm"
-        clean_image "tar.gz"
-    fi
+    clean_image "deb"
+    clean_image "rpm"
+    clean_image "tar.gz"
    ;;
 "bash")
    CMD=/bin/bash
--- a/falco.yaml
+++ b/falco.yaml
@@ -139,7 +139,7 @@ stdout_output:
 webserver:
  enabled: true
  listen_port: 8765
-  k8s_audit_endpoint: /k8s-audit
+  k8s_audit_endpoint: /k8s_audit
  ssl_enabled: false
  ssl_certificate: /etc/falco/falco.pem

@@ -182,8 +182,7 @@ http_output:
 # grpc:
 #   enabled: true
 #   bind_address: "0.0.0.0:5060"
-#   # when threadiness is 0, Falco sets it by automatically figuring out the number of online cores
-#   threadiness: 0
+#   threadiness: 8
 #   private_key: "/etc/falco/certs/server.key"
 #   cert_chain: "/etc/falco/certs/server.crt"
 #   root_certs: "/etc/falco/certs/ca.crt"
@@ -192,8 +191,7 @@ http_output:
 grpc:
  enabled: false
  bind_address: "unix:///var/run/falco.sock"
-  # when threadiness is 0, Falco automatically guesses it depending on the number of online cores
-  threadiness: 0
+  threadiness: 8

 # gRPC output service.
 # By default it is off.
--- a/proposals/20190826-grpc-outputs.md
+++ b/proposals/20190826-grpc-outputs.md
@@ -1,4 +1,4 @@
-# Falco gRPC Outputs
+# gRPC Falco Output

 <!-- toc -->

@@ -25,7 +25,7 @@ An alert is an "output" when it goes over a transport, and it is emitted by Falc

 At the current moment, however, Falco can deliver alerts in a very basic way, for example by dumping them to standard output.

-For this reason, many Falco users asked, with issues - eg., [falco#528](https://github.com/falcosecurity/falco/issues/528) - or in the [slack channel](https://slack.k8s.io) if we can find a more consumable way to implement Falco outputs in an extensible way.
+For this reason, many Falco users asked, with issues - eg., [falco#528](https://github.com/falcosecurity/falco/issues/528) - or in the [slack channel](https://sysdig.slack.com) if we can find a more consumable way to implement Falco outputs in an extensible way.

 The motivation behind this proposal is to design a new output implementation that can meet our user's needs.

@@ -39,10 +39,7 @@ The motivation behind this proposal is to design a new output implementation tha
 - To continue supporting the old output formats by implementing their same interface
 - To be secure by default (**mutual TLS** authentication)
 - To be **asynchronous** and **non-blocking**
- To provide a connection over unix socket (no authentication)
- To implement a Go client
- To implement a Rust client
- To implement a Python client
+- To implement a Go SDK

 ### Non-Goals

@@ -80,25 +77,26 @@ syntax = "proto3";
 import "google/protobuf/timestamp.proto";
 import "schema.proto";

-package falco.outputs;
+package falco.output;

-option go_package = "github.com/falcosecurity/client-go/pkg/api/outputs";
+option go_package = "github.com/falcosecurity/client-go/pkg/api/output";

-// This service defines the RPC methods
-// to `request` a stream of output `response`s.
+// The `subscribe` service defines the RPC call
+// to perform an output `request` which will lead to obtain an output `response`.
 service service {
-  // Subscribe to a stream of Falco outputs by sending a stream of requests.
-  rpc sub(stream request) returns (stream response);
-  // Get all the Falco outputs present in the system up to this call.
-  rpc get(request) returns (stream response);
+  rpc subscribe(request) returns (stream response);
 }

 // The `request` message is the logical representation of the request model.
-// It is the input of the `output.service` service.
+// It is the input of the `subscribe` service.
+// It is used to configure the kind of subscription to the gRPC streaming server.
 message request {
+  bool keepalive = 1;
+  // string duration = 2; // TODO(leodido, fntlnz): not handled yet but keeping for reference.
+  // repeated string tags = 3; // TODO(leodido, fntlnz): not handled yet but keeping for reference.
 }

-// The `response` message is the representation of the output model.
+// The `response` message is the logical representation of the output model.
 // It contains all the elements that Falco emits in an output along with the
 // definitions for priorities and source.
 message response {
@@ -108,7 +106,7 @@ message response {
  string rule = 4;
  string output = 5;
  map<string, string> output_fields = 6;
-  string hostname = 7;
+  // repeated string tags = 7; // TODO(leodido,fntlnz): tags not supported yet, keeping for reference
 }
 ```

--- a/proposals/20200506-artifacts-scope-part-1.md
+++ b/proposals/20200506-artifacts-scope-part-1.md
@@ -4,7 +4,7 @@ The **Falco Artifact Scope** proposal is divided in two parts:
 1. the Part 1 - *this document*: the State of Art of Falco artifacts
 2. the [Part 2](./20200506-artifacts-scope-part-2.md): the intended state moving forward

-## Summary
+## Summary 

 As a project we would like to support the following artifacts.

@@ -16,7 +16,7 @@ Inspired by many previous issues and many of the weekly community calls.

 ## Terms

-**falco**
+**falco** 

 *The Falco binary*

@@ -30,12 +30,12 @@ Inspired by many previous issues and many of the weekly community calls.

 **package**

-*An installable artifact that is operating system specific. All packages MUST be hosted on [bintray](https://bintray.com/falcosecurity).*
+*An installable artifact that is operating system specific. All packages MUST be hosted on bintray.*

 **image**

 *OCI compliant container image hosted on dockerhub with tags for every release and the current master branch.*
-
+ 

 # Packages

@@ -52,11 +52,11 @@ List of currently official container images (for X86 64bits only):

 | Name | Directory | Description |
 |---|---|---|
-| [falcosecurity/falco:latest](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:master](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/stable | Falco (DEB built from git tag or from the master) with all the building toolchain. |
-| [falcosecurity/falco:latest-slim](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_-slim](https://hub.docker.com/repository/docker/falcosecurity/falco),[falcosecurity/falco:master-slim](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/slim | Falco (DEB build from git tag or from the master) without the building toolchain. |
-| [falcosecurity/falco-driver-loader:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:master](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader) | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. |
-| [falcosecurity/falco-builder:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-builder) | docker/builder | The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source. Used to build Falco (CI). |
-| [falcosecurity/falco-tester:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-tester) | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests (CI). |
+| [falcosecurity/falco:latest](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:master](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/stable | Falco (DEB built from git tag or from the master) with all the building toolchain. | 
+| [falcosecurity/falco:latest-slim](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_-slim](https://hub.docker.com/repository/docker/falcosecurity/falco),[falcosecurity/falco:master-slim](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/slim | Falco (DEB build from git tag or from the master) without the building toolchain. | 
+| [falcosecurity/falco-driver-loader:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:master](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader) | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. | 
+| [falcosecurity/falco-builder:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-builder) | docker/builder | The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source. Used to build Falco (CI). | 
+| [falcosecurity/falco-tester:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-tester) | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests (CI). | 
 | _to not be published_ | docker/local | Built on-the-fly and used by falco-tester. |

 **Note**: `falco-builder`, `falco-tester` (and the `docker/local` image which it's built on the fly by the `falco-tester` one) are not integrated into the release process because they are development and CI tools that need to be manually pushed only when updated.
@@ -76,7 +76,7 @@ This new [contrib](https://github.com/falcosecurity/contrib) repository will be

 ### repository

-"_Incubating level_" projects such as [falco-exporter](https://github.com/falco-exporter) can be promoted from `contrib` to their own repository.
+"_Incubating level_" projects such as [falco-exporter](https://github.com/falco-exporter) can be promoted from `contrib` to their own repository. 

 This is done as needed, and can best be measured by the need to cut a release and use the GitHub release features. Again, this is at the discretion of the Falco open source community.

@@ -92,7 +92,7 @@ The *Part 1* is mainly intended as a cleanup process.
 For each item not listed above, ask if it needs to be moved or deleted.
 After the cleanup process, all items will match the *Part 1* of this proposal.

-
+    
 ### Action Items

 Here are SOME of the items that would need to be done, for example:
--- a/proposals/20200818-artifacts-storage.md
+++ b/proposals/20200818-artifacts-storage.md
@@ -1,83 +0,0 @@
-# Falco Artifacts Storage
-
-This document reflects the way we store the Falco artifacts.
-
-## Terms & Definitions
-
- [Falco artifacts](./20200506-artifacts-scope-part-1.md)
- Bintray: artifacts distribution platform
-
-## Packages
-
-The Falco packages are **automatically** built and sent to [bintray](https://bintray.com/falcosecurity) in the following cases:
-
- a pull request gets merged into the master branch (**Falco development releases**)
- a new Falco release (git tag) happens on the master branch (**Falco stable releases**)
-
-The only prerequisite is that the specific Falco source code builds successfully and that the tests pass.
-
-As per [Falco Artifacts Scope (#1)](./20200506-artifacts-scope-part-1.md) proposal we provide three kind of Falco packages:
-
- DEB
- RPM
- Tarball
-
-Thus, we have three repositories for the Falco stable releases:
-
- https://bintray.com/falcosecurity/deb
- https://bintray.com/falcosecurity/rpm
- https://bintray.com/falcosecurity/bin
-
-And three repositories for the Falco development releases:
-
- https://bintray.com/falcosecurity/deb-dev
- https://bintray.com/falcosecurity/rpm-dev
- https://bintray.com/falcosecurity/bin-dev
-
-## Drivers
-
-The process of publishing a set of prebuilt Falco drivers is implemented by the **Drivers Build Grid (DBG)** in the [test-infra](https://github.com/falcosecurity/test-infra/tree/master/driverkit) repository (`driverkit` directory).
-
-This process is driven by the configuration files (YAML) present in the `driverkit/config` directory in the [test-infra](https://github.com/falcosecurity/test-infra/tree/master/driverkit) repository.
-
-Each of these files represents a prebuilt driver (eventually two: kernel module and eBPF probe, when possible) that will be published on [bintray](https://bintray.com/falcosecurity) if it builds correctly.
-
-Every time the `driverkit/config` directory on the master branch has some changes from the previous commit the CI system, which you can find defined in the [.circleci/config.yml](https://github.com/falcosecurity/test-infra/blob/master/.circleci/config.yml) file, takes care of building and publishing all the drivers.
-
-The driver versions we ship prebuilt drivers for are:
-
- the driver version associated with the last Falco stable version ([see here](https://github.com/falcosecurity/falco/blob/c4b7f17271d1a4ca533b2e672ecaaea5289ccdc5/cmake/modules/sysdig.cmake#L29))
- the driver version associated with the penultimate Falco stable version
-
-The prebuilt drivers get published into [this](https://bintray.com/falcosecurity/driver) generic artifacts repository.
-
-You can also visualize the full list of prebuilt drivers by driver version visiting this [URL](https://dl.bintray.com/falcosecurity/driver).
-
-### Notice
-
-The generation of new prebuilt drivers takes usually place with a frequency of 1-2 weeks, on a **best-effort** basis.
-
-Thus, it can happen the list of available prebuilt drivers does not yet contain the driver version currently on Falco master.
-
-Nevertheless, this process is an open, auditable, and transparent one.
-
-So, by sending a pull-request towards [test-infra](https://github.com/falcosecurity/test-infra) repository containing the configuration YAML files you can help the Falco community stay on track.
-
-Some pull-requests you can look at to create your own are:
-
- https://github.com/falcosecurity/test-infra/pull/165
- https://github.com/falcosecurity/test-infra/pull/163
- https://github.com/falcosecurity/test-infra/pull/162
-
-While, the documentation of the YAML configuration files can be found [here](https://github.com/falcosecurity/driverkit/blob/master/README.md).
-
-## Container images
-
-As per Falco packages, also the Falco official container images are **automatically** published to the [dockerhub](https://hub.docker.com/r/falcosecurity/falco).
-
-These images are built and published in two cases:
-
- a pull request gets merged into the master branch (**Falco development releases**)
- a new Falco release (git tag) happens (**Falco stable releases**)
-
-For a detailed explanation of the container images we build and ship look at the following [documentation](https://github.com/falcosecurity/falco/blob/master/docker/README.md).
--- a/proposals/20200901-artifacts-cleanup.md
+++ b/proposals/20200901-artifacts-cleanup.md
@@ -1,102 +0,0 @@
-# Falco Artifacts Cleanup
-
-This document reflects when and how we clean up the Falco artifacts from their storage location.
-
-## Motivation
-
-The [bintray](https://bintray.com/falcosecurity) open-source plan offers 10GB free space for storing artifacts.
-
-They also kindly granted us an additional 5GB of free space.
-
-## Goal
-
-Keep the storage space usage under 15GB by cleaning up the [Falco artifacts](./20200506-artifacts-scope-part-1.md) from the [storage](./20200818-artifacts-storage).
-
-## Status
-
-To be implemented.
-
-## Packages
-
-### Tarballs from Falco master
-
-At the moment of writing this document, this kind of Falco package requires approx. 50MB (maximum detected size) of storage space.
-
-Since, historically, the [bin-dev](https://bintray.com/falcosecurity/bin-dev) repository is the less used one, this document proposes to keep only the last 10 **Falco development releases** it contains.
-
-This means that the [bin-dev](https://bintray.com/falcosecurity/bin-dev) repository will take at maximum 500MB of storage space.
-
-### DEB from Falco master
-
-At the moment of writing this document, this kind of Falco package requires approx. 5.1MB (maximum detected size) of storage space.
-
-Historically, every Falco release is composed by less than 50 merges (upper limit).
-
-So, to theoretically retain all the **Falco development releases** that led to a Falco stable release, this document proposes to keep the last 50 Falco DEB packages.
-
-This means that the [deb-dev](https://bintray.com/falcosecurity/deb-dev) repository will take at maximum 255MB of storage space.
-
-### RPM from Falco master
-
-At the moment of writing this document, this kind of Falco package requires approx. 4.3MB (maximum detected size) of storage space.
-
-For the same exact reasons explained above this document proposes to keep the last 50 Falco RPM packages.
-
-This means that the [rpm-dev](https://bintray.com/falcosecurity/rpm-dev) repository will take at maximum 215MB of storage space.
-
-### Stable releases
-
-This document proposes to retain all the stable releases.
-
-This means that all the Falco packages present in the Falco stable release repositories will be kept.
-
-The [bin](https://bintray.com/falcosecurity/bin) repository contains a Falco tarball package for every release.
-This means it grows in space of ~50MB each month.
-
-The [deb](https://bintray.com/falcosecurity/deb) repository contains a Falco DEB package for every release.
-This means it grows in space of ~5MB each month.
-
-The [rpm](https://bintray.com/falcosecurity/rpm) repository contains a Falco RPM package for every release.
-This means it grows in space of ~4.3MB each month.
-
-### Considerations
-
-Assuming the size of the packages does not surpass the numbers listed in the above sections, the **Falco development releases** will always take less that 1GB of artifacts storage space.
-
-Assuming 12 stable releases at year, at the current size of packages, the **Falco stable releases** will take approx. 720MB of storage space every year.
-
-### Implementation
-
-The Falco CI will have a new CI job - called `cleanup/packages-dev` - responsible for removing the **Falco development releases** depending on the above plan.
-
-This job will be triggered after the `publish/packages-dev` completed successfully.
-
-## Drivers
-
-As explained in the [Artifacts Storage](./20200818-artifacts-storage) proposal, we build the drivers for the **last two driver versions** associated with **latest Falco stable releases**.
-Then, we store those drivers into a [generic bintray repository](https://bintray.com/falcosecurity/driver) from which the installation process automatically downloads them, if suitable.
-
-This document proposes to implement a cleanup mechanism that deletes all the other driver versions available.
-
-At the moment of writing, considering only the last two driver versions (**ae104eb**, **85c8895**) associated with the latest Falco stable releases, we ship ~340 eBPF drivers, each accounting for ~3.1MB of storage space, and 1512 kernel modules (~3.1MB size each, too).
-
-Thus, we obtain an estimate of approx. 2.875GB for **each** driver version.
-
-This document proposes to only store the last two driver versions associates with the latest Falco stable releases. And deleting the other ones.
-
-This way, assuming the number of prebuilt drivers does not skyrocket, we can reasonably estimate the storage space used by prebuilt drivers to be around 6GB.
-
-Notice that, in case a Falco stable release will not depend on a new driver version, this means the last two driver versions will, in this case, cover more than the two Falco stable releases.
-
-### Archivation
-
-Since the process of building drivers is time and resource consuming, this document also proposes to move the driver versions in other storage facilities.
-
-The candidate is an AWS S3 bucket responsible for holding the deleted driver version files.
-
-### Implementation
-
-The [test-infra](https://github.com/falcosecurity/test-infra) CI, specifically its part dedicated to run the **Drivers Build Grid** that runs every time it detects changes into the `driverkit` directory of the [test-infra](https://github.com/falcosecurity/test-infra) repository,
-will have a new job - called `drivers/cleanup` - responsible for removing all the Falco driver versions except the last two.
-
-This job will be triggered after the `drivers/publish` completed successfully on the master branch.
--- a/proposals/20201025-drivers-storage-s3.md
+++ b/proposals/20201025-drivers-storage-s3.md
@@ -1,137 +0,0 @@
-# Falco Drivers Storage S3
-
-Supersedes: [20200818-artifacts-storage.md#drivers](20200818-artifacts-storage.md#drivers)
-
-Supersedes: [20200901-artifacts-cleanup.md#drivers](20200901-artifacts-cleanup.md#drivers)
-
-## Introduction
-
-In the past days, as many people probably noticed, Bintray started rate-limiting our users, effectively preventing them from downloading any kernel module, rpm/deb package or any pre-built dependency we host there.
-
-This does not only interrupt the workflow of our users but also the workflow of the contributors, since without bintray most of our container images and CMake files can’t download the dependencies we mirror.
-
-### What is the cause?
-
-We had a spike in adoption apparently, either a user with many nodes or an increased number of users. We don’t know this detail specifically yet because bintray does not give us very fine-grained statistics on this.
-
-This is the 30-days history:
-
-![A spike on driver downloads the last ten days](20201025-drivers-storage-s3_downloads.png)
-
-As you can see, we can only see that they downloaded the latest kernel module driver version, however we can’t see if:
-
-* It’s a single source or many different users
-
-* What is the kernel/OS they are using
-
-### What do we host on Bintray?
-
-* RPM packages: high traffic but very manageable ~90k downloads a month
-
-* Deb packages:low traffic ~5k downloads a month
-
-* Pre-built image Dependencies: low traffic, will eventually disappear in the future
-
-* Kernel modules: very high traffic, 700k downloads in 10 days, this is what is causing the current problems. They are primarily used by users of our container images.
-
-* eBPF probes: low traffic ~5k downloads a month
-
-### Motivations to go to S3 instead of Bintray for the Drivers
-
-Bintray does an excellent service at building the rpm/deb structures for us, however we also use them for S3-like storage for the drivers. We have ten thousand files hosted there and the combinations are infinite.
-
-
-Before today, we had many issues with storage even without the spike in users we are seeing since the last ten days.
-
-## Context on AWS
-
-Amazon AWS, recently gave credits to the Falco project to operate some parts of the infrastructure on AWS. The CNCF is providing a sub-account we are already using for the migration of the other pieces (like Prow).
-
-## Interactions with other teams and the CNCF
-
-* The setup on the AWS account side already done, this is all technical work.
-
-* We need to open a CNCF service account ticket for the download.falco.org subdomain to point to the S3 bucket we want to use
-
-## The Plan
-
-We want to propose to move the drivers and the container dependencies to S3.
-
-#### Moving means:
-
-* We create a public S3 bucket with [stats enabled](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html)
-
-* We attach the bucket to a cloudfront distribution behind the download.falco.org subdomain
-
-* We move the current content keeping the same web server directory structure
-
-* We change the Falco Dockerfiles and driver loader script accordingly
-
-* We update test-infra to push the drivers to S3
-
-* Once we have the drivers in S3, we can ask bintray to relax the limits for this month so that our users are able to download the other packages we keep there. Otherwise they will have to wait until November 1st. We only want to do that after the moving because otherwise we will hit the limits pretty quickly.
-
-#### The repositories we want to move are:
-
-* [https://bintray.com/falcosecurity/driver](https://bintray.com/falcosecurity/driver) will become https://download.falco.org/driver
-
-* [https://bintray.com/falcosecurity/dependencies](https://bintray.com/falcosecurity/dependencies) will become https://download.falco.org/dependencies
-
-#### Changes in Falco
-
-* [Search for bintray ](https://github.com/falcosecurity/falco/search?p=2&q=bintray)on the Falco repo and replace the URL for the CMake and Docker files.
-
-* It’s very important to change the DRIVERS_REPO environment variable [here](https://github.com/falcosecurity/falco/blob/0a33f555eb8e019806b46fea8b80a6302a935421/CMakeLists.txt#L86) - this is what updates the falco-driver-loader scripts that the users and container images use to fetch the module
-
-#### Changes in Test Infra
-
-* We need to use the S3 cli instead of jfrog cli to upload to the s3 bucket after building [here](https://github.com/falcosecurity/test-infra/blob/master/.circleci/config.yml)
-
-* We can probably remove jfrog from that repo since it only deals with drivers and drivers are being put on S3 now
-
-* Instructions on how to setup the S3 directory structure [here](https://falco.org/docs/installation/#install-driver)
-
-    * `/$driver_version$/falco_$target$_$kernelrelease$_$kernelversion$.[ko|o]`
-
-#### Changes to Falco website
-
-* Changes should not be necessary, we are not updating the way people install Falco but only the driver. The driver is managed by a script we can change.
-
-## Mitigation and next steps for the users
-
-* **The average users should be good to go now, Bintray raised our limits and we have some room to do this without requiring manual steps on your end**
-
-* **Users that can’t wait for us to have the S3 setup done: **can setup an S3 as driver repo themselves, push the drivers they need to it after compiling them (they can use [Driverkit](https://github.com/falcosecurity/driverkit) for that) Instructions on how to setup the S3 directory structure [here](https://falco.org/docs/installation/#install-driver).
-
-* **Users that can’t wait but don’t want to setup a webserver themselves**: the falco-driver-loader script can also compile the module for you. Make sure to install the kernel-headers on your nodes.
-
-* **Users that can wait** we will approve this document and act on the plan described here by providing the DRIVERS_REPO at  [https://download.falco.org/driver](https://download.falco.org/driver) that then you can use
-
-### How to use an alternative DRIVERS_REPO ?
-
-**On bash:**
-
-export DRIVERS_REPO=https://your-url-here
-
-**Docker**
-
-Pass it as environment variable using the docker run flag -e - for example:
-
-docker run -e DRIVERS_REPO=[https://your-url-here](https://your-url-here)
-
-**Kubernetes**
-
-spec:
-
-  containers:
-
-  - env:
-
-    - name: DRIVERS_REPO
-
-      value: https://your-url-here
-
-## Release
-
-Next release is on December 1st, we want to rollout a hotfix 0.26.2 release that only contains the updated script before that date so that users don’t get confused and we can just tell them "update Falco" to get the thing working again.
-
--- a/proposals/20201025-drivers-storage-s3_downloads.png
+++ b/proposals/20201025-drivers-storage-s3_downloads.png
--- a/rules/CMakeLists.txt
+++ b/rules/CMakeLists.txt
@@ -37,7 +37,8 @@ if(DEFINED FALCO_COMPONENT)
    COMPONENT "${FALCO_COMPONENT}"
    DESTINATION "${FALCO_ETC_DIR}"
    RENAME "${FALCO_LOCAL_RULES_DEST_FILENAME}")
-# Intentionally *not* installing application_rules.yaml. Not needed when falco is embedded in other projects.
+
+  # Intentionally *not* installing application_rules.yaml. Not needed when falco is embedded in other projects.
 else()
  install(
    FILES falco_rules.yaml
@@ -56,8 +57,8 @@ else()

  install(
    FILES application_rules.yaml
-    DESTINATION "${FALCO_ETC_DIR}/rules.available"
+    DESTINATION "/etc/falco/rules.available"
    RENAME "${FALCO_APP_RULES_DEST_FILENAME}")

-  install(DIRECTORY DESTINATION "${FALCO_ETC_DIR}/rules.d")
+  install(DIRECTORY DESTINATION "/etc/falco/rules.d")
 endif()
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
--- a/rules/k8s_audit_rules.yaml
+++ b/rules/k8s_audit_rules.yaml
@@ -45,12 +45,8 @@

 - list: allowed_k8s_users
  items: [
-    "minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy", "kube-apiserver-healthcheck",
-    "kubernetes-admin",
+    "minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy",
    vertical_pod_autoscaler_users,
-    cluster-autoscaler,
-    "system:addon-manager",
-    "cloud-controller-manager"
    ]

 - rule: Disallowed K8s User
@@ -159,13 +155,10 @@
  source: k8s_audit
  tags: [k8s]

- macro: user_known_node_port_service
-  condition: (k8s_audit_never_true)
-
 - rule: Create NodePort Service
  desc: >
    Detect an attempt to start a service with a NodePort service type
-  condition: kevt and service and kcreate and ka.req.service.type=NodePort and not user_known_node_port_service
+  condition: kevt and service and kcreate and ka.req.service.type=NodePort
  output: NodePort Service Created (user=%ka.user.name service=%ka.target.name ns=%ka.target.namespace ports=%ka.req.service.ports)
  priority: WARNING
  source: k8s_audit
@@ -193,7 +186,7 @@
 - rule: Anonymous Request Allowed
  desc: >
    Detect any request made by the anonymous user that was allowed
-  condition: kevt and ka.user.name=system:anonymous and ka.auth.decision="allow" and not health_endpoint
+  condition: kevt and ka.user.name=system:anonymous and ka.auth.decision!=reject and not health_endpoint
  output: Request by anonymous user allowed (user=%ka.user.name verb=%ka.verb uri=%ka.uri reason=%ka.auth.reason))
  priority: WARNING
  source: k8s_audit
@@ -208,31 +201,15 @@
 # attach request was created privileged or not. For now, we have a
 # less severe rule that detects attaches/execs to any pod.

- macro: user_known_exec_pod_activities
-  condition: (k8s_audit_never_true)
-
 - rule: Attach/Exec Pod
  desc: >
    Detect any attempt to attach/exec to a pod
-  condition: kevt_started and pod_subresource and kcreate and ka.target.subresource in (exec,attach) and not user_known_exec_pod_activities
+  condition: kevt_started and pod_subresource and kcreate and ka.target.subresource in (exec,attach)
  output: Attach/Exec to pod (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace action=%ka.target.subresource command=%ka.uri.param[command])
  priority: NOTICE
  source: k8s_audit
  tags: [k8s]

- macro: user_known_pod_debug_activities
-  condition: (k8s_audit_never_true)
-
-# Only works when feature gate EphemeralContainers is enabled
- rule: EphemeralContainers Created
-  desc: >
-    Detect any ephemeral container created
-  condition: kevt and pod_subresource and kmodify and ka.target.subresource in (ephemeralcontainers) and not user_known_pod_debug_activities
-  output: Ephemeral container is created in pod (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace ephemeral_container_name=%jevt.value[/requestObject/ephemeralContainers/0/name] ephemeral_container_image=%jevt.value[/requestObject/ephemeralContainers/0/image])
-  priority: NOTICE
-  source: k8s_audit
-  tags: [k8s]
-
 # In a local/user rules fie, you can append to this list to add additional allowed namespaces
 - list: allowed_namespaces
  items: [kube-system, kube-public, default]
@@ -245,63 +222,19 @@
  source: k8s_audit
  tags: [k8s]

-# Only defined for backwards compatibility. Use the more specific
-# user_allowed_kube_namespace_image_list instead.
- list: user_trusted_image_list
-  items: []
-
- list: user_allowed_kube_namespace_image_list
-  items: [user_trusted_image_list]
-
-# Only defined for backwards compatibility. Use the more specific
-# allowed_kube_namespace_image_list instead.
- list: k8s_image_list
-  items: []
-
- list: allowed_kube_namespace_image_list
-  items: [
-    gcr.io/google-containers/prometheus-to-sd,
-    gcr.io/projectcalico-org/node,
-    gke.gcr.io/addon-resizer,
-    gke.gcr.io/heapster,
-    gke.gcr.io/gke-metadata-server,
-    k8s.gcr.io/ip-masq-agent-amd64,
-    k8s.gcr.io/kube-apiserver,
-    gke.gcr.io/kube-proxy,
-    gke.gcr.io/netd-amd64,
-    k8s.gcr.io/addon-resizer
-    k8s.gcr.io/prometheus-to-sd,
-    k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64,
-    k8s.gcr.io/k8s-dns-kube-dns-amd64,
-    k8s.gcr.io/k8s-dns-sidecar-amd64,
-    k8s.gcr.io/metrics-server-amd64,
-    kope/kube-apiserver-healthcheck,
-    k8s_image_list
-    ]
-
- macro: allowed_kube_namespace_pods
-  condition: (ka.req.pod.containers.image.repository in (user_allowed_kube_namespace_image_list) or
-              ka.req.pod.containers.image.repository in (allowed_kube_namespace_image_list))
-
 # Detect any new pod created in the kube-system namespace
 - rule: Pod Created in Kube Namespace
  desc: Detect any attempt to create a pod in the kube-system or kube-public namespaces
-  condition: kevt and pod and kcreate and ka.target.namespace in (kube-system, kube-public) and not allowed_kube_namespace_pods
+  condition: kevt and pod and kcreate and ka.target.namespace in (kube-system, kube-public)
  output: Pod created in kube namespace (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace images=%ka.req.pod.containers.image)
  priority: WARNING
  source: k8s_audit
  tags: [k8s]

- list: user_known_sa_list
-  items: []
-
- macro: trusted_sa
-  condition: (ka.target.name in (user_known_sa_list))
-
 # Detect creating a service account in the kube-system/kube-public namespace
 - rule: Service Account Created in Kube Namespace
  desc: Detect any attempt to create a serviceaccount in the kube-system or kube-public namespaces
-  condition: kevt and serviceaccount and kcreate and ka.target.namespace in (kube-system, kube-public) and response_successful and not trusted_sa
+  condition: kevt and serviceaccount and kcreate and ka.target.namespace in (kube-system, kube-public) and response_successful
  output: Service account created in kube namespace (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace)
  priority: WARNING
  source: k8s_audit
@@ -312,8 +245,7 @@
 # normal operation.
 - rule: System ClusterRole Modified/Deleted
  desc: Detect any attempt to modify/delete a ClusterRole/Role starting with system
-  condition: kevt and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith "system:") and
-             not ka.target.name in (system:coredns, system:managed-certificate-controller)
+  condition: kevt and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith "system:") and ka.target.name!="system:coredns"
  output: System ClusterRole/Role modified or deleted (user=%ka.user.name role=%ka.target.name ns=%ka.target.namespace action=%ka.verb)
  priority: WARNING
  source: k8s_audit
@@ -537,13 +469,15 @@
  condition: >
    kevt 
    and non_system_user 
-    and ka.user.name in (full_admin_k8s_users)
+    and ka.user.name in (admin_k8s_users) 
    and not allowed_full_admin_users
  output: K8s Operation performed by full admin user (user=%ka.user.name target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)
  priority: WARNING
  source: k8s_audit
  tags: [k8s]

+
+
 - macro: ingress
  condition: ka.target.resource=ingresses

@@ -579,6 +513,8 @@
  priority: WARNING
  tags: [k8s, network]

+
+
 - macro: node
  condition: ka.target.resource=nodes

--- a/scripts/cleanup
+++ b/scripts/cleanup
@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-
-usage() {
-    echo "usage: $0 -p 0987654321 -r <deb-dev|rpm-dev|bin-dev>"
-    exit 1
-}
-
-user=poiana
-
-# Get the versions to delete.
-#
-# $1: repository to lookup
-# $2: number of versions to skip.
-get_versions() {
-    # The API endpoint returns the Falco package versions sort by most recent.
-    IFS=$'\n' read -r -d '' -a all < <(curl -s --header "Content-Type: application/json" "https://api.bintray.com/packages/falcosecurity/$1/falco" | jq -r '.versions | .[]' | tail -n "+$2")
-}
-
-# Remove all the versions (${all[@]} array).
-#
-# $1: repository containing the versions.
-rem_versions() {
-    for i in "${!all[@]}";
-    do
-        JFROG_CLI_LOG_LEVEL=DEBUG jfrog bt vd --quiet --user "${user}" --key "${pass}" "falcosecurity/$1/falco/${all[$i]}"
-    done
-}
-
-while getopts ":p::r:" opt; do
-    case "${opt}" in
-        p )
-          pass=${OPTARG}
-          ;;
-        r )
-          repo="${OPTARG}"
-          [[ "${repo}" == "deb-dev" || "${repo}" == "rpm-dev" || "${repo}" == "bin-dev" ]] || usage
-          ;;
-        : )
-          echo "invalid option: ${OPTARG} requires an argument" 1>&2
-          exit 1
-          ;;
-        \?)
-          echo "invalid option: ${OPTARG}" 1>&2
-          exit 1
-          ;;
-    esac
-done
-shift $((OPTIND-1))
-
-if [ -z "${pass}" ] || [ -z "${repo}" ]; then
-    usage
-fi
-
-skip=51
-if [[ "${repo}" == "bin-dev" ]]; then
-    skip=11
-fi
-
-get_versions "${repo}" ${skip}
-echo "number of versions to delete: ${#all[@]}"
-rem_versions "${repo}"
--- a/scripts/falco-driver-loader
+++ b/scripts/falco-driver-loader
@@ -143,41 +143,33 @@ load_kernel_module_compile() {
 	# skip dkms on UEK hosts because it will always fail
 	if [[ $(uname -r) == *uek* ]]; then
 		echo "* Skipping dkms install for UEK host"
-		return
-	fi
-
-	if ! hash dkms &>/dev/null; then
-		echo "* Skipping dkms install (dkms not found)"
-		return
-	fi
-
-	# try to compile using all the available gcc versions
-	for CURRENT_GCC in $(which gcc) $(ls "$(dirname "$(which gcc)")"/gcc-* | grep 'gcc-[0-9]\+' | sort -r); do
-		echo "* Trying to dkms install ${DRIVER_NAME} module with GCC ${CURRENT_GCC}"
-		echo "#!/usr/bin/env bash" > /tmp/falco-dkms-make
-		echo "make CC=${CURRENT_GCC} \$@" >> /tmp/falco-dkms-make
-		chmod +x /tmp/falco-dkms-make
-		if dkms install --directive="MAKE='/tmp/falco-dkms-make'" -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
-			echo "* ${DRIVER_NAME} module installed in dkms, trying to insmod"				
-			if insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko" > /dev/null 2>&1; then
-				echo "* Success: ${DRIVER_NAME} module found and loaded in dkms"
-				exit 0
-			elif insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko.xz" > /dev/null 2>&1; then
-				echo "* Success: ${DRIVER_NAME} module found and loaded in dkms (xz)"
-				exit 0
+	else
+		if hash dkms &>/dev/null; then
+				echo "* Trying to dkms install ${DRIVER_NAME} module"
+			if dkms install -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
+				echo "* ${DRIVER_NAME} module installed in dkms, trying to insmod"				
+				if insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko" > /dev/null 2>&1; then
+					echo "* Success: ${DRIVER_NAME} module found and loaded in dkms"
+					exit 0
+				elif insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko.xz" > /dev/null 2>&1; then
+					echo "* Success: ${DRIVER_NAME} module found and loaded in dkms (xz)"
+					exit 0
+				else
+					echo "* Unable to insmod ${DRIVER_NAME} module"
+				fi
 			else
-				echo "* Unable to insmod ${DRIVER_NAME} module"
+				DKMS_LOG="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/build/make.log"
+				if [ -f "${DKMS_LOG}" ]; then
+					echo "* Running dkms build failed, dumping ${DKMS_LOG}"
+					cat "${DKMS_LOG}"
+				else
+					echo "* Running dkms build failed, couldn't find ${DKMS_LOG}"
+				fi
 			fi
 		else
-			DKMS_LOG="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/build/make.log"
-			if [ -f "${DKMS_LOG}" ]; then
-				echo "* Running dkms build failed, dumping ${DKMS_LOG} (with GCC ${CURRENT_GCC})"
-				cat "${DKMS_LOG}"
-			else
-				echo "* Running dkms build failed, couldn't find ${DKMS_LOG} (with GCC ${CURRENT_GCC})"
-			fi
+			echo "* Skipping dkms install (dkms not found)"
 		fi
-	done
+	fi
 }

 load_kernel_module_download() {
@@ -220,7 +212,7 @@ load_kernel_module() {
 	rmmod "${DRIVER_NAME}" 2>/dev/null
 	WAIT_TIME=0
 	KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
-	while lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do 
+	while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do
 		if rmmod "${DRIVER_NAME}" 2>/dev/null; then
 			echo "* Unloading ${DRIVER_NAME} module succeeded after ${WAIT_TIME}s"
 			break
@@ -232,7 +224,7 @@ load_kernel_module() {
 		sleep 1
 	done

-	if lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" > /dev/null 2>&1; then
+	if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then
 		echo "* ${DRIVER_NAME} module seems to still be loaded, hoping the best"
 		exit 0
 	fi
@@ -481,8 +473,9 @@ else
 	FALCO_DRIVER_CURL_OPTIONS=-fsS
 fi

-if [[ -z "$MAX_RMMOD_WAIT" ]]; then
-	MAX_RMMOD_WAIT=60
+MAX_RMMOD_WAIT=60
+if [[ $# -ge 1 ]]; then
+	MAX_RMMOD_WAIT=$1
 fi

 DRIVER_VERSION="@PROBE_VERSION@"
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -1,4 +1 @@
 add_subdirectory(trace_files)
-
-add_custom_target(test-trace-files ALL)
-add_dependencies(test-trace-files trace-files-base-scap trace-files-psp trace-files-k8s-audit)
--- a/test/README.md
+++ b/test/README.md
@@ -7,25 +7,13 @@ You can find instructions on how to run this test suite on the Falco website [he
 ## Test suites

 - [falco_tests](./falco_tests.yaml)
- [falco_traces](./falco_traces.yaml.in)
+- [falco_traces](./falco_traces.yaml)
 - [falco_tests_package](./falco_tests_package.yaml)
 - [falco_k8s_audit_tests](./falco_k8s_audit_tests.yaml)
 - [falco_tests_psp](./falco_tests_psp.yaml)

 ## Running locally

-This step assumes you already built Falco.
-
-Note that the tests are intended to be run against a [release build](https://falco.org/docs/source/#specify-the-build-type) of Falco, at the moment.
-
-Also, it assumes you prepared [falco_traces](#falco_traces) (see the section below) and you already run the following command from the build directory:
-
-```console
-make test-trace-files
-```
-
-It prepares the fixtures (`json` and `scap` files) needed by the integration tests.
-
 Using `virtualenv` the steps to locally run a specific test suite are the following ones (from this directory):

 ```console
@@ -44,72 +32,8 @@ In case you want to only execute a specific test case, use the `--mux-filter-onl
 BUILD_DIR="../build" avocado run --mux-yaml falco_tests.yaml --job-results-dir /tmp/job-results --mux-filter-only /run/trace_files/program_output -- falco_test.py
 ```

-To obtain the path of all the available variants for a given test suite, execute:
+To obtain the path of all the available variants, execute:

 ```console
-avocado variants --mux-yaml falco_tests.yaml
-```
-
-### falco_traces
-
-The `falco_traces.yaml` test suite gets generated through the `falco_traces.yaml.in` file and some fixtures (`scap` files) downloaded from the web at execution time.
-
-1. Ensure you have `unzip` and `xargs` utilities
-2. Prepare the test suite with the following command:
-
-    ```console
-    bash run_regression_tests.sh -p -v
-    ```
-
-### falco_tests_package
-
-The `falco_tests_package.yaml` test suite requires some additional setup steps to be succesfully run on your local machine.
-
-In particular, it requires some runners (ie., docker images) to be already built and present into your local machine.
-
-1. Ensure you have `docker` up and running
-2. Ensure you build Falco (with bundled deps)
-
-    The recommended way of doing it by running the `falcosecurity/falco-builder` docker image from the project root:
-
-    ```console
-    docker run -v $PWD/..:/source -v $PWD/mybuild:/build falcosecurity/falco-builder cmake
-    docker run -v $PWD/..:/source -v $PWD/mybuild:/build falcosecurity/falco-builder falco
-    ```
-
-3. Ensure you build the Falco packages from the Falco above:
-
-    ```console
-    docker run -v $PWD/..:/source -v $PWD/mybuild:/build falcosecurity/falco-builder package
-    ```
-
-4. Ensure you build the runners:
-
-    ```console
-    FALCO_VERSION=$(./mybuild/release/userspace/falco/falco --version  | head -n 1 | cut -d' ' -f3 | tr -d '\r')
-    mkdir -p /tmp/runners-rootfs
-    cp -R ./test/rules /tmp/runners-rootfs
-    cp -R ./test/trace_files /tmp/runners-rootfs
-    cp ./mybuild/release/falco-${FALCO_VERSION}-x86_64.{deb,rpm,tar.gz} /tmp/runners-rootfs
-    docker build -f docker/tester/root/runners/deb.Dockerfile --build-arg FALCO_VERSION=${FALCO_VERSION} -t falcosecurity/falco:test-deb /tmp/runners-rootfs
-    docker build -f docker/tester/root/runners/rpm.Dockerfile --build-arg FALCO_VERSION=${FALCO_VERSION} -t falcosecurity/falco:test-rpm /tmp/runners-rootfs
-    docker build -f docker/tester/root/runners/tar.gz.Dockerfile --build-arg FALCO_VERSION=${FALCO_VERSION} -t falcosecurity/falco:test-tar.gz /tmp/runners-rootfs
-    ```
-
-5. Run the `falco_tests_package.yaml` test suite from the `test` directory
-
-    ```console
-    cd test
-    BUILD_DIR="../mybuild" avocado run --mux-yaml falco_tests_package.yaml --job-results-dir /tmp/job-results -- falco_test.py
-    ```
-
-### Execute all the test suites
-
-In case you want to run all the test suites at once, you can directly use the `run_regression_tests.sh` runner script.
-
-```console
-cd test
-./run_regression_tests.sh -v
-```
-
-Just make sure you followed all the previous setup steps.
+avocado variants --mux-yaml falco_test.yaml
+```
--- a/test/confs/grpc_unix_socket.yaml
+++ b/test/confs/grpc_unix_socket.yaml
@@ -1,38 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# Whether to output events in json or text.
-json_output: false
-
-# Send information logs to stderr and/or syslog
-# Note these are *not* security notification logs!
-# These are just Falco lifecycle (and possibly error) logs.
-log_stderr: false
-log_syslog: false
-
-# Where security notifications should go.
-stdout_output:
-  enabled: false
-
-# gRPC server using an unix socket.
-grpc:
-    enabled: true
-    bind_address: "unix:///tmp/falco/falco.sock"
-    threadiness: 8
-
-grpc_output:
-  enabled: true
--- a/test/confs/program_output.yaml
+++ b/test/confs/program_output.yaml
@@ -41,4 +41,4 @@ stdout_output:

 program_output:
  enabled: true
-  program: cat >> /tmp/falco_outputs/program_output.txt
+  program: cat > /tmp/falco_outputs/program_output.txt
--- a/test/confs/psp.yaml
+++ b/test/confs/psp.yaml
@@ -136,7 +136,7 @@ stdout_output:
 webserver:
  enabled: true
  listen_port: 8765
-  k8s_audit_endpoint: /k8s-audit
+  k8s_audit_endpoint: /k8s_audit
  ssl_enabled: false
  ssl_certificate: /etc/falco/falco.pem

--- a/test/confs/stdout_output.yaml
+++ b/test/confs/stdout_output.yaml
@@ -1,42 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# File containing Falco rules, loaded at startup.
-rules_file: /etc/falco_rules.yaml
-
-# Whether to output events in json or text
-json_output: false
-
-# Send information logs to stderr and/or syslog Note these are *not* security
-# notification logs! These are just Falco lifecycle (and possibly error) logs.
-log_stderr: false
-log_syslog: false
-
-# Where security notifications should go.
-# Multiple outputs can be enabled.
-
-syslog_output:
-  enabled: false
-
-file_output:
-  enabled: false
-
-stdout_output:
-  enabled: true
-
-program_output:
-  enabled: false
--- a/test/driver-loader/run_test.sh
+++ b/test/driver-loader/run_test.sh
@@ -20,17 +20,17 @@ set -euo pipefail
 BUILD_DIR=$1

 SCRIPT=$(readlink -f $0)
-SCRIPTDIR=$(dirname "$SCRIPT")
+SCRIPTDIR=$(dirname $SCRIPT)
 RUNNERDIR="${SCRIPTDIR}/runner"
 FALCO_VERSION=$(cat ${BUILD_DIR}/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
 DRIVER_VERSION=$(cat ${BUILD_DIR}/userspace/falco/config_falco.h | grep 'DRIVER_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
 FALCO_PACKAGE="falco-${FALCO_VERSION}-x86_64.tar.gz"

 cp "${BUILD_DIR}/${FALCO_PACKAGE}" "${RUNNERDIR}"
-pushd "${RUNNERDIR}"
+pushd ${RUNNERDIR}
 docker build --build-arg FALCO_VERSION="$FALCO_VERSION" \
    -t falcosecurity/falco:test-driver-loader \
-    -f "${RUNNERDIR}/Dockerfile" "${RUNNERDIR}"
+    -f "${RUNNERDIR}/Dockerfile" ${RUNNERDIR}
 popd
 rm -f "${RUNNERDIR}/${FALCO_PACKAGE}"

--- a/test/driver-loader/runner/Dockerfile
+++ b/test/driver-loader/runner/Dockerfile
@@ -10,6 +10,7 @@ ENV HOST_ROOT=/host
 RUN apt-get update -y
 RUN apt-get install -y --no-install-recommends \
 	ca-certificates \
+	libyaml-0-2 \
 	dkms \
 	curl \
 	gcc \
--- a/test/falco_test.py
+++ b/test/falco_test.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+ #!/usr/bin/env python
 #
 # Copyright (C) 2019 The Falco Authors.
 #
@@ -28,9 +28,6 @@ import urllib.request
 from avocado import Test
 from avocado import main
 from avocado.utils import process
-from watchdog.observers import Observer
-from watchdog.events import PatternMatchingEventHandler
-

 class FalcoTest(Test):

@@ -50,20 +47,17 @@ class FalcoTest(Test):
        self.stdout_is = self.params.get('stdout_is', '*', default='')
        self.stderr_is = self.params.get('stderr_is', '*', default='')

-        self.stdout_contains = self.params.get(
-            'stdout_contains', '*', default='')
+        self.stdout_contains = self.params.get('stdout_contains', '*', default='')

        if not isinstance(self.stdout_contains, list):
            self.stdout_contains = [self.stdout_contains]

-        self.stderr_contains = self.params.get(
-            'stderr_contains', '*', default='')
+        self.stderr_contains = self.params.get('stderr_contains', '*', default='')

        if not isinstance(self.stderr_contains, list):
            self.stderr_contains = [self.stderr_contains]

-        self.stdout_not_contains = self.params.get(
-            'stdout_not_contains', '*', default='')
+        self.stdout_not_contains = self.params.get('stdout_not_contains', '*', default='')

        if not isinstance(self.stdout_not_contains, list):
            if self.stdout_not_contains == '':
@@ -71,8 +65,7 @@ class FalcoTest(Test):
            else:
                self.stdout_not_contains = [self.stdout_not_contains]

-        self.stderr_not_contains = self.params.get(
-            'stderr_not_contains', '*', default='')
+        self.stderr_not_contains = self.params.get('stderr_not_contains', '*', default='')

        if not isinstance(self.stderr_not_contains, list):
            if self.stderr_not_contains == '':
@@ -88,18 +81,15 @@ class FalcoTest(Test):
            self.trace_file = os.path.join(build_dir, "test", self.trace_file)

        self.json_output = self.params.get('json_output', '*', default=False)
-        self.json_include_output_property = self.params.get(
-            'json_include_output_property', '*', default=True)
+        self.json_include_output_property = self.params.get('json_include_output_property', '*', default=True)
        self.all_events = self.params.get('all_events', '*', default=False)
        self.priority = self.params.get('priority', '*', default='debug')
-        self.rules_file = self.params.get(
-            'rules_file', '*', default=os.path.join(self.basedir, '../rules/falco_rules.yaml'))
+        self.rules_file = self.params.get('rules_file', '*', default=os.path.join(self.basedir, '../rules/falco_rules.yaml'))

        if not isinstance(self.rules_file, list):
            self.rules_file = [self.rules_file]

-        self.validate_rules_file = self.params.get(
-            'validate_rules_file', '*', default=False)
+        self.validate_rules_file = self.params.get('validate_rules_file', '*', default=False)

        if self.validate_rules_file == False:
            self.validate_rules_file = []
@@ -126,15 +116,13 @@ class FalcoTest(Test):
                file = os.path.join(self.basedir, file)
            self.rules_args = self.rules_args + "-r " + file + " "

-        self.conf_file = self.params.get(
-            'conf_file', '*', default=os.path.join(self.basedir, '../falco.yaml'))
+        self.conf_file = self.params.get('conf_file', '*', default=os.path.join(self.basedir, '../falco.yaml'))
        if not os.path.isabs(self.conf_file):
            self.conf_file = os.path.join(self.basedir, self.conf_file)

        self.run_duration = self.params.get('run_duration', '*', default='')

-        self.disabled_rules = self.params.get(
-            'disabled_rules', '*', default='')
+        self.disabled_rules = self.params.get('disabled_rules', '*', default='')

        if self.disabled_rules == '':
            self.disabled_rules = []
@@ -147,8 +135,7 @@ class FalcoTest(Test):
        for rule in self.disabled_rules:
            self.disabled_args = self.disabled_args + "-D " + rule + " "

-        self.detect_counts = self.params.get(
-            'detect_counts', '*', default=False)
+        self.detect_counts = self.params.get('detect_counts', '*', default=False)
        if self.detect_counts == False:
            self.detect_counts = {}
        else:
@@ -158,8 +145,7 @@ class FalcoTest(Test):
                    detect_counts[key] = value
            self.detect_counts = detect_counts

-        self.rules_warning = self.params.get(
-            'rules_warning', '*', default=False)
+        self.rules_warning = self.params.get('rules_warning', '*', default=False)
        if self.rules_warning == False:
            self.rules_warning = set()
        else:
@@ -184,11 +170,9 @@ class FalcoTest(Test):

        self.package = self.params.get('package', '*', default='None')

-        self.addl_docker_run_args = self.params.get(
-            'addl_docker_run_args', '*', default='')
+        self.addl_docker_run_args = self.params.get('addl_docker_run_args', '*', default='')

-        self.copy_local_driver = self.params.get(
-            'copy_local_driver', '*', default=False)
+        self.copy_local_driver = self.params.get('copy_local_driver', '*', default=False)

        # Used by possibly_copy_local_driver as well as docker run
        self.module_dir = os.path.expanduser("~/.falco")
@@ -211,60 +195,17 @@ class FalcoTest(Test):
                        os.makedirs(filedir)
            self.outputs = outputs

-        self.output_strictly_contains = self.params.get(
-            'output_strictly_contains', '*', default='')
-
-        if self.output_strictly_contains == '':
-            self.output_strictly_contains = {}
-        else:
-            output_strictly_contains = []
-            for item in self.output_strictly_contains:
-                for key, value in list(item.items()):
-                    output = {}
-                    output['actual'] = key
-                    output['expected'] = value
-                    output_strictly_contains.append(output)
-                    if not output['actual'] == 'stdout':
-                        # Clean up file from previous tests, if any
-                        if os.path.exists(output['actual']):
-                            os.remove(output['actual'])
-                        # Create the parent directory for the file if it doesn't exist.
-                        filedir = os.path.dirname(output['actual'])
-                        if not os.path.isdir(filedir):
-                            os.makedirs(filedir)
-            self.output_strictly_contains = output_strictly_contains
-
-        self.grpcurl_res = None
-        self.grpc_observer = None
-        self.grpc_address = self.params.get(
-            'address', 'grpc/*', default='/var/run/falco.sock')
-        if self.grpc_address.startswith("unix://"):
-            self.is_grpc_using_unix_socket = True
-            self.grpc_address = self.grpc_address[len("unix://"):]
-        else:
-            self.is_grpc_using_unix_socket = False
-        self.grpc_proto = self.params.get('proto', 'grpc/*', default='')
-        self.grpc_service = self.params.get('service', 'grpc/*', default='')
-        self.grpc_method = self.params.get('method', 'grpc/*', default='')
-        self.grpc_results = self.params.get('results', 'grpc/*', default='')
-        if self.grpc_results == '':
-            self.grpc_results = []
-        else:
-            if type(self.grpc_results) == str:
-                self.grpc_results = [self.grpc_results]
-
        self.disable_tags = self.params.get('disable_tags', '*', default='')

        if self.disable_tags == '':
-            self.disable_tags = []
+            self.disable_tags=[]

        self.run_tags = self.params.get('run_tags', '*', default='')

        if self.run_tags == '':
-            self.run_tags = []
+            self.run_tags=[]

-        self.time_iso_8601 = self.params.get(
-            'time_iso_8601', '*', default=False)
+        self.time_iso_8601 = self.params.get('time_iso_8601', '*', default=False)

    def tearDown(self):
        if self.package != 'None':
@@ -283,8 +224,7 @@ class FalcoTest(Test):
        self.log.debug("Actual warning rules: {}".format(found_warning))

        if found_warning != self.rules_warning:
-            self.fail("Expected rules with warnings {} does not match actual rules with warnings {}".format(
-                self.rules_warning, found_warning))
+            self.fail("Expected rules with warnings {} does not match actual rules with warnings {}".format(self.rules_warning, found_warning))

    def check_rules_events(self, res):

@@ -295,60 +235,50 @@ class FalcoTest(Test):
            events = set(match.group(2).split(","))
            found_events[rule] = events

-        self.log.debug(
-            "Expected events for rules: {}".format(self.rules_events))
+        self.log.debug("Expected events for rules: {}".format(self.rules_events))
        self.log.debug("Actual events for rules: {}".format(found_events))

        for rule in list(found_events.keys()):
            if found_events.get(rule) != self.rules_events.get(rule):
-                self.fail("rule {}: expected events {} differs from actual events {}".format(
-                    rule, self.rules_events.get(rule), found_events.get(rule)))
+                self.fail("rule {}: expected events {} differs from actual events {}".format(rule, self.rules_events.get(rule), found_events.get(rule)))

    def check_detections(self, res):
        # Get the number of events detected.
        match = re.search('Events detected: (\d+)', res.stdout.decode("utf-8"))
        if match is None:
-            self.fail(
-                "Could not find a line 'Events detected: <count>' in falco output")
+            self.fail("Could not find a line 'Events detected: <count>' in falco output")

        events_detected = int(match.group(1))

        if not self.should_detect and events_detected > 0:
-            self.fail("Detected {} events when should have detected none".format(
-                events_detected))
+            self.fail("Detected {} events when should have detected none".format(events_detected))

        if self.should_detect:
            if events_detected == 0:
-                self.fail("Detected {} events when should have detected > 0".format(
-                    events_detected))
+                self.fail("Detected {} events when should have detected > 0".format(events_detected))

            for level in self.detect_level:
                level_line = '(?i){}: (\d+)'.format(level)
                match = re.search(level_line, res.stdout.decode("utf-8"))

                if match is None:
-                    self.fail(
-                        "Could not find a line '{}: <count>' in falco output".format(level))
+                    self.fail("Could not find a line '{}: <count>' in falco output".format(level))

                    events_detected = int(match.group(1))

                    if not events_detected > 0:
-                        self.fail("Detected {} events at level {} when should have detected > 0".format(
-                            events_detected, level))
+                        self.fail("Detected {} events at level {} when should have detected > 0".format(events_detected, level))

    def check_detections_by_rule(self, res):
        # Get the number of events detected for each rule. Must match the expected counts.
-        match = re.search('Triggered rules by rule name:(.*)',
-                          res.stdout.decode("utf-8"), re.DOTALL)
+        match = re.search('Triggered rules by rule name:(.*)', res.stdout.decode("utf-8"), re.DOTALL)
        if match is None:
-            self.fail(
-                "Could not find a block 'Triggered rules by rule name: ...' in falco output")
+            self.fail("Could not find a block 'Triggered rules by rule name: ...' in falco output")

        triggered_rules = match.group(1)

        for rule, count in list(self.detect_counts.items()):
-            expected = '\s{}: (\d+)'.format(
-                re.sub(r'([$\.*+?()[\]{}|^])', r'\\\1', rule))
+            expected = '\s{}: (\d+)'.format(re.sub(r'([$\.*+?()[\]{}|^])', r'\\\1', rule))
            match = re.search(expected, triggered_rules)

            if match is None:
@@ -357,11 +287,9 @@ class FalcoTest(Test):
                actual_count = int(match.group(1))

            if actual_count != count:
-                self.fail("Different counts for rule {}: expected={}, actual={}".format(
-                    rule, count, actual_count))
+                self.fail("Different counts for rule {}: expected={}, actual={}".format(rule, count, actual_count))
            else:
-                self.log.debug(
-                    "Found expected count for rule {}: {}".format(rule, count))
+                self.log.debug("Found expected count for rule {}: {}".format(rule, count))

    def check_outputs(self):
        for output in self.outputs:
@@ -376,8 +304,7 @@ class FalcoTest(Test):
                    found = True

            if found == False:
-                self.fail("Could not find a line '{}' in file '{}'".format(
-                    output['line'], output['file']))
+                self.fail("Could not find a line '{}' in file '{}'".format(output['line'], output['file']))

        return True

@@ -394,27 +321,7 @@ class FalcoTest(Test):
                        attrs = ['time', 'rule', 'priority']
                    for attr in attrs:
                        if not attr in obj:
-                            self.fail(
-                                "Falco JSON object {} does not contain property \"{}\"".format(line, attr))
-
-    def check_output_strictly_contains(self, res):
-        for output in self.output_strictly_contains:
-            # Read the expected output (from a file) and actual output (either from a file or the stdout),
-            # then check if the actual one strictly contains the expected one.
-
-            expected = open(output['expected']).read()
-
-            if output['actual'] == 'stdout':
-                actual = res.stdout.decode("utf-8")
-            else:
-                actual = open(output['actual']).read()
-
-            if expected not in actual:
-                self.fail("Output '{}' does not strictly contains the expected content '{}'".format(
-                    output['actual'], output['expected']))
-                return False
-
-        return True
+                            self.fail("Falco JSON object {} does not contain property \"{}\"".format(line, attr))

    def install_package(self):

@@ -433,39 +340,35 @@ class FalcoTest(Test):
                                         self.module_dir, self.addl_docker_run_args, image)

        elif self.package.endswith(".deb"):
-            self.falco_binary_path = '/usr/bin/falco'
+            self.falco_binary_path = '/usr/bin/falco';

            package_glob = "{}/{}".format(self.falcodir, self.package)

            matches = glob.glob(package_glob)

            if len(matches) != 1:
-                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}",
-                          package_glob, ",".join(matches))
+                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}", package_glob, ",".join(matches))

            package_path = matches[0]

            cmdline = "dpkg -i {}".format(package_path)
-            self.log.debug(
-                "Installing debian package via \"{}\"".format(cmdline))
+            self.log.debug("Installing debian package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

        elif self.package.endswith(".rpm"):
-            self.falco_binary_path = '/usr/bin/falco'
+            self.falco_binary_path = '/usr/bin/falco';

            package_glob = "{}/{}".format(self.falcodir, self.package)

            matches = glob.glob(package_glob)

            if len(matches) != 1:
-                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}",
-                          package_glob, ",".join(matches))
+                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}", package_glob, ",".join(matches))

            package_path = matches[0]

            cmdline = "rpm -i --nodeps --noscripts {}".format(package_path)
-            self.log.debug(
-                "Installing centos package via \"{}\"".format(cmdline))
+            self.log.debug("Installing centos package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

    def uninstall_package(self):
@@ -475,29 +378,25 @@ class FalcoTest(Test):

        elif self.package.endswith(".rpm"):
            cmdline = "rpm -e --noscripts --nodeps falco"
-            self.log.debug(
-                "Uninstalling centos package via \"{}\"".format(cmdline))
+            self.log.debug("Uninstalling centos package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

        elif self.package.endswith(".deb"):
            cmdline = "dpkg --purge falco"
-            self.log.debug(
-                "Uninstalling debian package via \"{}\"".format(cmdline))
+            self.log.debug("Uninstalling debian package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

    def possibly_copy_driver(self):
        # Remove the contents of ~/.falco regardless of copy_local_driver.
        self.log.debug("Checking for module dir {}".format(self.module_dir))
        if os.path.isdir(self.module_dir):
-            self.log.info(
-                "Removing files below directory {}".format(self.module_dir))
+            self.log.info("Removing files below directory {}".format(self.module_dir))
            for rmfile in glob.glob(self.module_dir + "/*"):
                self.log.debug("Removing file {}".format(rmfile))
                os.remove(rmfile)

        if self.copy_local_driver:
-            verlines = [str.strip() for str in subprocess.check_output(
-                [self.falco_binary_path, "--version"]).splitlines()]
+            verlines = [str.strip() for str in subprocess.check_output([self.falco_binary_path, "--version"]).splitlines()]
            verstr = verlines[0].decode("utf-8")
            self.log.info("verstr {}".format(verstr))
            falco_version = verstr.split(" ")[2]
@@ -509,70 +408,22 @@ class FalcoTest(Test):

            # falco-driver-loader has a more comprehensive set of ways to
            # find the config hash. We only look at /boot/config-<kernel release>
-            md5_output = subprocess.check_output(
-                ["md5sum", "/boot/config-{}".format(kernel_release)]).rstrip()
+            md5_output = subprocess.check_output(["md5sum", "/boot/config-{}".format(kernel_release)]).rstrip()
            config_hash = md5_output.split(" ")[0]

-            probe_filename = "falco-{}-{}-{}-{}.ko".format(
-                falco_version, arch, kernel_release, config_hash)
+            probe_filename = "falco-{}-{}-{}-{}.ko".format(falco_version, arch, kernel_release, config_hash)
            driver_path = os.path.join(self.falcodir, "driver", "falco.ko")
            module_path = os.path.join(self.module_dir, probe_filename)
            self.log.debug("Copying {} to {}".format(driver_path, module_path))
            shutil.copyfile(driver_path, module_path)

-    def init_grpc_handler(self):
-        self.grpcurl_res = None
-        if len(self.grpc_results) > 0:
-            if not self.is_grpc_using_unix_socket:
-                self.fail("This test suite supports gRPC with unix socket only")
-
-            cmdline = "grpcurl -format text -import-path ../userspace/falco " \
-                "-proto {} -plaintext -unix {} " \
-                "{}/{}".format(self.grpc_proto, self.grpc_address,
-                               self.grpc_service, self.grpc_method)
-            that = self
-
-            class GRPCUnixSocketEventHandler(PatternMatchingEventHandler):
-                def on_created(self, event):
-                    # that.log.info("EVENT: {}", event)
-                    that.grpcurl_res = process.run(cmdline)
-
-            path = os.path.dirname(self.grpc_address)
-            process.run("mkdir -p {}".format(path))
-            event_handler = GRPCUnixSocketEventHandler(patterns=['*'],
-                                                       ignore_directories=True)
-            self.grpc_observer = Observer()
-            self.grpc_observer.schedule(event_handler, path, recursive=False)
-            self.grpc_observer.start()
-
-    def check_grpc(self):
-        if self.grpc_observer is not None:
-            self.grpc_observer.stop()
-            self.grpc_observer = None
-            if self.grpcurl_res is None:
-                self.fail("gRPC responses not found")
-
-            for exp_result in self.grpc_results:
-                found = False
-                for line in self.grpcurl_res.stdout.decode("utf-8").splitlines():
-                    if exp_result in line:
-                        found = True
-                        break
-
-                if found == False:
-                    self.fail(
-                        "Could not find a line with '{}' in gRPC responses (protobuf text".format(exp_result))
-
    def test(self):
        self.log.info("Trace file %s", self.trace_file)

-        self.falco_binary_path = '{}/userspace/falco/falco'.format(
-            self.falcodir)
+        self.falco_binary_path = '{}/userspace/falco/falco'.format(self.falcodir)

        self.possibly_copy_driver()

-        self.init_grpc_handler()
-
        if self.package != 'None':
            # This sets falco_binary_path as a side-effect.
            self.install_package()
@@ -586,11 +437,9 @@ class FalcoTest(Test):
        if self.psp_file != "":

            if not os.path.isfile(self.psp_conv_path):
-                self.log.info("Downloading {} to {}".format(
-                    self.psp_conv_url, self.psp_conv_path))
+                self.log.info("Downloading {} to {}".format(self.psp_conv_url, self.psp_conv_path))

-                urllib.request.urlretrieve(
-                    self.psp_conv_url, self.psp_conv_path)
+                urllib.request.urlretrieve(self.psp_conv_url, self.psp_conv_path)
                os.chmod(self.psp_conv_path, stat.S_IEXEC)

            conv_cmd = '{} convert psp --psp-path {} --rules-path {}'.format(
@@ -608,6 +457,7 @@ class FalcoTest(Test):
                psp_rules = myfile.read()
                self.log.debug("Converted Rules: {}".format(psp_rules))

+
        # Run falco
        cmd = '{} {} {} -c {} {} -o json_output={} -o json_include_output_property={} -o priority={} -v'.format(
            self.falco_binary_path, self.rules_args, self.disabled_args, self.conf_file, trace_arg, self.json_output, self.json_include_output_property, self.priority)
@@ -643,26 +493,22 @@ class FalcoTest(Test):
        for pattern in self.stderr_contains:
            match = re.search(pattern, res.stderr.decode("utf-8"))
            if match is None:
-                self.fail(
-                    "Stderr of falco process did not contain content matching {}".format(pattern))
+                self.fail("Stderr of falco process did not contain content matching {}".format(pattern))

        for pattern in self.stdout_contains:
            match = re.search(pattern, res.stdout.decode("utf-8"))
            if match is None:
-                self.fail("Stdout of falco process '{}' did not contain content matching {}".format(
-                    res.stdout.decode("utf-8"), pattern))
+                self.fail("Stdout of falco process '{}' did not contain content matching {}".format(res.stdout.decode("utf-8"), pattern))

        for pattern in self.stderr_not_contains:
            match = re.search(pattern, res.stderr.decode("utf-8"))
            if match is not None:
-                self.fail(
-                    "Stderr of falco process contained content matching {} when it should have not".format(pattern))
+                self.fail("Stderr of falco process contained content matching {} when it should have not".format(pattern))

        for pattern in self.stdout_not_contains:
            match = re.search(pattern, res.stdout.decode("utf-8"))
            if match is not None:
-                self.fail("Stdout of falco process '{}' did contain content matching {} when it should have not".format(
-                    res.stdout.decode("utf-8"), pattern))
+                self.fail("Stdout of falco process '{}' did contain content matching {} when it should have not".format(res.stdout.decode("utf-8"), pattern))

        if res.exit_status != self.exit_status:
            self.error("Falco command \"{}\" exited with unexpected return value {} (!= {})".format(
@@ -680,8 +526,6 @@ class FalcoTest(Test):
            self.check_detections_by_rule(res)
        self.check_json_output(res)
        self.check_outputs()
-        self.check_output_strictly_contains(res)
-        self.check_grpc()
        pass


--- a/test/falco_tests.yaml
+++ b/test/falco_tests.yaml
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2016-2018 The Falco Authors..
 #
 # This file is part of falco.
 #
@@ -652,79 +652,25 @@ trace_files: !mux
    trace_file: trace_files/cat_write.scap
    stdout_contains: "Warning An open was seen .cport=<NA> command=cat /dev/null."

-  stdout_output_strict:
-    detect: True
-    detect_level: WARNING
-    rules_file:
-      - rules/single_rule.yaml
-    conf_file: confs/stdout_output.yaml
-    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - stdout: output_files/single_rule_with_cat_write.txt
-
-  stdout_output_json_strict:
-    json_output: True
-    detect: True
-    detect_level: WARNING
-    rules_file:
-      - rules/single_rule.yaml
-    conf_file: confs/stdout_output.yaml
-    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - stdout: output_files/single_rule_with_cat_write.json
-
-  file_output_strict:
+  file_output:
    detect: True
    detect_level: WARNING
    rules_file:
      - rules/single_rule.yaml
    conf_file: confs/file_output.yaml
    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - /tmp/falco_outputs/file_output.txt: output_files/single_rule_with_cat_write.txt
+    outputs:
+      - /tmp/falco_outputs/file_output.txt: Warning An open was seen

-  program_output_strict:
+  program_output:
    detect: True
    detect_level: WARNING
    rules_file:
      - rules/single_rule.yaml
    conf_file: confs/program_output.yaml
    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - /tmp/falco_outputs/program_output.txt: output_files/single_rule_with_cat_write.txt
-
-  grpc_unix_socket_outputs:
-    detect: True
-    detect_level: WARNING
-    rules_file:
-      - rules/single_rule.yaml
-    conf_file: confs/grpc_unix_socket.yaml
-    trace_file: trace_files/cat_write.scap
-    run_duration: 5
-    time_iso_8601: true
-    grpc:
-      address: unix:///tmp/falco/falco.sock
-      proto: outputs.proto
-      service: falco.outputs.service
-      method: get
-      # protobuf text format
-      results:
-        - "seconds:1470327477 nanos:881781397"
-        - "priority: WARNING"
-        - "rule: \"open_from_cat\""
-        - "output: \"2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)\""
-        # output fields
-        - "key: \"evt.time.iso8601\""
-        - "value: \"2016-08-04T16:17:57.881781397+0000\""
-        - "key: \"proc.cmdline\""
-        - "value: \"cat /dev/null\""
-        # For the hostname, since we don't know that beforehand,
-        # only check the field presence
-        - "hostname: "
+    outputs:
+      - /tmp/falco_outputs/program_output.txt: Warning An open was seen

  detect_counts:
    detect: True
--- a/test/falco_traces.yaml.in
+++ b/test/falco_traces.yaml.in
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
--- a/test/output_files/single_rule_with_cat_write.json
+++ b/test/output_files/single_rule_with_cat_write.json
@@ -1,8 +0,0 @@
-{"output":"2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881781397Z", "output_fields": {"evt.time.iso8601":1470327477881781397,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881785348+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881785348Z", "output_fields": {"evt.time.iso8601":1470327477881785348,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881796705+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881796705Z", "output_fields": {"evt.time.iso8601":1470327477881796705,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881799840+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881799840Z", "output_fields": {"evt.time.iso8601":1470327477881799840,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882003104+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882003104Z", "output_fields": {"evt.time.iso8601":1470327477882003104,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882008208+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882008208Z", "output_fields": {"evt.time.iso8601":1470327477882008208,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882045694+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882045694Z", "output_fields": {"evt.time.iso8601":1470327477882045694,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882054739+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882054739Z", "output_fields": {"evt.time.iso8601":1470327477882054739,"proc.cmdline":"cat /dev/null"}}
--- a/test/output_files/single_rule_with_cat_write.txt
+++ b/test/output_files/single_rule_with_cat_write.txt
@@ -1,8 +0,0 @@
-2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881785348+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881796705+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881799840+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882003104+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882008208+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882045694+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882054739+0000: Warning An open was seen (command=cat /dev/null)
--- a/test/requirements.txt
+++ b/test/requirements.txt
@@ -3,11 +3,9 @@ avocado-framework-plugin-varianter-yaml-to-mux==69.0
 certifi==2020.4.5.1
 chardet==3.0.4
 idna==2.9
-pathtools==0.1.2
 pbr==5.4.5
 PyYAML==5.3.1
 requests==2.23.0
 six==1.14.0
 stevedore==1.32.0
 urllib3==1.25.9
-watchdog==0.10.2
--- a/test/rules/detect_connect_using_in.yaml
+++ b/test/rules/detect_connect_using_in.yaml
@@ -18,5 +18,5 @@
  desc: Detect any connect to the localhost network, using fd.net and the in operator
  condition: evt.type=connect and fd.net in ("127.0.0.1/24")
  output: Program connected to localhost network
-    (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline connection=%fd.name)
+    (user=%user.name command=%proc.cmdline connection=%fd.name)
  priority: INFO
--- a/test/run_regression_tests.sh
+++ b/test/run_regression_tests.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,53 +18,45 @@
 set -euo pipefail

 SCRIPT=$(readlink -f $0)
-SCRIPTDIR=$(dirname "$SCRIPT")
-SKIP_PACKAGES_TESTS=${SKIP_PACKAGES_TESTS:-false}
+SCRIPTDIR=$(dirname $SCRIPT)
+BUILD_DIR=$1
+BRANCH=${2:-none}

-# Trace file tarballs are now versioned. Any time a substantial change
-# is made that affects the interaction of rules+engine and the trace
-# files here, upload a new trace file zip file and change the version
-# suffix here.
-TRACE_FILES_VERSION=20200831
+TRACE_DIR=$BUILD_DIR/test
+
+mkdir -p $TRACE_DIR

 function download_trace_files() {
+    echo "branch=$BRANCH"
    for TRACE in traces-positive traces-negative traces-info ; do
-    if [ ! -e "$TRACE_DIR/$TRACE" ]; then
-        if [ "$OPT_BRANCH" != "none" ]; then
-        curl -fso "$TRACE_DIR/$TRACE.zip" https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE-$OPT_BRANCH.zip
-        else
-        curl -fso "$TRACE_DIR/$TRACE.zip" https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE-$TRACE_FILES_VERSION.zip
-        fi
-        unzip -d "$TRACE_DIR" "$TRACE_DIR/$TRACE.zip"
-        rm -rf "$TRACE_DIR/$TRACE.zip"
-    else
-        if ${OPT_VERBOSE}; then
-            echo "Trace directory $TRACE_DIR/$TRACE already exist: skipping"
-        fi
-    fi
+	if [ ! -e $TRACE_DIR/$TRACE ]; then
+	    if [ $BRANCH != "none" ]; then
+		curl -fso $TRACE_DIR/$TRACE.zip https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE-$BRANCH.zip
+	    else
+		curl -fso $TRACE_DIR/$TRACE.zip https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE.zip
+	    fi
+	    unzip -d $TRACE_DIR $TRACE_DIR/$TRACE.zip
+	    rm -rf $TRACE_DIR/$TRACE.zip
+	fi
    done
 }

 function prepare_multiplex_fileset() {
+
    dir=$1
    detect=$2

-    for trace in "$TRACE_DIR/$dir"/*.scap ; do
-        [ -e "$trace" ] || continue
-        NAME=$(basename "$trace" .scap)
+    for trace in $TRACE_DIR/$dir/*.scap ; do
+	[ -e "$trace" ] || continue
+	NAME=`basename $trace .scap`

-        # falco_traces.yaml might already have an entry for this trace file, with specific detection levels and counts.
-        # If so, skip it.
-        # Otherwise, add a generic entry showing whether or not to detect anything.
-        if grep -q "$NAME:" "$SCRIPTDIR/falco_traces.yaml"; then
-            if ${OPT_VERBOSE}; then
-                echo "Entry $NAME already exist: skipping"
-            fi
-            continue
-        fi
-
-        cat << EOF >> "$SCRIPTDIR/falco_traces.yaml"
+	# falco_traces.yaml might already have an entry for this trace
+	# file, with specific detection levels and counts. If so, skip
+	# it. Otherwise, add a generic entry showing whether or not to
+	# detect anything.
+	grep -q "$NAME:" $SCRIPTDIR/falco_traces.yaml && continue

+	cat << EOF >> $SCRIPTDIR/falco_traces.yaml
  $NAME:
    detect: $detect
    detect_level: WARNING
@@ -74,106 +66,41 @@ EOF
 }

 function prepare_multiplex_file() {
-    /bin/cp -f "$SCRIPTDIR/falco_traces.yaml.in" "$SCRIPTDIR/falco_traces.yaml"
+    cp $SCRIPTDIR/falco_traces.yaml.in $SCRIPTDIR/falco_traces.yaml

    prepare_multiplex_fileset traces-positive True
    prepare_multiplex_fileset traces-negative False
    prepare_multiplex_fileset traces-info True

-    if ${OPT_VERBOSE}; then
-        echo "Contents of $SCRIPTDIR/falco_traces.yaml"
-        cat "$SCRIPTDIR/falco_traces.yaml"
-    fi
+    echo "Contents of $SCRIPTDIR/falco_traces.yaml:"
+    cat $SCRIPTDIR/falco_traces.yaml
 }

 function print_test_failure_details() {
    echo "Showing full job logs for any tests that failed:"
-    jq '.tests[] | select(.status != "PASS") | .logfile' "$SCRIPTDIR/job-results/latest/results.json" | xargs cat
+    jq '.tests[] | select(.status != "PASS") | .logfile' $SCRIPTDIR/job-results/latest/results.json  | xargs cat
 }

 function run_tests() {
    rm -rf /tmp/falco_outputs
    mkdir /tmp/falco_outputs
-    # If we got this far, we can undo set -e,
-    # as we're watching the return status when running avocado.
+    # If we got this far, we can undo set -e, as we're watching the
+    # return status when running avocado.
    set +e
    TEST_RC=0
-    suites=($SCRIPTDIR/falco_traces.yaml $SCRIPTDIR/falco_tests.yaml $SCRIPTDIR/falco_k8s_audit_tests.yaml $SCRIPTDIR/falco_tests_psp.yaml)
-
-    if [ "$SKIP_PACKAGES_TESTS" = false ] ; then
-        suites+=($SCRIPTDIR/falco_tests_package.yaml)
-    fi
-    
-    XUNIT_DIR="${OPT_BUILD_DIR}/integration-tests-xunit"
-    mkdir -p "${XUNIT_DIR}"
-
-    for mult in "${suites[@]}"; do
-        XUNIT_FILE_NAME="${XUNIT_DIR}/$(basename "${mult}").xml"
-        CMD="avocado run --xunit ${XUNIT_FILE_NAME} --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
-        echo "Running $CMD"
-        BUILD_DIR=${OPT_BUILD_DIR} $CMD
-        RC=$?
-        TEST_RC=$((TEST_RC+RC))
-        if [ $RC -ne 0 ]; then
-            print_test_failure_details
-        fi
+    for mult in $SCRIPTDIR/falco_traces.yaml $SCRIPTDIR/falco_tests.yaml $SCRIPTDIR/falco_tests_package.yaml $SCRIPTDIR/falco_k8s_audit_tests.yaml $SCRIPTDIR/falco_tests_psp.yaml; do
+	CMD="avocado run --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
+	echo "Running: $CMD"
+	BUILD_DIR=${BUILD_DIR} $CMD
+	RC=$?
+	TEST_RC=$((TEST_RC+$RC))
+	if [ $RC -ne 0 ]; then
+	    print_test_failure_details
+	fi
    done
 }

-OPT_ONLY_PREPARE="false"
-OPT_VERBOSE="false"
-OPT_BUILD_DIR="$(dirname "$SCRIPTDIR")/build"
-OPT_BRANCH="none"
-while getopts ':p :h :v :b: :d:' 'OPTKEY'; do
-    case ${OPTKEY} in
-        'p')
-            OPT_ONLY_PREPARE="true"
-            ;;
-        'h')
-            /bin/bash usage
-            exit 0
-            ;;
-        'v')
-            OPT_VERBOSE="true"
-            ;;
-        'd')
-            OPT_BUILD_DIR=${OPTARG}
-            ;;
-        'b')
-            OPT_BRANCH=${OPTARG}
-            ;;
-        '?')
-            echo "Invalid option: ${OPTARG}." >&2
-            /bin/bash usage
-            exit 1
-            ;;
-        ':')
-            echo "Missing argument for option: ${OPTARG}." >&2
-            /bin/bash usage
-            exit 1
-            ;;
-        *)
-            echo "Unimplemented option: ${OPTKEY}." >&2
-            /bin/bash usage
-            exit 1
-            ;;
-        esac
-done
-
-TRACE_DIR=$OPT_BUILD_DIR/test
-
-if ${OPT_VERBOSE}; then
-    echo "Build directory = $OPT_BUILD_DIR"
-    echo "Trace directory = $TRACE_DIR"
-    echo "Custom branch   = $OPT_BRANCH"
-fi
-
-mkdir -p "$TRACE_DIR"
-
 download_trace_files
 prepare_multiplex_file
-
-if ! ${OPT_ONLY_PREPARE}; then
-    run_tests
-    exit $TEST_RC
-fi
+run_tests
+exit $TEST_RC
--- a/test/trace_files/CMakeLists.txt
+++ b/test/trace_files/CMakeLists.txt
@@ -1,6 +1,5 @@
 add_subdirectory(k8s_audit)
 add_subdirectory(psp)
-
 # Note: list of traces is created at cmake time, not build time
 file(GLOB test_trace_files
 	"${CMAKE_CURRENT_SOURCE_DIR}/*.scap")
@@ -12,8 +11,4 @@ foreach(trace_file_path ${test_trace_files})
 	add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		COMMAND ${CMAKE_COMMAND} -E copy ${trace_file_path} ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		DEPENDS ${trace_file_path})
-	list(APPEND BASE_SCAP_TRACE_FILES_TARGETS test-trace-${trace_file})
 endforeach()
-
-add_custom_target(trace-files-base-scap ALL)
-add_dependencies(trace-files-base-scap ${BASE_SCAP_TRACE_FILES_TARGETS})
--- a/test/trace_files/k8s_audit/CMakeLists.txt
+++ b/test/trace_files/k8s_audit/CMakeLists.txt
@@ -9,8 +9,4 @@ foreach(trace_file_path ${test_trace_files})
 	add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		COMMAND ${CMAKE_COMMAND} -E copy ${trace_file_path} ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		DEPENDS ${trace_file_path})
-	list(APPEND K8S_AUDIT_TRACE_FILES_TARGETS test-trace-${trace_file})
 endforeach()
-
-add_custom_target(trace-files-k8s-audit ALL)
-add_dependencies(trace-files-k8s-audit ${K8S_AUDIT_TRACE_FILES_TARGETS})
--- a/test/trace_files/psp/CMakeLists.txt
+++ b/test/trace_files/psp/CMakeLists.txt
@@ -10,8 +10,4 @@ foreach(trace_file_path ${test_trace_files})
 	add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		COMMAND ${CMAKE_COMMAND} -E copy ${trace_file_path} ${CMAKE_CURRENT_BINARY_DIR}/${trace_file}
 		DEPENDS ${trace_file_path})
-	list(APPEND PSP_TRACE_FILES_TARGETS test-trace-${trace_file})
 endforeach()
-
-add_custom_target(trace-files-psp ALL)
-add_dependencies(trace-files-psp ${PSP_TRACE_FILES_TARGETS})
--- a/test/usage
+++ b/test/usage
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-cat <<EOF
-Hello, this is Falco integration tests runner.
-
-SYNOPSIS
-
-    bash run_regression_tests.sh [-h] [-v] [-p] [-d=<build directory>] [-b=<custom branch>]
-
-DESCRIPTION
-
-    -h                      Display usage instructions
-    -v                      Verbose output
-    -p                      Prepare the falco_traces integration test suite
-    -b=CUSTOM_BRANCH        Specify a custom branch for downloading falco_traces fixtures (defaults to "none")
-    -d=BUILD_DIRECTORY      Specify the build directory where Falco has been built (defaults to $SCRIPTDIR/../build)
-EOF
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -14,11 +14,7 @@
 # License for the specific language governing permissions and limitations under
 # the License.
 #
-if(MINIMAL_BUILD)
-  set(FALCO_TESTS_SOURCES test_base.cpp engine/test_token_bucket.cpp engine/test_rulesets.cpp engine/test_falco_utils.cpp)
-else()
-  set(FALCO_TESTS_SOURCES test_base.cpp engine/test_token_bucket.cpp engine/test_rulesets.cpp engine/test_falco_utils.cpp falco/test_webserver.cpp)
-endif()
+set(FALCO_TESTS_SOURCES test_base.cpp engine/test_token_bucket.cpp engine/test_rulesets.cpp engine/test_falco_utils.cpp falco/test_webserver.cpp)

 set(FALCO_TESTED_LIBRARIES falco_engine)

@@ -39,25 +35,14 @@ if(FALCO_BUILD_TESTS)
  add_executable(falco_test ${FALCO_TESTS_SOURCES})

  target_link_libraries(falco_test PUBLIC ${FALCO_TESTED_LIBRARIES})
-
-  if(MINIMAL_BUILD)
-    target_include_directories(
-      falco_test
-      PUBLIC "${CATCH2_INCLUDE}"
-            "${FAKEIT_INCLUDE}"
-            "${PROJECT_SOURCE_DIR}/userspace/engine"
-            "${YAMLCPP_INCLUDE_DIR}"
-            "${PROJECT_SOURCE_DIR}/userspace/falco")
-  else()
-    target_include_directories(
-      falco_test
-      PUBLIC "${CATCH2_INCLUDE}"
-            "${FAKEIT_INCLUDE}"
-            "${PROJECT_SOURCE_DIR}/userspace/engine"
-            "${YAMLCPP_INCLUDE_DIR}"
-            "${CIVETWEB_INCLUDE_DIR}"
-            "${PROJECT_SOURCE_DIR}/userspace/falco")
-  endif()
+  target_include_directories(
+    falco_test
+    PUBLIC "${CATCH2_INCLUDE}"
+           "${FAKEIT_INCLUDE}"
+           "${PROJECT_SOURCE_DIR}/userspace/engine"
+           "${YAMLCPP_INCLUDE_DIR}"
+           "${CIVETWEB_INCLUDE_DIR}"
+           "${PROJECT_SOURCE_DIR}/userspace/falco")
  add_dependencies(falco_test catch2)

  include(CMakeParseArguments)
--- a/userspace/README.md
+++ b/userspace/README.md
@@ -0,0 +1,22 @@
+# Userspace
+
+Here is where the main Falco engine lives.
+
+There are two libraries here that are roughly seperated in the following way.are
+
+### falco
+
+This is the beloved `main()` function of the Falco program, as well as the logic for various falco outputs.
+
+An output is just a way of delivering a Falco alert, the most simple output is the Falco stdout log.
+
+### engine
+
+This is the processing engine that connect the inbound stream of systemcalls to the rules engine.
+
+This is the main powerhouse behind Falco, and does the assertion at runtime that compares system call events to rules.are
+
+
+### CMake
+
+If you are adding new files to either library you must define the `.cpp` file in the associated CMakeLists.txt file such that the linker will know where to find your new file.
--- a/userspace/engine/CMakeLists.txt
+++ b/userspace/engine/CMakeLists.txt
@@ -16,6 +16,7 @@ set(FALCO_ENGINE_SOURCE_FILES
    falco_engine.cpp
    falco_utils.cpp
    json_evt.cpp
+    prettyprint.cpp
    ruleset.cpp
    token_bucket.cpp
    formats.cpp)
@@ -23,36 +24,18 @@ set(FALCO_ENGINE_SOURCE_FILES
 add_library(falco_engine STATIC ${FALCO_ENGINE_SOURCE_FILES})
 add_dependencies(falco_engine njson lyaml lpeg string-view-lite)

-if(USE_BUNDLED_DEPS)
-  add_dependencies(falco_engine libyaml)
-endif()
-
-if(MINIMAL_BUILD)
-  target_include_directories(
-    falco_engine
-    PUBLIC
-      "${LUAJIT_INCLUDE}"
-      "${NJSON_INCLUDE}"
-      "${TBB_INCLUDE_DIR}"
-      "${STRING_VIEW_LITE_INCLUDE}"
-      "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp"
-      "${SYSDIG_SOURCE_DIR}/userspace/libscap"
-      "${SYSDIG_SOURCE_DIR}/userspace/libsinsp"
-      "${PROJECT_BINARY_DIR}/userspace/engine")
-else()
-  target_include_directories(
-    falco_engine
-    PUBLIC
-      "${LUAJIT_INCLUDE}"
-      "${NJSON_INCLUDE}"
-      "${CURL_INCLUDE_DIR}"
-      "${TBB_INCLUDE_DIR}"
-      "${STRING_VIEW_LITE_INCLUDE}"
-      "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp"
-      "${SYSDIG_SOURCE_DIR}/userspace/libscap"
-      "${SYSDIG_SOURCE_DIR}/userspace/libsinsp"
-      "${PROJECT_BINARY_DIR}/userspace/engine")
-endif()
+target_include_directories(
+  falco_engine
+  PUBLIC
+    "${LUAJIT_INCLUDE}"
+    "${NJSON_INCLUDE}"
+    "${CURL_INCLUDE_DIR}"
+    "${TBB_INCLUDE_DIR}"
+    "${STRING_VIEW_LITE_INCLUDE}"
+    "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/third-party/jsoncpp"
+    "${SYSDIG_SOURCE_DIR}/userspace/libscap"
+    "${SYSDIG_SOURCE_DIR}/userspace/libsinsp"
+    "${PROJECT_BINARY_DIR}/userspace/engine")

 target_link_libraries(falco_engine "${FALCO_SINSP_LIBRARY}" "${LPEG_LIB}" "${LYAML_LIB}" "${LIBYAML_LIB}")

--- a/userspace/engine/falco_engine.cpp
+++ b/userspace/engine/falco_engine.cpp
@@ -22,6 +22,7 @@ limitations under the License.
 #include "falco_engine.h"
 #include "falco_utils.h"
 #include "falco_engine_version.h"
+#include "prettyprint.h"
 #include "config_falco_engine.h"

 #include "formats.h"
@@ -171,8 +172,9 @@ void falco_engine::load_rules(const string &rules_content, bool verbose, bool al
 					  m_ls);
 	}

-	// Note that falco_formats is added to the lua state used
-	// by the falco engine only. Within the engine, only
+	// Note that falco_formats is added to both the lua state used
+	// by the falco engine as well as the separate lua state used
+	// by falco outputs.  Within the engine, only
 	// formats.formatter is used, so we can unconditionally set
 	// json_output to false.
 	bool json_output = false;
@@ -315,6 +317,9 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_sinsp_event(sinsp_ev
 			string err = "Error invoking function output: " + string(lerr);
 			throw falco_exception(err);
 		}
+
+		prettyprint::sinsp_event(ev, "Raw event just before popping to Lua");
+
 		res->evt = ev;
 		const char *p =  lua_tostring(m_ls, -3);
 		res->rule = p;
--- a/userspace/engine/falco_engine_version.h
+++ b/userspace/engine/falco_engine_version.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,9 +16,9 @@ limitations under the License.

 // The version of rules/filter fields/etc supported by this falco
 // engine.
-#define FALCO_ENGINE_VERSION (7)
+#define FALCO_ENGINE_VERSION (5)

 // This is the result of running "falco --list -N | sha256sum" and
 // represents the fields supported by this version of falco. It's used
 // at build time to detect a changed set of fields.
-#define FALCO_FIELDS_CHECKSUM "2f324e2e66d4b423f53600e7e0fcf2f0ff72e4a87755c490f2ae8f310aba9386"
+#define FALCO_FIELDS_CHECKSUM "ca9e75fa41fe4480cdfad8cf275cdbbc334e656569f070c066d87cbd2955c1ae"
--- a/userspace/engine/falco_utils.cpp
+++ b/userspace/engine/falco_utils.cpp
@@ -52,12 +52,6 @@ std::string wrap_text(const std::string& str, uint32_t initial_pos, uint32_t ind
 	return ret;
 }

-uint32_t hardware_concurrency()
-{
-	auto hc = std::thread::hardware_concurrency();
-	return hc ? hc : 1;
-}
-
 void readfile(const std::string& filename, std::string& data)
 {
 	std::ifstream file(filename.c_str(), std::ios::in);
--- a/userspace/engine/falco_utils.h
+++ b/userspace/engine/falco_utils.h
@@ -21,7 +21,6 @@ limitations under the License.
 #include <fstream>
 #include <iostream>
 #include <string>
-#include <thread>
 #include <nonstd/string_view.hpp>

 #pragma once
@@ -35,9 +34,6 @@ namespace utils
 std::string wrap_text(const std::string& str, uint32_t initial_pos, uint32_t indent, uint32_t line_len);

 void readfile(const std::string& filename, std::string& data);
-
-uint32_t hardware_concurrency();
-
 namespace network
 {
 static const std::string UNIX_SCHEME("unix://");
--- a/userspace/engine/formats.cpp
+++ b/userspace/engine/formats.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,19 +20,24 @@ limitations under the License.
 #include "falco_engine.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

-sinsp *falco_formats::s_inspector = NULL;
+
+sinsp* falco_formats::s_inspector = NULL;
 falco_engine *falco_formats::s_engine = NULL;
 bool falco_formats::s_json_output = false;
 bool falco_formats::s_json_include_output_property = true;
-std::unique_ptr<sinsp_evt_formatter_cache> falco_formats::s_formatters = NULL;
+sinsp_evt_formatter_cache *falco_formats::s_formatters = NULL;

-const static struct luaL_Reg ll_falco[] =
-	{
-		{"formatter", &falco_formats::lua_formatter},
-		{"free_formatter", &falco_formats::lua_free_formatter},
-		{NULL, NULL}};
+const static struct luaL_reg ll_falco [] =
+{
+	{"formatter", &falco_formats::formatter},
+	{"free_formatter", &falco_formats::free_formatter},
+	{"free_formatters", &falco_formats::free_formatters},
+	{"format_event", &falco_formats::format_event},
+	{"resolve_tokens", &falco_formats::resolve_tokens},
+	{NULL,NULL}
+};

-void falco_formats::init(sinsp *inspector,
+void falco_formats::init(sinsp* inspector,
 			 falco_engine *engine,
 			 lua_State *ls,
 			 bool json_output,
@@ -42,14 +47,15 @@ void falco_formats::init(sinsp *inspector,
 	s_engine = engine;
 	s_json_output = json_output;
 	s_json_include_output_property = json_include_output_property;
-
-	// todo(leogr): we should have used std::make_unique, but we cannot since it's not C++14
-	s_formatters = std::unique_ptr<sinsp_evt_formatter_cache>(new sinsp_evt_formatter_cache(s_inspector));
+	if(!s_formatters)
+	{
+		s_formatters = new sinsp_evt_formatter_cache(s_inspector);
+	}

 	luaL_openlib(ls, "formats", ll_falco, 0);
 }

-int falco_formats::lua_formatter(lua_State *ls)
+int falco_formats::formatter(lua_State *ls)
 {
 	string source = luaL_checkstring(ls, -2);
 	string format = luaL_checkstring(ls, -1);
@@ -58,7 +64,7 @@ int falco_formats::lua_formatter(lua_State *ls)
 	{
 		if(source == "syscall")
 		{
-			sinsp_evt_formatter *formatter;
+			sinsp_evt_formatter* formatter;
 			formatter = new sinsp_evt_formatter(s_inspector, format);
 			lua_pushlightuserdata(ls, formatter);
 		}
@@ -69,11 +75,11 @@ int falco_formats::lua_formatter(lua_State *ls)
 			lua_pushlightuserdata(ls, formatter);
 		}
 	}
-	catch(sinsp_exception &e)
+	catch(sinsp_exception& e)
 	{
 		luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
 	}
-	catch(falco_exception &e)
+	catch(falco_exception& e)
 	{
 		luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
 	}
@@ -81,10 +87,10 @@ int falco_formats::lua_formatter(lua_State *ls)
 	return 1;
 }

-int falco_formats::lua_free_formatter(lua_State *ls)
+int falco_formats::free_formatter(lua_State *ls)
 {
-	if(!lua_islightuserdata(ls, -1) ||
-	   !lua_isstring(ls, -2))
+	if (!lua_islightuserdata(ls, -1) ||
+	    !lua_isstring(ls, -2))

 	{
 		luaL_error(ls, "Invalid argument passed to free_formatter");
@@ -94,75 +100,115 @@ int falco_formats::lua_free_formatter(lua_State *ls)

 	if(source == "syscall")
 	{
-		sinsp_evt_formatter *formatter = (sinsp_evt_formatter *)lua_topointer(ls, -1);
+		sinsp_evt_formatter *formatter = (sinsp_evt_formatter *) lua_topointer(ls, -1);
 		delete(formatter);
 	}
 	else
 	{
-		json_event_formatter *formatter = (json_event_formatter *)lua_topointer(ls, -1);
+		json_event_formatter *formatter = (json_event_formatter *) lua_topointer(ls, -1);
 		delete(formatter);
 	}

 	return 0;
 }

-string falco_formats::format_event(const gen_event *evt, const std::string &rule, const std::string &source,
-				   const std::string &level, const std::string &format)
+int falco_formats::free_formatters(lua_State *ls)
 {
+	if(s_formatters)
+	{
+		delete(s_formatters);
+		s_formatters = NULL;
+	}
+	return 0;
+}

+int falco_formats::format_event (lua_State *ls)
+{
 	string line;
 	string json_line;
+
+	if (!lua_isstring(ls, -1) ||
+	    !lua_isstring(ls, -2) ||
+	    !lua_isstring(ls, -3) ||
+	    !lua_isstring(ls, -4) ||
+	    !lua_islightuserdata(ls, -5)) {
+		lua_pushstring(ls, "Invalid arguments passed to format_event()");
+		lua_error(ls);
+	}
+	gen_event* evt = (gen_event*)lua_topointer(ls, 1);
+	const char *rule = (char *) lua_tostring(ls, 2);
+	const char *source = (char *) lua_tostring(ls, 3);
+	const char *level = (char *) lua_tostring(ls, 4);
+	const char *format = (char *) lua_tostring(ls, 5);
+
 	string sformat = format;

-	if(strcmp(source.c_str(), "syscall") == 0)
+	if(strcmp(source, "syscall") == 0)
 	{
-		// This is "output"
-		s_formatters->tostring((sinsp_evt *)evt, sformat, &line);
+		try {
+			// This is "output"
+			s_formatters->tostring((sinsp_evt *) evt, sformat, &line);

-		if(s_json_output)
+			if(s_json_output)
+			{
+				sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
+				switch(cur_fmt)
+				{
+					case sinsp_evt::PF_NORMAL:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
+						break;
+					case sinsp_evt::PF_EOLS:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
+						break;
+					case sinsp_evt::PF_HEX:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
+						break;
+					case sinsp_evt::PF_HEXASCII:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
+						break;
+					case sinsp_evt::PF_BASE64:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
+						break;
+					default:
+						// do nothing
+						break;
+				}
+				// This is output fields
+				s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line);
+
+				// The formatted string might have a leading newline. If it does, remove it.
+				if (json_line[0] == '\n')
+				{
+					json_line.erase(0, 1);
+				}
+				s_inspector->set_buffer_format(cur_fmt);
+			}
+		}
+		catch (sinsp_exception& e)
 		{
-			sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
-			switch(cur_fmt)
-			{
-			case sinsp_evt::PF_NORMAL:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
-				break;
-			case sinsp_evt::PF_EOLS:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
-				break;
-			case sinsp_evt::PF_HEX:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
-				break;
-			case sinsp_evt::PF_HEXASCII:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
-				break;
-			case sinsp_evt::PF_BASE64:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
-				break;
-			default:
-				// do nothing
-				break;
-			}
-			// This is output fields
-			s_formatters->tostring((sinsp_evt *)evt, sformat, &json_line);
-
-			// The formatted string might have a leading newline. If it does, remove it.
-			if(json_line[0] == '\n')
-			{
-				json_line.erase(0, 1);
-			}
-			s_inspector->set_buffer_format(cur_fmt);
+			string err = "Invalid output format '" + sformat + "': '" + string(e.what()) + "'";
+			lua_pushstring(ls, err.c_str());
+			lua_error(ls);
 		}
 	}
 	else
 	{
-		json_event_formatter formatter(s_engine->json_factory(), sformat);
+		try {

-		line = formatter.tostring((json_event *)evt);
+			json_event_formatter formatter(s_engine->json_factory(), sformat);

-		if(s_json_output)
+			line = formatter.tostring((json_event *) evt);
+
+			if(s_json_output)
+			{
+				json_line = formatter.tojson((json_event *) evt);
+			}
+		}
+		catch (exception &e)
 		{
-			json_line = formatter.tojson((json_event *)evt);
+			string err = "Invalid output format '" + sformat + "': '" + string(e.what()) + "'";
+			lua_pushstring(ls, err.c_str());
+			lua_error(ls);
 		}
 	}

@@ -171,16 +217,15 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
 	// message as well as the event time in ns. Use this to build
 	// a more detailed object containing the event time, rule,
 	// severity, full output, and fields.
-	if(s_json_output)
-	{
+	if (s_json_output) {
 		Json::Value event;
 		Json::FastWriter writer;
 		string full_line;

 		// Convert the time-as-nanoseconds to a more json-friendly ISO8601.
-		time_t evttime = evt->get_ts() / 1000000000;
+		time_t evttime = evt->get_ts()/1000000000;
 		char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
-		char time_ns[12];  // sizeof ".sssssssssZ"
+		char time_ns[12]; // sizeof ".sssssssssZ"
 		string iso8601evttime;

 		strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime));
@@ -201,9 +246,9 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule

 		// Json::FastWriter may add a trailing newline. If it
 		// does, remove it.
-		if(full_line[full_line.length() - 1] == '\n')
+		if (full_line[full_line.length()-1] == '\n')
 		{
-			full_line.resize(full_line.length() - 1);
+			full_line.resize(full_line.length()-1);
 		}

 		// Cheat-graft the output from the formatter into this
@@ -216,12 +261,24 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
 		line = full_line;
 	}

-	return line.c_str();
+	lua_pushstring(ls, line.c_str());
+	return 1;
 }

-map<string, string> falco_formats::resolve_tokens(const gen_event *evt, const std::string &source, const std::string &format)
+int falco_formats::resolve_tokens(lua_State *ls)
 {
+	if(!lua_isstring(ls, -1) ||
+	   !lua_isstring(ls, -2) ||
+	   !lua_islightuserdata(ls, -3))
+	{
+		lua_pushstring(ls, "Invalid arguments passed to resolve_tokens()");
+		lua_error(ls);
+	}
+	gen_event *evt = (gen_event *)lua_topointer(ls, 1);
+	string source = luaL_checkstring(ls, 2);
+	const char *format = (char *)lua_tostring(ls, 3);
 	string sformat = format;
+
 	map<string, string> values;
 	if(source == "syscall")
 	{
@@ -231,7 +288,16 @@ map<string, string> falco_formats::resolve_tokens(const gen_event *evt, const st
 	else
 	{
 		json_event_formatter json_formatter(s_engine->json_factory(), sformat);
-		values = json_formatter.tomap((json_event *)evt);
+		values = json_formatter.tomap((json_event*) evt);
 	}
-	return values;
+
+	lua_newtable(ls);
+	for(auto const& v : values)
+	{
+		lua_pushstring(ls, v.first.c_str());
+		lua_pushstring(ls, v.second.c_str());
+		lua_settable(ls, -3);
+	}
+
+	return 1;
 }
--- a/userspace/engine/formats.h
+++ b/userspace/engine/formats.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -18,8 +18,7 @@ limitations under the License.

 #include "sinsp.h"

-extern "C"
-{
+extern "C" {
 #include "lua.h"
 #include "lualib.h"
 #include "lauxlib.h"
@@ -32,28 +31,31 @@ class sinsp_evt_formatter;

 class falco_formats
 {
-public:
-	static void init(sinsp *inspector,
+ public:
+	static void init(sinsp* inspector,
 			 falco_engine *engine,
 			 lua_State *ls,
 			 bool json_output,
 			 bool json_include_output_property);

 	// formatter = falco.formatter(format_string)
-	static int lua_formatter(lua_State *ls);
+	static int formatter(lua_State *ls);

 	// falco.free_formatter(formatter)
-	static int lua_free_formatter(lua_State *ls);
+	static int free_formatter(lua_State *ls);

-	static string format_event(const gen_event *evt, const std::string &rule, const std::string &source,
-				   const std::string &level, const std::string &format);
+	// falco.free_formatters()
+	static int free_formatters(lua_State *ls);

-	static map<string, string> resolve_tokens(const gen_event *evt, const std::string &source,
-						  const std::string &format);
+	// formatted_string = falco.format_event(evt, formatter)
+	static int format_event(lua_State *ls);

-	static sinsp *s_inspector;
+	// resolve_tokens = falco.resolve_tokens(evt, formatter)
+	static int resolve_tokens(lua_State *ls);
+
+	static sinsp* s_inspector;
 	static falco_engine *s_engine;
-	static std::unique_ptr<sinsp_evt_formatter_cache> s_formatters;
+	static sinsp_evt_formatter_cache *s_formatters;
 	static bool s_json_output;
 	static bool s_json_include_output_property;
 };
--- a/userspace/engine/json_evt.cpp
+++ b/userspace/engine/json_evt.cpp
@@ -45,7 +45,7 @@ const json &json_event::jevt()
 	return m_jevt;
 }

-uint64_t json_event::get_ts() const
+uint64_t json_event::get_ts()
 {
 	return m_event_ts;
 }
--- a/userspace/engine/json_evt.h
+++ b/userspace/engine/json_evt.h
@@ -38,14 +38,14 @@ public:
 	void set_jevt(nlohmann::json &evt, uint64_t ts);
 	const nlohmann::json &jevt();

-	uint64_t get_ts() const;
+	uint64_t get_ts();

-	inline uint16_t get_source() const
+	inline uint16_t get_source()
 	{
 		return ESRC_K8S_AUDIT;
 	}

-	inline uint16_t get_type() const
+	inline uint16_t get_type()
 	{
 		// All k8s audit events have the single tag "1". - see falco_engine::process_k8s_audit_event
 		return 1;
--- a/userspace/engine/prettyprint.cpp
+++ b/userspace/engine/prettyprint.cpp
@@ -0,0 +1,82 @@
+/*
+Copyright (C) 2019 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "prettyprint.h"
+
+/**
+ * sinsp_event will pretty print a pointer to a sinsp_evt.
+ *
+ * This can be used for debugging an event at various times during development.
+ * This should never be turned on in production. Feel free to add fields below
+ * as we need them, and we can just dump an event in here whenever we need while
+ * debugging.
+ *
+ * sinsp_events are blue because they are happy.
+ */
+void prettyprint::sinsp_event(sinsp_evt *ev, const char* note)
+{
+  ev->get_type()
+  prettyprint::warning();
+  printf("\033[0;34m"); // Start Blue
+  printf("\n*************************************************************\n");
+  printf("[Sinsp Event: %s]\n\n", note);
+  printf("name: %s\n", ev->get_name());
+  for(uint32_t i = 0; i <= ev->get_num_params(); i++){
+  }
+  for(int64_t j = 0; j <= ev->get_fd_num(); j++) {
+    printf("%s: %s\n", ev->get_param_name(j), ev->get_param_value_str(j, true).c_str());
+  };
+  // One off fields
+  //printf("fdinfo: %s\n", ev->get_fd_info()->tostring_clean().c_str());
+  //printf("type: %d\n", ev->get_type());
+/*
+  printf("k8s.ns.name: %s\n", ev->get_param_value_str("k8s.ns.name", true).c_str());
+  printf("k8s %s\n", ev->get_param_value_str("k8s", true).c_str());
+  printf("container: %s\n", ev->get_param_value_str("container", true).c_str());
+  printf("proc.pid: %s\n", ev->get_param_value_str("%proc.pid", true).c_str());
+  printf("proc: %s\n", ev->get_param_value_str("%proc", true).c_str());
+  printf("data: %s\n", ev->get_param_value_str("data", true).c_str());
+  printf("cpu: %s\n", ev->get_param_value_str("cpu", true).c_str());
+  printf("fd: %s\n", ev->get_param_value_str("fd", true).c_str());
+  printf("fd: %s\n", ev->get_param_value_str("evt.arg.fd", true).c_str());
+  printf("user: %s\n", ev->get_param_value_str("user", true).c_str());
+*/
+
+  printf("*************************************************************\n");
+  printf("\033[0m");
+}
+
+/**
+ * has_alerted controls our one time preliminary alert for using pretty print which is debug only
+ */
+bool prettyprint::has_alerted = false;
+
+/**
+ * Warnings are red
+ */
+void prettyprint::warning() {
+  if (!prettyprint::has_alerted) {
+    printf("\033[0;31m"); // Start Red
+    printf("\n\n");
+    printf("*************************************************************\n");
+    printf("          [Pretty Printing Debugging is Enabled]             \n");
+    printf("  This should never be used in production, by anyone, ever.  \n");
+    printf("*************************************************************\n");
+    printf("\033[0m");
+    prettyprint::has_alerted = true;
+  }
+}
+
--- a/userspace/falco/outputs_stdout.h
+++ b/userspace/falco/outputs_stdout.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,24 +14,29 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-#pragma once
+#include <string>
+#include <set>
+#include <vector>
+#include <list>
+#include <map>

-#include "outputs.h"
+#include "sinsp.h"
+#include "filter.h"
+#include "event.h"

-namespace falco
-{
-namespace outputs
-{
+#include "gen_filter.h"

-class output_stdout : public abstract_output
-{
-	void output_event(gen_event *evt, std::string &rule, std::string &source,
-			  falco_common::priority_type priority, std::string &format, std::string &msg);

-	void output_msg(falco_common::priority_type priority, std::string &msg);
+#ifndef FALCO_FALCO_USERSPACE_PRETTYPRINT_H_
+#define FALCO_FALCO_USERSPACE_PRETTYPRINT_H_

-	void cleanup();
+class prettyprint {
+ public:
+  static void sinsp_event(sinsp_evt *ev, const char* note = "");
+
+ private:
+  static bool has_alerted;
+  static void warning();
 };

-} // namespace outputs
-} // namespace falco
+#endif //FALCO_FALCO_USERSPACE_PRETTYPRINT_H_
--- a/userspace/engine/rules.cpp
+++ b/userspace/engine/rules.cpp
@@ -26,14 +26,15 @@ extern "C" {
 #include "falco_engine.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

-const static struct luaL_Reg ll_falco_rules[] =
-	{
-		{"clear_filters", &falco_rules::clear_filters},
-		{"add_filter", &falco_rules::add_filter},
-		{"add_k8s_audit_filter", &falco_rules::add_k8s_audit_filter},
-		{"enable_rule", &falco_rules::enable_rule},
-		{"engine_version", &falco_rules::engine_version},
-		{NULL, NULL}};
+const static struct luaL_reg ll_falco_rules [] =
+{
+	{"clear_filters", &falco_rules::clear_filters},
+	{"add_filter", &falco_rules::add_filter},
+	{"add_k8s_audit_filter", &falco_rules::add_k8s_audit_filter},
+	{"enable_rule", &falco_rules::enable_rule},
+	{"engine_version", &falco_rules::engine_version},
+	{NULL,NULL}
+};

 falco_rules::falco_rules(sinsp* inspector,
 			 falco_engine *engine,
--- a/userspace/falco/CMakeLists.txt
+++ b/userspace/falco/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -11,169 +11,102 @@
 # specific language governing permissions and limitations under the License.
 #

-configure_file(config_falco.h.in config_falco.h)
+configure_file("${SYSDIG_SOURCE_DIR}/userspace/sysdig/config_sysdig.h.in" config_sysdig.h)

-set(
-  FALCO_SOURCES
-  cli.cpp
-  configuration.cpp
-  logger.cpp
-  falco_outputs.cpp
-  outputs_file.cpp
-  outputs_program.cpp
-  outputs_stdout.cpp
-  outputs_syslog.cpp
-  event_drops.cpp
-  statsfilewriter.cpp
-  falco.cpp
-  "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/fields_info.cpp"
-)
-
-set(
-  FALCO_INCLUDE_DIRECTORIES
-  "${PROJECT_SOURCE_DIR}/userspace/engine"
-  "${PROJECT_BINARY_DIR}/userspace/falco"
-  "${PROJECT_BINARY_DIR}/driver/src"
-  "${STRING_VIEW_LITE_INCLUDE}"
-  "${CXXOPTS_INCLUDE}"
-  "${YAMLCPP_INCLUDE_DIR}"
-  "${CMAKE_CURRENT_BINARY_DIR}"
-  "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include"
-)
-
-set(
-  FALCO_DEPENDENCIES
-  cxxopts
-  string-view-lite
-  libyaml
-  b64
-  luajit
-  lpeg
-  lyaml
-)
-
-set(
-  FALCO_LIBRARIES
-  falco_engine
-  sinsp
-  "${LIBYAML_LIB}"
-  "${YAMLCPP_LIB}"
-)
-
-if(USE_BUNDLED_DEPS)
-  list(APPEND FALCO_DEPENDENCIES yamlcpp)
-endif()
-
-if(NOT MINIMAL_BUILD)
-  list(
-    APPEND FALCO_SOURCES
-    outputs_grpc.cpp
-    outputs_http.cpp
-    webserver.cpp
-    grpc_context.cpp
-    grpc_server_impl.cpp
-    grpc_request_context.cpp
-    grpc_server.cpp
-    grpc_context.cpp
-    grpc_server_impl.cpp
-    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
-  )
-
-  list(
-    APPEND FALCO_INCLUDE_DIRECTORIES
-    "${CIVETWEB_INCLUDE_DIR}"
-    "${OPENSSL_INCLUDE_DIR}"
-    "${GRPC_INCLUDE}"
-    "${GRPCPP_INCLUDE}"
-    "${PROTOBUF_INCLUDE}"
-  )
-
-  list(APPEND FALCO_DEPENDENCIES civetweb)
-
-  list(
-    APPEND FALCO_LIBRARIES
-    "${GPR_LIB}"
-    "${GRPC_LIB}"
-    "${GRPCPP_LIB}"
-    "${PROTOBUF_LIB}"
-    "${OPENSSL_LIBRARY_SSL}"
-    "${OPENSSL_LIBRARY_CRYPTO}"
-    "${LIBYAML_LIB}"
-    "${YAMLCPP_LIB}"
-    "${CIVETWEB_LIB}"
-  )
-endif()
-
-add_executable(
-  falco
-  ${FALCO_SOURCES}
-)
-
-add_dependencies(falco ${FALCO_DEPENDENCIES})
-
-target_link_libraries(
-  falco
-  ${FALCO_LIBRARIES}
-)
-
-target_include_directories(
-  falco
-  PUBLIC
-  ${FALCO_INCLUDE_DIRECTORIES}
-)
-
-# if(NOT MINIMAL_BUILD)
-#   add_custom_command(
-#     TARGET falco
-#     COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/verify_engine_fields.sh ${CMAKE_SOURCE_DIR}
-#     WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-#     COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields"
-#   )
-# else()
-#   message(STATUS "Skipping engine fields checksum when building the minimal Falco.")
-# endif()
-
-if(NOT MINIMAL_BUILD)
-  add_custom_command(
-    OUTPUT
+add_custom_command(
+  OUTPUT
    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.h
    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.h
+    ${CMAKE_CURRENT_BINARY_DIR}/output.grpc.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/output.grpc.pb.h
+    ${CMAKE_CURRENT_BINARY_DIR}/output.pb.cc
+    ${CMAKE_CURRENT_BINARY_DIR}/output.pb.h
    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.h
-    COMMENT "Generate gRPC API"
-    # Falco gRPC Version API
-    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
-    ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    # Falco gRPC Outputs API
-    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
-    ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-  )
+  COMMENT "Generate gRPC version API"
+  DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+  COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+  COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
+          ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+  COMMENT "Generate gRPC outputs API"
+  DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/output.proto
+  COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/output.proto
+          ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
+  COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
+          ${CMAKE_CURRENT_SOURCE_DIR}/output.proto
+  WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+
+add_executable(
+  falco
+  configuration.cpp
+  logger.cpp
+  falco_outputs.cpp
+  event_drops.cpp
+  statsfilewriter.cpp
+  falco.cpp
+  "${SYSDIG_SOURCE_DIR}/userspace/sysdig/fields_info.cpp"
+  webserver.cpp
+  grpc_context.cpp
+  grpc_server_impl.cpp
+  grpc_request_context.cpp
+  grpc_server.cpp
+  ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
+  ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
+  ${CMAKE_CURRENT_BINARY_DIR}/output.grpc.pb.cc
+  ${CMAKE_CURRENT_BINARY_DIR}/output.pb.cc
+  ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc)
+
+add_dependencies(falco civetweb string-view-lite)
+
+if(USE_BUNDLED_DEPS)
+  add_dependencies(falco yamlcpp)
 endif()

-# strip the Falco binary when releasing using musl
-if(MUSL_OPTIMIZED_BUILD AND CMAKE_BUILD_TYPE STREQUAL "release")
-  add_custom_command(
-    TARGET falco
-    POST_BUILD
-    COMMAND ${CMAKE_STRIP} --strip-unneeded falco
-    COMMENT "Strip the Falco binary when releasing the musl build"
-  )
-endif()
+target_include_directories(
+  falco
+  PUBLIC
+    "${SYSDIG_SOURCE_DIR}/userspace/sysdig"
+    "${PROJECT_SOURCE_DIR}/userspace/engine"
+    "${PROJECT_BINARY_DIR}/userspace/falco"
+    "${PROJECT_BINARY_DIR}/driver/src"
+    "${STRING_VIEW_LITE_INCLUDE}"
+    "${YAMLCPP_INCLUDE_DIR}"
+    "${CIVETWEB_INCLUDE_DIR}"
+    "${GRPC_INCLUDE}"
+    "${GRPCPP_INCLUDE}"
+    "${PROTOBUF_INCLUDE}"
+    "${CMAKE_CURRENT_BINARY_DIR}"
+    "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include")
+
+target_link_libraries(
+  falco
+  falco_engine
+  sinsp
+  "${GPR_LIB}"
+  "${GRPC_LIB}"
+  "${GRPCPP_LIB}"
+  "${PROTOBUF_LIB}"
+  "${LIBYAML_LIB}"
+  "${YAMLCPP_LIB}"
+  "${CIVETWEB_LIB}")
+
+configure_file(config_falco.h.in config_falco.h)
+
+add_custom_command(
+  TARGET falco
+  COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/verify_engine_fields.sh ${CMAKE_SOURCE_DIR} ${OPENSSL_BINARY}
+  WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+  COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields")
+
+# add_custom_target(verify_engine_fields DEPENDS verify_engine_fields.sh falco_engine.h)
+
+# add_dependencies(verify_engine_fields falco)

 install(TARGETS falco DESTINATION ${FALCO_BIN_DIR})
+install(
+  DIRECTORY lua
+  DESTINATION ${FALCO_SHARE_DIR}
+  FILES_MATCHING
+  PATTERN *.lua)
--- a/userspace/falco/cli.cpp
+++ b/userspace/falco/cli.cpp
@@ -1,22 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "cli.h"
-
-namespace falco
-{
-
-} // namespace falco
--- a/userspace/falco/cli.h
+++ b/userspace/falco/cli.h
@@ -1,188 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <cxxopts.hpp>
-
-namespace falco
-{
-
-class option_requires_specific_argument_exception : public cxxopts::OptionParseException
-{
-public:
-	explicit option_requires_specific_argument_exception(const std::string& option, const std::string& values):
-		OptionParseException("Option " + cxxopts::LQUOTE + option + cxxopts::RQUOTE + " requires an argument equal to " + values)
-	{
-	}
-};
-
-class option_cannot_be_specified_exception : public cxxopts::OptionParseException
-{
-public:
-	explicit option_cannot_be_specified_exception(const std::string& option1, const std::string& option2):
-		OptionParseException("Options " + cxxopts::LQUOTE + option1 + cxxopts::RQUOTE + " and " + cxxopts::LQUOTE + option2 + cxxopts::RQUOTE + " can not be specified together")
-	{
-	}
-};
-
-class cli
-{
-public:
-	cli(int argc, const char** argv):
-		m_argc(argc), m_argv(argv), m_options("falco", "Cloud-Native Runtime Security")
-	{
-	}
-	virtual ~cli()
-	{
-	}
-
-	void run()
-	{
-		// These options give some info about Falco (Falco exits).
-		m_options.add_options(
-			"help",
-			{
-				{"h,help", "Print help page."},
-				{"support", "Print support information (version, rules files, etc.)."},
-				{"version", "Print version info."},
-			});
-
-		// These are options responsible for listing Falco elements (Falco exits).
-		m_options.add_options(
-			"list",
-			{
-				{"L", "Show name and description of all rules."},
-				{"l", "Show name and description of a specific rule.", cxxopts::value<std::string>(), "rule name"},
-				{"list", "Show all fields.", cxxopts::value<std::string>()->implicit_value("all"), "sycall|k8s_audit"},
-				{"N", "Show field names only."},
-			});
-
-		// m_options.add_options(
-		// 	"output",
-		// 	{
-		// 		{},
-		// 	});
-
-		// m_options.add_options(
-		// 	"input",
-		// 	{
-		// 		{},
-		// 	});
-
-		m_options.add_options(
-			"filtering",
-			{
-				{"D", "Disable any rules with names having the given substring. Can be specified multiple times. Can not be specified with -t.", cxxopts::value<std::vector<std::string>>(), "substring"},
-				{"T", "Disable any rules with a specific tag. Can be specified several times. Can not be specified with -t.", cxxopts::value<std::vector<std::string>>(), "tag"},
-				{"t", "Only run those rules with a specific tag. Can be specified several times. Can not be specified with -T or -D.", cxxopts::value<std::vector<std::string>>(), "tag"},
-			});
-
-		m_result = m_options.parse(m_argc, m_argv);
-
-		process();
-	}
-
-private:
-	void process()
-	{
-		if(m_result.count("help") && m_result["help"].as<bool>())
-		{
-			std::cout << m_options.help() << std::endl;
-			// todo: print > exit
-		}
-
-		if(m_result.count("support") && m_result["support"].as<bool>())
-		{
-			// todo: argv + config rule filenames > cmdline > print > exit
-		}
-
-		if(m_result.count("version") && m_result["version"].as<bool>())
-		{
-			// todo: print > exit
-		}
-
-		if(m_result.count("L") && m_result["L"].as<bool>())
-		{
-			// todo: engine > print > exit
-			// engine->describe_rule(NULL)
-		}
-
-		if(m_result.count("l"))
-		{
-			// todo: engine > print > exit
-			// engine->describe_rule(m_result["l"].as<string>());
-		}
-
-		if(m_result.count("list"))
-		{
-			auto source = m_result["list"].as<std::string>();
-			// todo: retrieve implicit value
-			if(source.empty() || (source != "syscall" && source != "k8s_audit" && source != "all"))
-			{
-				throw falco::option_requires_specific_argument_exception(
-					"list",
-					cxxopts::LQUOTE + "syscall" + cxxopts::RQUOTE + " or " + cxxopts::LQUOTE + "k8s_audit" + cxxopts::RQUOTE);
-			}
-
-			bool names_only = false;
-			if(m_result.count("N"))
-			{
-				names_only = m_result["N"].as<bool>();
-			}
-
-			// todo: engine + names_only + source
-			// se valore == syscall ==> + [-V]
-		}
-
-		bool count_D = m_result.count("D");
-		bool count_t = m_result.count("t");
-		bool count_T = m_result.count("T");
-		if(count_D > 0)
-		{
-			if(count_t > 0)
-			{
-				throw falco::option_cannot_be_specified_exception("D", "t");
-			}
-			// todo
-			// engine > not exit
-		}
-		if(count_T > 0)
-		{
-			if(count_t > 0)
-			{
-				throw falco::option_cannot_be_specified_exception("T", "t");
-			}
-			// todo
-			// engine > not exit
-		}
-		if(count_t > 0)
-		{
-			// todo
-			// engine > not exit
-		}
-	}
-
-	int m_argc;
-	const char** m_argv;
-	cxxopts::Options m_options;
-	cxxopts::ParseResult m_result;
-};
-
-} // namespace falco
-
-// 3 tipi di azioni
-// quelle che una volta date devono farlo uscire e non hanno bisogno di nessuna istanza
-// quelle che hanno bisogno di inspector e/o engine e poi falco esce
-// quelle che hanno bisogno di inspector e/o engine e poi falco esegue
--- a/userspace/falco/config_falco.h.in
+++ b/userspace/falco/config_falco.h.in
@@ -25,9 +25,11 @@ limitations under the License.
 #define FALCO_VERSION_PRERELEASE "@FALCO_VERSION_PRERELEASE@"
 #define FALCO_VERSION_BUILD "@FALCO_VERSION_BUILD@"

+#define FALCO_LUA_DIR "${CMAKE_INSTALL_PREFIX}/${FALCO_SHARE_DIR}/lua/"
 #define FALCO_SOURCE_DIR "${PROJECT_SOURCE_DIR}"
 #define FALCO_SOURCE_CONF_FILE "${PROJECT_SOURCE_DIR}/falco.yaml"
 #define FALCO_INSTALL_CONF_FILE "/etc/falco/falco.yaml"
+#define FALCO_SOURCE_LUA_DIR "${PROJECT_SOURCE_DIR}/userspace/falco/lua/"

 #define PROBE_NAME "@PROBE_NAME@"
 #define DRIVER_VERSION "@PROBE_VERSION@"
--- a/userspace/falco/configuration.cpp
+++ b/userspace/falco/configuration.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,7 +20,6 @@ limitations under the License.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
-#include "falco_utils.h"

 #include "configuration.h"
 #include "logger.h"
@@ -33,7 +32,7 @@ falco_configuration::falco_configuration():
 	m_time_format_iso_8601(false),
 	m_webserver_enabled(false),
 	m_webserver_listen_port(8765),
-	m_webserver_k8s_audit_endpoint("/k8s-audit"),
+	m_webserver_k8s_audit_endpoint("/k8s_audit"),
 	m_webserver_ssl_enabled(false),
 	m_config(NULL)
 {
@@ -52,7 +51,7 @@ void falco_configuration::init(list<string> &cmdline_options)
 {
 	init_cmdline_options(cmdline_options);

-	falco::outputs::config stdout_output;
+	falco_outputs::output_config stdout_output;
 	stdout_output.name = "stdout";
 	m_outputs.push_back(stdout_output);
 }
@@ -81,7 +80,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 	m_json_output = m_config->get_scalar<bool>("json_output", false);
 	m_json_include_output_property = m_config->get_scalar<bool>("json_include_output_property", true);

-	falco::outputs::config file_output;
+	falco_outputs::output_config file_output;
 	file_output.name = "file";
 	if(m_config->get_scalar<bool>("file_output", "enabled", false))
 	{
@@ -99,21 +98,21 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 		m_outputs.push_back(file_output);
 	}

-	falco::outputs::config stdout_output;
+	falco_outputs::output_config stdout_output;
 	stdout_output.name = "stdout";
 	if(m_config->get_scalar<bool>("stdout_output", "enabled", false))
 	{
 		m_outputs.push_back(stdout_output);
 	}

-	falco::outputs::config syslog_output;
+	falco_outputs::output_config syslog_output;
 	syslog_output.name = "syslog";
 	if(m_config->get_scalar<bool>("syslog_output", "enabled", false))
 	{
 		m_outputs.push_back(syslog_output);
 	}

-	falco::outputs::config program_output;
+	falco_outputs::output_config program_output;
 	program_output.name = "program";
 	if(m_config->get_scalar<bool>("program_output", "enabled", false))
 	{
@@ -131,7 +130,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 		m_outputs.push_back(program_output);
 	}

-	falco::outputs::config http_output;
+	falco_outputs::output_config http_output;
 	http_output.name = "http";
 	if(m_config->get_scalar<bool>("http_output", "enabled", false))
 	{
@@ -149,17 +148,16 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio

 	m_grpc_enabled = m_config->get_scalar<bool>("grpc", "enabled", false);
 	m_grpc_bind_address = m_config->get_scalar<string>("grpc", "bind_address", "0.0.0.0:5060");
-	m_grpc_threadiness = m_config->get_scalar<uint32_t>("grpc", "threadiness", 0);
+	m_grpc_threadiness = m_config->get_scalar<uint32_t>("grpc", "threadiness", 8); // todo > limit it to avoid overshubscription? std::thread::hardware_concurrency()
 	if(m_grpc_threadiness == 0)
 	{
-		m_grpc_threadiness = falco::utils::hardware_concurrency();
+		throw logic_error("error reading config file (" + m_config_file + "): gRPC threadiness must be greater than 0");
 	}
-	// todo > else limit threadiness to avoid oversubscription?
 	m_grpc_private_key = m_config->get_scalar<string>("grpc", "private_key", "/etc/falco/certs/server.key");
 	m_grpc_cert_chain = m_config->get_scalar<string>("grpc", "cert_chain", "/etc/falco/certs/server.crt");
 	m_grpc_root_certs = m_config->get_scalar<string>("grpc", "root_certs", "/etc/falco/certs/ca.crt");

-	falco::outputs::config grpc_output;
+	falco_outputs::output_config grpc_output;
 	grpc_output.name = "grpc";
 	// gRPC output is enabled only if gRPC server is enabled too
 	if(m_config->get_scalar<bool>("grpc_output", "enabled", true) && m_grpc_enabled)
@@ -200,7 +198,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio

 	m_webserver_enabled = m_config->get_scalar<bool>("webserver", "enabled", false);
 	m_webserver_listen_port = m_config->get_scalar<uint32_t>("webserver", "listen_port", 8765);
-	m_webserver_k8s_audit_endpoint = m_config->get_scalar<string>("webserver", "k8s_audit_endpoint", "/k8s-audit");
+	m_webserver_k8s_audit_endpoint = m_config->get_scalar<string>("webserver", "k8s_audit_endpoint", "/k8s_audit");
 	m_webserver_ssl_enabled = m_config->get_scalar<bool>("webserver", "ssl_enabled", false);
 	m_webserver_ssl_certificate = m_config->get_scalar<string>("webserver", "ssl_certificate", "/etc/falco/falco.pem");

@@ -346,4 +344,4 @@ void falco_configuration::set_cmdline_option(const string &opt)
 	{
 		m_config->set_scalar(keyval.first, keyval.second);
 	}
-}
+}
--- a/userspace/falco/configuration.h
+++ b/userspace/falco/configuration.h
@@ -37,7 +37,7 @@ public:
 	{
 		m_path = path;
 		YAML::Node config;
-		std::vector<falco::outputs::config> outputs;
+		std::vector<falco_outputs::output_config> outputs;
 		try
 		{
 			m_root = YAML::LoadFile(path);
@@ -196,7 +196,7 @@ public:
 	bool m_json_output;
 	bool m_json_include_output_property;
 	std::string m_log_level;
-	std::vector<falco::outputs::config> m_outputs;
+	std::vector<falco_outputs::output_config> m_outputs;
 	uint32_t m_notifications_rate;
 	uint32_t m_notifications_max_burst;

@@ -206,7 +206,7 @@ public:
 	bool m_time_format_iso_8601;

 	bool m_grpc_enabled;
-	uint32_t m_grpc_threadiness;
+	int m_grpc_threadiness;
 	std::string m_grpc_bind_address;
 	std::string m_grpc_private_key;
 	std::string m_grpc_cert_chain;
--- a/userspace/falco/event_drops.cpp
+++ b/userspace/falco/event_drops.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -15,7 +15,6 @@ limitations under the License.
 */

 #include "event_drops.h"
-#include "falco_common.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

 syscall_evt_drop_mgr::syscall_evt_drop_mgr():
@@ -138,7 +137,7 @@ bool syscall_evt_drop_mgr::perform_actions(uint64_t now, scap_stats &delta, bool

 		case ACT_ALERT:
 			m_outputs->handle_msg(now,
-					      falco_common::PRIORITY_CRITICAL,
+					      falco_outputs::PRIORITY_CRITICAL,
 					      msg,
 					      rule,
 					      output_fields);
--- a/userspace/falco/falco.cpp
+++ b/userspace/falco/falco.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -36,18 +36,15 @@ limitations under the License.
 #include "logger.h"
 #include "utils.h"
 #include "chisel.h"
-#include "fields_info.h"
+#include "sysdig.h"

 #include "event_drops.h"
 #include "configuration.h"
 #include "falco_engine.h"
 #include "config_falco.h"
 #include "statsfilewriter.h"
-#include "cli.h"
-#ifndef MINIMAL_BUILD
 #include "webserver.h"
 #include "grpc_server.h"
-#endif
 #include "banned.h" // This raises a compilation error when certain functions are used

 typedef function<void(sinsp* inspector)> open_t;
@@ -75,102 +72,99 @@ static void restart_falco(int signal)
 	g_restart = true;
 }

-// //
-// // Program help
-// //
-// static void usage()
-// {
-//     printf(
-// 	   "Falco version: " FALCO_VERSION "\n"
-// 	   "Usage: falco [options]\n\n"
-// 	   "Options:\n"
-
-// 	   " -c                            Configuration file (default " FALCO_SOURCE_CONF_FILE ", " FALCO_INSTALL_CONF_FILE ")\n"
-// 	   " -A                            Monitor all events, including those with EF_DROP_SIMPLE_CONS flag.\n"
-// 	   " --alternate-lua-dir <path>    Specify an alternate path for loading Falco lua files\n"
-// 	   " -b, --print-base64            Print data buffers in base64.\n"
-// 	   "                               This is useful for encoding binary data that needs to be used over media designed to.\n"
-// 	   " --cri <path>                  Path to CRI socket for container metadata.\n"
-// 	   "                               Use the specified socket to fetch data from a CRI-compatible runtime.\n"
-// 	   " -d, --daemon                  Run as a daemon.\n"
-// 	   " --disable-cri-async           Disable asynchronous CRI metadata fetching.\n"
-// 	   "                               This is useful to let the input event wait for the container metadata fetch\n"
-// 	   "                               to finish before moving forward. Async fetching, in some environments leads\n"
-// 	   "                               to empty fields for container metadata when the fetch is not fast enough to be\n"
-// 	   "                               completed asynchronously. This can have a performance penalty on your environment\n"
-// 	   "                               depending on the number of containers and the frequency at which they are created/started/stopped\n"
-// 	   " --disable-source <event_source>\n"
-// 	   "                               Disable a specific event source.\n"
-// 	   "                               Available event sources are: syscall, k8s_audit.\n"
-// 	   "                               It can be passed multiple times.\n"
-// 	   "                               Can not disable both the event sources.\n"
-
-// 	   " -e <events_file>              Read the events from <events_file> (in .scap format for sinsp events, or jsonl for\n"
-// 	   "                               k8s audit events) instead of tapping into live.\n"
-// #ifndef MINIMAL_BUILD
-// 	   " -k <url>, --k8s-api <url>\n"
-// 	   "                               Enable Kubernetes support by connecting to the API server specified as argument.\n"
-//        "                               E.g. \"http://admin:password@127.0.0.1:8080\".\n"
-// 	   "                               The API server can also be specified via the environment variable FALCO_K8S_API.\n"
-// 	   " -K <bt_file> | <cert_file>:<key_file[#password]>[:<ca_cert_file>], --k8s-api-cert <bt_file> | <cert_file>:<key_file[#password]>[:<ca_cert_file>]\n"
-// 	   "                               Use the provided files names to authenticate user and (optionally) verify the K8S API server identity.\n"
-// 	   "                               Each entry must specify full (absolute, or relative to the current directory) path to the respective file.\n"
-// 	   "                               Private key password is optional (needed only if key is password protected).\n"
-// 	   "                               CA certificate is optional. For all files, only PEM file format is supported. \n"
-// 	   "                               Specifying CA certificate only is obsoleted - when single entry is provided \n"
-// 	   "                               for this option, it will be interpreted as the name of a file containing bearer token.\n"
-// 	   "                               Note that the format of this command-line option prohibits use of files whose names contain\n"
-// 	   "                               ':' or '#' characters in the file name.\n"
-// #endif
-
-
-
-
-// #ifndef MINIMAL_BUILD
-// 	   " -m <url[,marathon_url]>, --mesos-api <url[,marathon_url]>\n"
-// 	   "                               Enable Mesos support by connecting to the API server\n"
-// 	   "                               specified as argument. E.g. \"http://admin:password@127.0.0.1:5050\".\n"
-// 	   "                               Marathon url is optional and defaults to Mesos address, port 8080.\n"
-// 	   "                               The API servers can also be specified via the environment variable FALCO_MESOS_API.\n"
-// #endif
-// 	   " -M <num_seconds>              Stop collecting after <num_seconds> reached.\n"
-
-// 	   " -o, --option <key>=<val>      Set the value of option <key> to <val>. Overrides values in configuration file.\n"
-// 	   "                               <key> can be a two-part <key>.<subkey>\n"
-// 	   " -p <output_format>, --print <output_format>\n"
-// 	   "                               Add additional information to each falco notification's output.\n"
-// 	   "                               With -pc or -pcontainer will use a container-friendly format.\n"
-// 	   "                               With -pk or -pkubernetes will use a kubernetes-friendly format.\n"
-// 	   "                               With -pm or -pmesos will use a mesos-friendly format.\n"
-// 	   "                               Additionally, specifying -pc/-pk/-pm will change the interpretation\n"
-// 	   "                               of %%container.info in rule output fields.\n"
-// 	   " -P, --pidfile <pid_file>      When run as a daemon, write pid to specified file\n"
-//        " -r <rules_file>               Rules file/directory (defaults to value set in configuration file, or /etc/falco_rules.yaml).\n"
-//        "                               Can be specified multiple times to read from multiple files/directories.\n"
-// 	   " -s <stats_file>               If specified, append statistics related to Falco's reading/processing of events\n"
-// 	   "                               to this file (only useful in live mode).\n"
-// 	   " --stats-interval <msec>       When using -s <stats_file>, write statistics every <msec> ms.\n"
-// 	   "                               This uses signals, so don't recommend intervals below 200 ms.\n"
-// 	   "                               Defaults to 5000 (5 seconds).\n"
-// 	   " -S <len>, --snaplen <len>\n"
-// 	   "                               Capture the first <len> bytes of each I/O buffer.\n"
-// 	   "                               By default, the first 80 bytes are captured. Use this\n"
-// 	   "                               option with caution, it can generate huge trace files.\n"
-
-
-// 	   " -U,--unbuffered               Turn off output buffering to configured outputs.\n"
-// 	   "                               This causes every single line emitted by falco to be flushed,\n"
-// 	   "                               which generates higher CPU usage but is useful when piping those outputs\n"
-// 	   "                               into another process or into a script.\n"
-// 	   " -u, --userspace               Parse events from userspace.\n"
-// 	   "                               To be used in conjunction with the ptrace(2) based driver (pdig).\n"
-// 	   " -V, --validate <rules_file>   Read the contents of the specified rules(s) file and exit.\n"
-// 	   "                               Can be specified multiple times to validate multiple files.\n"
-// 	   " -v                            Verbose output.\n"
-
-// 	   "\n"
-//     );
-// }
+//
+// Program help
+//
+static void usage()
+{
+    printf(
+	   "Falco version: " FALCO_VERSION "\n"
+	   "Usage: falco [options]\n\n"
+	   "Options:\n"
+	   " -h, --help                    Print this page\n"
+	   " -c                            Configuration file (default " FALCO_SOURCE_CONF_FILE ", " FALCO_INSTALL_CONF_FILE ")\n"
+	   " -A                            Monitor all events, including those with EF_DROP_SIMPLE_CONS flag.\n"
+	   " -b, --print-base64            Print data buffers in base64.\n"
+	   "                               This is useful for encoding binary data that needs to be used over media designed to.\n"
+	   " --cri <path>                  Path to CRI socket for container metadata.\n"
+	   "                               Use the specified socket to fetch data from a CRI-compatible runtime.\n"
+	   " -d, --daemon                  Run as a daemon.\n"
+	   " --disable-cri-async           Disable asynchronous CRI metadata fetching.\n"
+	   "                               This is useful to let the input event wait for the container metadata fetch\n"
+	   "                               to finish before moving forward. Async fetching, in some environments leads\n"
+	   "                               to empty fields for container metadata when the fetch is not fast enough to be\n"
+	   "                               completed asynchronously. This can have a performance penalty on your environment\n"
+	   "                               depending on the number of containers and the frequency at which they are created/started/stopped\n"
+	   " --disable-source <event_source>\n"
+	   "                               Disable a specific event source.\n"
+	   "                               Available event sources are: syscall, k8s_audit.\n"
+	   "                               It can be passed multiple times.\n"
+	   "                               Can not disable both the event sources.\n"
+	   " -D <substring>                Disable any rules with names having the substring <substring>. Can be specified multiple times.\n"
+	   "                               Can not be specified with -t.\n"
+	   " -e <events_file>              Read the events from <events_file> (in .scap format for sinsp events, or jsonl for\n"
+	   "                               k8s audit events) instead of tapping into live.\n"
+	   " -k <url>, --k8s-api <url>\n"
+	   "                               Enable Kubernetes support by connecting to the API server specified as argument.\n"
+       "                               E.g. \"http://admin:password@127.0.0.1:8080\".\n"
+	   "                               The API server can also be specified via the environment variable FALCO_K8S_API.\n"
+	   " -K <bt_file> | <cert_file>:<key_file[#password]>[:<ca_cert_file>], --k8s-api-cert <bt_file> | <cert_file>:<key_file[#password]>[:<ca_cert_file>]\n"
+	   "                               Use the provided files names to authenticate user and (optionally) verify the K8S API server identity.\n"
+	   "                               Each entry must specify full (absolute, or relative to the current directory) path to the respective file.\n"
+	   "                               Private key password is optional (needed only if key is password protected).\n"
+	   "                               CA certificate is optional. For all files, only PEM file format is supported. \n"
+	   "                               Specifying CA certificate only is obsoleted - when single entry is provided \n"
+	   "                               for this option, it will be interpreted as the name of a file containing bearer token.\n"
+	   "                               Note that the format of this command-line option prohibits use of files whose names contain\n"
+	   "                               ':' or '#' characters in the file name.\n"
+	   " -L                            Show the name and description of all rules and exit.\n"
+	   " -l <rule>                     Show the name and description of the rule with name <rule> and exit.\n"
+	   " --list [<source>]             List all defined fields. If <source> is provided, only list those fields for\n"
+	   "                               the source <source>. Current values for <source> are \"syscall\", \"k8s_audit\"\n"
+	   " -m <url[,marathon_url]>, --mesos-api <url[,marathon_url]>\n"
+	   "                               Enable Mesos support by connecting to the API server\n"
+	   "                               specified as argument. E.g. \"http://admin:password@127.0.0.1:5050\".\n"
+	   "                               Marathon url is optional and defaults to Mesos address, port 8080.\n"
+	   "                               The API servers can also be specified via the environment variable FALCO_MESOS_API.\n"
+	   " -M <num_seconds>              Stop collecting after <num_seconds> reached.\n"
+	   " -N                            When used with --list, only print field names.\n"
+	   " -o, --option <key>=<val>      Set the value of option <key> to <val>. Overrides values in configuration file.\n"
+	   "                               <key> can be a two-part <key>.<subkey>\n"
+	   " -p <output_format>, --print <output_format>\n"
+	   "                               Add additional information to each falco notification's output.\n"
+	   "                               With -pc or -pcontainer will use a container-friendly format.\n"
+	   "                               With -pk or -pkubernetes will use a kubernetes-friendly format.\n"
+	   "                               With -pm or -pmesos will use a mesos-friendly format.\n"
+	   "                               Additionally, specifying -pc/-pk/-pm will change the interpretation\n"
+	   "                               of %%container.info in rule output fields.\n"
+	   " -P, --pidfile <pid_file>      When run as a daemon, write pid to specified file\n"
+       " -r <rules_file>               Rules file/directory (defaults to value set in configuration file, or /etc/falco_rules.yaml).\n"
+       "                               Can be specified multiple times to read from multiple files/directories.\n"
+	   " -s <stats_file>               If specified, write statistics related to falco's reading/processing of events\n"
+	   "                               to this file. (Only useful in live mode).\n"
+	   " --stats_interval <msec>       When using -s <stats_file>, write statistics every <msec> ms.\n"
+	   "                               This uses signals, so don't recommend intervals below 200 ms.\n"
+	   "                               Defaults to 5000 (5 seconds).\n"
+	   " -S <len>, --snaplen <len>\n"
+	   "                               Capture the first <len> bytes of each I/O buffer.\n"
+	   "                               By default, the first 80 bytes are captured. Use this\n"
+	   "                               option with caution, it can generate huge trace files.\n"
+	   " --support                     Print support information including version, rules files used, etc. and exit.\n"
+	   " -T <tag>                      Disable any rules with a tag=<tag>. Can be specified multiple times.\n"
+	   "                               Can not be specified with -t.\n"
+	   " -t <tag>                      Only run those rules with a tag=<tag>. Can be specified multiple times.\n"
+	   "                               Can not be specified with -T/-D.\n"
+	   " -U,--unbuffered               Turn off output buffering to configured outputs.\n"
+	   "                               This causes every single line emitted by falco to be flushed,\n"
+	   "                               which generates higher CPU usage but is useful when piping those outputs\n"
+	   "                               into another process or into a script.\n"
+	   " -V, --validate <rules_file>   Read the contents of the specified rules(s) file and exit.\n"
+	   "                               Can be specified multiple times to validate multiple files.\n"
+	   " -v                            Verbose output.\n"
+       " --version                     Print version number.\n"
+	   "\n"
+    );
+}

 static void display_fatal_err(const string &msg)
 {
@@ -189,7 +183,6 @@ static void display_fatal_err(const string &msg)
 // Splitting into key=value or key.subkey=value will be handled by configuration class.
 std::list<string> cmdline_options;

-#ifndef MINIMAL_BUILD
 // Read a jsonl file containing k8s audit events and pass each to the engine.
 void read_k8s_audit_trace_file(falco_engine *engine,
 			       falco_outputs *outputs,
@@ -218,7 +211,6 @@ void read_k8s_audit_trace_file(falco_engine *engine,
 		}
 	}
 }
-#endif

 static std::string read_file(std::string filename)
 {
@@ -392,7 +384,8 @@ static void print_all_ignored_events(sinsp *inspector)

 static void list_source_fields(falco_engine *engine, bool verbose, bool names_only, std::string &source)
 {
-	if(!source.empty() && !(source == "syscall" || source == "k8s_audit"))
+	if(source.size() > 0 &&
+	   !(source == "syscall" || source == "k8s_audit"))
 	{
 		throw std::invalid_argument("Value for --list must be \"syscall\" or \"k8s_audit\"");
 	}
@@ -409,7 +402,7 @@ static void list_source_fields(falco_engine *engine, bool verbose, bool names_on
 //
 // ARGUMENT PARSING AND PROGRAM SETUP
 //
-int falco_init()
+int falco_init(int argc, char **argv)
 {
 	int result = EXIT_SUCCESS;
 	sinsp* inspector = NULL;
@@ -434,11 +427,9 @@ int falco_init()
 	bool verbose = false;
 	bool names_only = false;
 	bool all_events = false;
-#ifndef MINIMAL_BUILD
 	string* k8s_api = 0;
 	string* k8s_api_cert = 0;
 	string* mesos_api = 0;
-#endif
 	string output_format = "";
 	uint32_t snaplen = 0;
 	bool replace_container_info = false;
@@ -452,7 +443,6 @@ int falco_init()
 	set<string> disable_sources;
 	bool disable_syscall = false;
 	bool disable_k8s_audit = false;
-	bool userspace = false;

 	// Used for writing trace files
 	int duration_seconds = 0;
@@ -468,239 +458,217 @@ int falco_init()
 	double duration;
 	scap_stats cstats;

-#ifndef MINIMAL_BUILD
 	falco_webserver webserver;
 	falco::grpc::server grpc_server;
 	std::thread grpc_server_thread;
-#endif

 	static struct option long_options[] =
-		{
-			{"alternate-lua-dir", required_argument, 0},
-			{"cri", required_argument, 0},
-			{"daemon", no_argument, 0, 'd'},
-			{"disable-cri-async", no_argument, 0, 0},
-			{"disable-source", required_argument, 0},
-			{"help", no_argument, 0, 'h'},
-			{"ignored-events", no_argument, 0, 'i'},
-			{"k8s-api-cert", required_argument, 0, 'K'},
-			{"k8s-api", required_argument, 0, 'k'},
-			{"list", optional_argument, 0},
-			{"mesos-api", required_argument, 0, 'm'},
-			{"option", required_argument, 0, 'o'},
-			{"pidfile", required_argument, 0, 'P'},
-			{"print-base64", no_argument, 0, 'b'},
-			{"print", required_argument, 0, 'p'},
-			{"snaplen", required_argument, 0, 'S'},
-			{"stats-interval", required_argument, 0},
-			{"support", no_argument, 0},
-			{"unbuffered", no_argument, 0, 'U'},
-			{"userspace", no_argument, 0, 'u'},
-			{"validate", required_argument, 0, 'V'},
-			{"version", no_argument, 0, 0},
-			{"writefile", required_argument, 0, 'w'},
-			{0, 0, 0, 0}};
+	{
+		{"cri", required_argument, 0},
+        {"daemon", no_argument, 0, 'd'},
+        {"disable-cri-async", no_argument, 0, 0},
+        {"disable-source", required_argument, 0},
+        {"help", no_argument, 0, 'h'},
+        {"ignored-events", no_argument, 0, 'i'},
+        {"k8s-api-cert", required_argument, 0, 'K'},
+        {"k8s-api", required_argument, 0, 'k'},
+        {"list", optional_argument, 0},
+        {"mesos-api", required_argument, 0, 'm'},
+        {"option", required_argument, 0, 'o'},
+        {"pidfile", required_argument, 0, 'P'},
+        {"print-base64", no_argument, 0, 'b'},
+        {"print", required_argument, 0, 'p'},
+        {"snaplen", required_argument, 0, 'S'},
+        {"stats_interval", required_argument, 0},
+        {"support", no_argument, 0},
+        {"unbuffered", no_argument, 0, 'U'},
+        {"validate", required_argument, 0, 'V'},
+        {"version", no_argument, 0, 0},
+        {"writefile", required_argument, 0, 'w'},
+		{0, 0, 0, 0}
+	};

 	try
 	{
 		set<string> disabled_rule_substrings;
 		string substring;
 		string all_rules = "";
-		string alternate_lua_dir = FALCO_ENGINE_SOURCE_LUA_DIR;
 		set<string> disabled_rule_tags;
 		set<string> enabled_rule_tags;

-		// 		//
-		// 		// Parse the args
-		// 		//
-		// 		while((op = getopt_long(argc, argv,
-		//                                         "hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:r:S:s:T:t:UuvV:w:",
-		//                                         long_options, &long_index)) != -1)
-		// 		{
-		// 			switch(op)
-		// 			{
-		// 			case 'h':
-		// 				usage();
-		// 				goto exit;
-		// 			case 'c':
-		// 				conf_filename = optarg;
-		// 				break;
-		// 			case 'A':
-		// 				all_events = true;
-		// 				break;
-		// 			case 'b':
-		// 				event_buffer_format = sinsp_evt::PF_BASE64;
-		// 				break;
-		// 			case 'd':
-		// 				daemon = true;
-		// 				break;
-		// 			case 'D':
-		// 				substring = optarg;
-		// 				disabled_rule_substrings.insert(substring);
-		// 				break;
-		// 			case 'e':
-		// 				trace_filename = optarg;
-		// #ifndef MINIMAL_BUILD
-		// 				k8s_api = new string();
-		// 				mesos_api = new string();
-		// #endif
-		// 				break;
-		// 			case 'F':
-		// 				list_flds = optarg;
-		// 				break;
-		// 			case 'i':
-		// 				print_ignored_events = true;
-		// 				break;
-		// #ifndef MINIMAL_BUILD
-		// 			case 'k':
-		// 				k8s_api = new string(optarg);
-		// 				break;
-		// 			case 'K':
-		// 				k8s_api_cert = new string(optarg);
-		// 				break;
-		// #endif
-		// 			case 'L':
-		// 				describe_all_rules = true;
-		// 				break;
-		// 			case 'l':
-		// 				describe_rule = optarg;
-		// 				break;
-		// #ifndef MINIMAL_BUILD
-		// 			case 'm':
-		// 				mesos_api = new string(optarg);
-		// 				break;
-		// #endif
-		// 			case 'M':
-		// 				duration_to_tot = atoi(optarg);
-		// 				if(duration_to_tot <= 0)
-		// 				{
-		// 					throw sinsp_exception(string("invalid duration") + optarg);
-		// 				}
-		// 				break;
-		// 			case 'N':
-		// 				names_only = true;
-		// 				break;
-		// 			case 'o':
-		// 				cmdline_options.push_back(optarg);
-		// 				break;
-		// 			case 'P':
-		// 				pidfilename = optarg;
-		// 				break;
-		// 			case 'p':
-		// 				if(string(optarg) == "c" || string(optarg) == "container")
-		// 				{
-		// 					output_format = "container=%container.name (id=%container.id)";
-		// 					replace_container_info = true;
-		// 				}
-		// 				else if(string(optarg) == "k" || string(optarg) == "kubernetes")
-		// 				{
-		// 					output_format = "k8s.ns=%k8s.ns.name k8s.pod=%k8s.pod.name container=%container.id";
-		// 					replace_container_info = true;
-		// 				}
-		// 				else if(string(optarg) == "m" || string(optarg) == "mesos")
-		// 				{
-		// 					output_format = "task=%mesos.task.name container=%container.id";
-		// 					replace_container_info = true;
-		// 				}
-		// 				else
-		// 				{
-		// 					output_format = optarg;
-		// 					replace_container_info = false;
-		// 				}
-		// 				break;
-		// 			case 'r':
-		// 				falco_configuration::read_rules_file_directory(string(optarg), rules_filenames);
-		// 				break;
-		// 			case 'S':
-		// 				snaplen = atoi(optarg);
-		// 				break;
-		// 			case 's':
-		// 				stats_filename = optarg;
-		// 				break;
-		// 			case 'T':
-		// 				disabled_rule_tags.insert(optarg);
-		// 				break;
-		// 			case 't':
-		// 				enabled_rule_tags.insert(optarg);
-		// 				break;
-		// 			case 'U':
-		// 				buffered_outputs = false;
-		// 				buffered_cmdline = true;
-		// 				break;
-		// 			case 'u':
-		// 				userspace = true;
-		// 				break;
-		// 			case 'v':
-		// 				verbose = true;
-		// 				break;
-		// 			case 'V':
-		// 				validate_rules_filenames.push_back(optarg);
-		// 				break;
-		// 			case 'w':
-		// 				outfile = optarg;
-		// 				break;
-		// 			case '?':
-		// 				result = EXIT_FAILURE;
-		// 				goto exit;
+		//
+		// Parse the args
+		//
+		while((op = getopt_long(argc, argv,
+                                        "hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:r:S:s:T:t:UvV:w:",
+                                        long_options, &long_index)) != -1)
+		{
+			switch(op)
+			{
+			case 'h':
+				usage();
+				goto exit;
+			case 'c':
+				conf_filename = optarg;
+				break;
+			case 'A':
+				all_events = true;
+				break;
+			case 'b':
+				event_buffer_format = sinsp_evt::PF_BASE64;
+				break;
+			case 'd':
+				daemon = true;
+				break;
+			case 'D':
+				substring = optarg;
+				disabled_rule_substrings.insert(substring);
+				break;
+			case 'e':
+				trace_filename = optarg;
+				k8s_api = new string();
+				mesos_api = new string();
+				break;
+			case 'F':
+				list_flds = optarg;
+				break;
+			case 'i':
+				print_ignored_events = true;
+				break;
+			case 'k':
+				k8s_api = new string(optarg);
+				break;
+			case 'K':
+				k8s_api_cert = new string(optarg);
+				break;
+			case 'L':
+				describe_all_rules = true;
+				break;
+			case 'l':
+				describe_rule = optarg;
+				break;
+			case 'm':
+				mesos_api = new string(optarg);
+				break;
+			case 'M':
+				duration_to_tot = atoi(optarg);
+				if(duration_to_tot <= 0)
+				{
+					throw sinsp_exception(string("invalid duration") + optarg);
+				}
+				break;
+			case 'N':
+				names_only = true;
+				break;
+			case 'o':
+				cmdline_options.push_back(optarg);
+				break;
+			case 'P':
+				pidfilename = optarg;
+				break;
+			case 'p':
+				if(string(optarg) == "c" || string(optarg) == "container")
+				{
+					output_format = "container=%container.name (id=%container.id)";
+					replace_container_info = true;
+				}
+				else if(string(optarg) == "k" || string(optarg) == "kubernetes")
+				{
+					output_format = "k8s.ns=%k8s.ns.name k8s.pod=%k8s.pod.name container=%container.id";
+					replace_container_info = true;
+				}
+				else if(string(optarg) == "m" || string(optarg) == "mesos")
+				{
+					output_format = "task=%mesos.task.name container=%container.id";
+					replace_container_info = true;
+				}
+				else
+				{
+					output_format = optarg;
+					replace_container_info = false;
+				}
+				break;
+			case 'r':
+				falco_configuration::read_rules_file_directory(string(optarg), rules_filenames);
+				break;
+			case 'S':
+				snaplen = atoi(optarg);
+				break;
+			case 's':
+				stats_filename = optarg;
+				break;
+			case 'T':
+				disabled_rule_tags.insert(optarg);
+				break;
+			case 't':
+				enabled_rule_tags.insert(optarg);
+				break;
+			case 'U':
+				buffered_outputs = false;
+				buffered_cmdline = true;
+				break;
+			case 'v':
+				verbose = true;
+				break;
+			case 'V':
+				validate_rules_filenames.push_back(optarg);
+				break;
+			case 'w':
+				outfile = optarg;
+				break;
+			case '?':
+				result = EXIT_FAILURE;
+				goto exit;

-		// 			case 0:
-		// 				if(string(long_options[long_index].name) == "version")
-		// 				{
-		// 					printf("Falco version: %s\n", FALCO_VERSION);
-		// 					printf("Driver version: %s\n", DRIVER_VERSION);
-		// 					return EXIT_SUCCESS;
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "cri")
-		// 				{
-		// 					if(optarg != NULL)
-		// 					{
-		// 						cri_socket_path = optarg;
-		// 					}
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "disable-cri-async")
-		// 				{
-		// 				  cri_async = false;
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "list")
-		// 				{
-		// 					list_flds = true;
-		// 					if(optarg != NULL)
-		// 					{
-		// 						list_flds_source = optarg;
-		// 					}
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "stats-interval")
-		// 				{
-		// 					stats_interval = atoi(optarg);
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "support")
-		// 				{
-		// 					print_support = true;
-		// 				}
-		// 				else if (string(long_options[long_index].name) == "disable-source")
-		// 				{
-		// 					if(optarg != NULL)
-		// 					{
-		// 						disable_sources.insert(optarg);
-		// 					}
-		// 				}
-		// 				else if (string(long_options[long_index].name)== "alternate-lua-dir")
-		// 				{
-		// 					if(optarg != NULL)
-		// 					{
-		// 						alternate_lua_dir = optarg;
-		// 						if (alternate_lua_dir.back() != '/') {
-		// 							alternate_lua_dir += '/';
-		// 						}
-		// 					}
-		// 				}
-		// 				break;
+			case 0:
+				if(string(long_options[long_index].name) == "version")
+				{
+					printf("Falco version: %s\n", FALCO_VERSION);
+					printf("Driver version: %s\n", DRIVER_VERSION);
+					return EXIT_SUCCESS;
+				}
+				else if (string(long_options[long_index].name) == "cri")
+				{
+					if(optarg != NULL)
+					{
+						cri_socket_path = optarg;
+					}
+				}
+				else if (string(long_options[long_index].name) == "disable-cri-async")
+				{
+				  cri_async = false;
+				}
+				else if (string(long_options[long_index].name) == "list")
+				{
+					list_flds = true;
+					if(optarg != NULL)
+					{
+						list_flds_source = optarg;
+					}
+				}
+				else if (string(long_options[long_index].name) == "stats_interval")
+				{
+					stats_interval = atoi(optarg);
+				}
+				else if (string(long_options[long_index].name) == "support")
+				{
+					print_support = true;
+				}
+				else if (string(long_options[long_index].name) == "disable-source")
+				{
+					if(optarg != NULL)
+					{
+						disable_sources.insert(optarg);
+					}
+				}
+				break;

-				// 			default:
-				// 				break;
-				// 			}
+			default:
+				break;
+			}
+
+		}

-						// 		}
 		inspector = new sinsp();
 		inspector->set_buffer_format(event_buffer_format);

@@ -728,7 +696,7 @@ int falco_init()
 			return EXIT_SUCCESS;
 		}

-		engine = new falco_engine(true, alternate_lua_dir);
+		engine = new falco_engine();
 		engine->set_inspector(inspector);
 		engine->set_extra(output_format, replace_container_info);

@@ -757,7 +725,8 @@ int falco_init()
 			}
 		}

-		outputs = new falco_outputs();
+		outputs = new falco_outputs(engine);
+		outputs->set_inspector(inspector);

 		// Some combinations of arguments are not allowed.
 		if (daemon && pidfilename == "") {
@@ -826,16 +795,12 @@ int falco_init()
 			falco_logger::set_time_format_iso_8601(config.m_time_format_iso_8601);

 			// log after config init because config determines where logs go
-			falco_logger::log(LOG_INFO, "Falco version " + std::string(FALCO_VERSION) + " (driver version " + std::string(DRIVER_VERSION) + ")\n");
 			falco_logger::log(LOG_INFO, "Falco initialized with configuration file " + conf_filename + "\n");
 		}
 		else
 		{
 			config.init(cmdline_options);
 			falco_logger::set_time_format_iso_8601(config.m_time_format_iso_8601);
-
-			// log after config init because config determines where logs go
-			falco_logger::log(LOG_INFO, "Falco version " + std::string(FALCO_VERSION) + " (driver version " + std::string(DRIVER_VERSION) + ")\n");
 			falco_logger::log(LOG_INFO, "Falco initialized. No configuration file found, proceeding with defaults\n");
 		}

@@ -916,14 +881,14 @@ int falco_init()
 				throw std::runtime_error(string("Could not uname() to find system info: %s\n") + strerror(errno));
 			}

-			// for(char **arg = argv; *arg; arg++)
-			// {
-			// 	if(cmdline.size() > 0)
-			// 	{
-			// 		cmdline += " ";
-			// 	}
-			// 	cmdline += *arg;
-			// }
+			for(char **arg = argv; *arg; arg++)
+			{
+				if(cmdline.size() > 0)
+				{
+					cmdline += " ";
+				}
+				cmdline += *arg;
+			}

 			support["version"] = FALCO_VERSION;
 			support["system_info"]["sysname"] = sysinfo.sysname;
@@ -965,6 +930,7 @@ int falco_init()
 			hostname = c_hostname;
 		}

+
 		outputs->init(config.m_json_output,
 			      config.m_json_include_output_property,
 			      config.m_notifications_rate, config.m_notifications_max_burst,
@@ -1097,12 +1063,6 @@ int falco_init()

 			if(!trace_is_scap)
 			{
-#ifdef MINIMAL_BUILD
-				// Note that the webserver is not available when MINIMAL_BUILD is defined.
-				fprintf(stderr, "Cannot use k8s audit events trace file with a minimal Falco build");
-				result = EXIT_FAILURE;
-				goto exit;
-#else
 				try {
 					string line;
 					nlohmann::json j;
@@ -1127,22 +1087,11 @@ int falco_init()
 					result = EXIT_FAILURE;
 					goto exit;
 				}
-#endif
 			}
 		}
 		else
 		{
-			open_t open_cb = [&userspace](sinsp* inspector)
-			{
-				if(userspace)
-				{
-					// open_udig() is the underlying method used in the capture code to parse userspace events from the kernel.
-					//
-					// Falco uses a ptrace(2) based userspace implementation.
-					// Regardless of the implementation, the underlying method remains the same.
-					inspector->open_udig();
-					return;
-				}
+			open_t open_cb = [](sinsp* inspector) {
 				inspector->open();
 			};
 			open_t open_nodriver_cb = [](sinsp* inspector) {
@@ -1167,20 +1116,11 @@ int falco_init()
 			}
 			catch(sinsp_exception &e)
 			{
-				// If syscall input source is enabled and not through userspace instrumentation
-				if (!disable_syscall && !userspace)
+				if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
 				{
-					// Try to insert the Falco kernel module
-					if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
-					{
-						falco_logger::log(LOG_ERR, "Unable to load the driver.\n");
-					}
-					open_f(inspector);
-				}
-				else
-				{
-					rethrow_exception(current_exception());
+					falco_logger::log(LOG_ERR, "Unable to load the driver. Exiting.\n");
 				}
+				open_f(inspector);
 			}
 		}

@@ -1198,9 +1138,8 @@ int falco_init()

 		duration = ((double)clock()) / CLOCKS_PER_SEC;

-#ifndef MINIMAL_BUILD
 		//
-		// Run k8s, if required
+		// run k8s, if required
 		//
 		if(k8s_api)
 		{
@@ -1239,7 +1178,7 @@ int falco_init()
 		}

 		//
-		// Run mesos, if required
+		// run mesos, if required
 		//
 		if(mesos_api)
 		{
@@ -1267,7 +1206,6 @@ int falco_init()
 		// gRPC server
 		if(config.m_grpc_enabled)
 		{
-			falco_logger::log(LOG_INFO, "gRPC server threadiness equals to " + to_string(config.m_grpc_threadiness) + "\n");
 			// TODO(fntlnz,leodido): when we want to spawn multiple threads we need to have a queue per thread, or implement
 			// different queuing mechanisms, round robin, fanout? What we want to achieve?
 			grpc_server.init(
@@ -1282,15 +1220,12 @@ int falco_init()
 				grpc_server.run();
 			});
 		}
-#endif

 		if(!trace_filename.empty() && !trace_is_scap)
 		{
-#ifndef MINIMAL_BUILD
 			read_k8s_audit_trace_file(engine,
 						  outputs,
 						  trace_filename);
-#endif
 		}
 		else
 		{
@@ -1325,25 +1260,15 @@ int falco_init()

 		}

-		// Honor -M also when using a trace file.
-		// Since inspection stops as soon as all events have been consumed
-		// just await the given duration is reached, if needed.
-		if(!trace_filename.empty() && duration_to_tot>0)
-		{
-			std::this_thread::sleep_for(std::chrono::seconds(duration_to_tot));
-		}
-
 		inspector->close();
 		engine->print_stats();
 		sdropmgr.print_stats();
-#ifndef MINIMAL_BUILD
 		webserver.stop();
 		if(grpc_server_thread.joinable())
 		{
 			grpc_server.shutdown();
 			grpc_server_thread.join();
 		}
-#endif
 	}
 	catch(exception &e)
 	{
@@ -1351,14 +1276,12 @@ int falco_init()

 		result = EXIT_FAILURE;

-#ifndef MINIMAL_BUILD
 		webserver.stop();
 		if(grpc_server_thread.joinable())
 		{
 			grpc_server.shutdown();
 			grpc_server_thread.join();
 		}
-#endif
 	}

 exit:
@@ -1373,23 +1296,13 @@ exit:
 //
 // MAIN
 //
-int main(int argc, const char **argv)
+int main(int argc, char **argv)
 {
-	try
-	{
-		auto cli = new falco::cli(argc, argv);
-		cli->run();
-	}
-	catch(const cxxopts::OptionException &e)
-	{
-		display_fatal_err("Error parsing options: " + string(e.what()) + "\n");
-		return EXIT_FAILURE;
-	}
-
 	int rc;
+
 	// g_restart will cause the falco loop to exit, but we
 	// should reload everything and start over.
-	while((rc = falco_init()) == EXIT_SUCCESS && g_restart)
+	while((rc = falco_init(argc, argv)) == EXIT_SUCCESS && g_restart)
 	{
 		g_restart = false;
 		optind = 1;
--- a/userspace/falco/falco_output_queue.h
+++ b/userspace/falco/falco_output_queue.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors
+Copyright (C) 2019 The Falco Authors

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,14 +16,14 @@ limitations under the License.

 #pragma once

-#include "outputs.pb.h"
+#include "output.pb.h"
 #include "tbb/concurrent_queue.h"

 namespace falco
 {
-namespace grpc
+namespace output
 {
-typedef tbb::concurrent_queue<outputs::response> response_cq;
+typedef tbb::concurrent_queue<response> response_cq;

 class queue
 {
@@ -34,12 +34,12 @@ public:
 		return instance;
 	}

-	bool try_pop(outputs::response& res)
+	bool try_pop(response& res)
 	{
 		return m_queue.try_pop(res);
 	}

-	void push(outputs::response& res)
+	void push(response& res)
 	{
 		m_queue.push(res);
 	}
@@ -56,5 +56,5 @@ public:
 	queue(queue const&) = delete;
 	void operator=(queue const&) = delete;
 };
-} // namespace grpc
+} // namespace output
 } // namespace falco
--- a/userspace/falco/falco_outputs.cpp
+++ b/userspace/falco/falco_outputs.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,9 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-#ifndef MINIMAL_BUILD
 #include <google/protobuf/util/time_util.h>
-#endif

 #include "falco_outputs.h"

@@ -24,21 +22,21 @@ limitations under the License.

 #include "formats.h"
 #include "logger.h"
-
-#include "outputs_file.h"
-#include "outputs_program.h"
-#include "outputs_stdout.h"
-#include "outputs_syslog.h"
-#ifndef MINIMAL_BUILD
-#include "outputs_http.h"
-#include "outputs_grpc.h"
-#endif
-
+#include "falco_output_queue.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

 using namespace std;
+using namespace falco::output;

-falco_outputs::falco_outputs():
+const static struct luaL_reg ll_falco_outputs [] =
+{
+	{"handle_http", &falco_outputs::handle_http},
+	{"handle_grpc", &falco_outputs::handle_grpc},
+	{NULL, NULL}
+};
+
+falco_outputs::falco_outputs(falco_engine *engine):
+	m_falco_engine(engine),
 	m_initialized(false),
 	m_buffered(true),
 	m_json_output(false),
@@ -49,11 +47,25 @@ falco_outputs::falco_outputs():

 falco_outputs::~falco_outputs()
 {
+	// Note: The assert()s in this destructor were previously places where
+	//       exceptions were thrown.  C++11 doesn't allow destructors to
+	//       emit exceptions; if they're thrown, they'll trigger a call
+	//       to 'terminate()'.  To maintain similar behavior, the exceptions
+	//       were replace with calls to 'assert()'
 	if(m_initialized)
 	{
-		for(auto it = m_outputs.cbegin(); it != m_outputs.cend(); ++it)
+		lua_getglobal(m_ls, m_lua_output_cleanup.c_str());
+		if(!lua_isfunction(m_ls, -1))
 		{
-			(*it)->cleanup();
+			falco_logger::log(LOG_ERR, std::string("No function ") + m_lua_output_cleanup + " found. ");
+			assert(nullptr == "Missing lua cleanup function in ~falco_outputs");
+		}
+
+		if(lua_pcall(m_ls, 0, 0, 0) != 0)
+		{
+			const char *lerr = lua_tostring(m_ls, -1);
+			falco_logger::log(LOG_ERR, std::string("lua_pcall failed, err: ") + lerr);
+			assert(nullptr == "lua_pcall failed in ~falco_outputs");
 		}
 	}
 }
@@ -63,13 +75,24 @@ void falco_outputs::init(bool json_output,
 			 uint32_t rate, uint32_t max_burst, bool buffered,
 			 bool time_format_iso_8601, string hostname)
 {
+	// The engine must have been given an inspector by now.
+	if(!m_inspector)
+	{
+		throw falco_exception("No inspector provided");
+	}
+
 	m_json_output = json_output;

-	// Note that falco_formats is already initialized by the engine,
-	// and the following json options are not used within the engine.
-	// So we can safely update them.
-	falco_formats::s_json_output = json_output;
-	falco_formats::s_json_include_output_property = json_include_output_property;
+	falco_common::init(m_lua_main_filename.c_str(), FALCO_SOURCE_LUA_DIR);
+
+	// Note that falco_formats is added to both the lua state used
+	// by the falco engine as well as the separate lua state used
+	// by falco outputs.
+	falco_formats::init(m_inspector, m_falco_engine, m_ls, json_output, json_include_output_property);
+
+	falco_logger::init(m_ls);
+
+	luaL_openlib(m_ls, "c_outputs", ll_falco_outputs, 0);

 	m_notifications_tb.init(rate, max_burst);

@@ -80,47 +103,40 @@ void falco_outputs::init(bool json_output,
 	m_initialized = true;
 }

-void falco_outputs::add_output(falco::outputs::config oc)
+void falco_outputs::add_output(output_config oc)
 {
+	uint8_t nargs = 3;
+	lua_getglobal(m_ls, m_lua_add_output.c_str());

-	falco::outputs::abstract_output *oo;
+	if(!lua_isfunction(m_ls, -1))
+	{
+		throw falco_exception("No function " + m_lua_add_output + " found. ");
+	}
+	lua_pushstring(m_ls, oc.name.c_str());
+	lua_pushnumber(m_ls, (m_buffered ? 1 : 0));
+	lua_pushnumber(m_ls, (m_time_format_iso_8601 ? 1 : 0));

-	if(oc.name == "file")
+	// If we have options, build up a lua table containing them
+	if(oc.options.size())
 	{
-		oo = new falco::outputs::output_file();
-	}
-	else if(oc.name == "program")
-	{
-		oo = new falco::outputs::output_program();
-	}
-	else if(oc.name == "stdout")
-	{
-		oo = new falco::outputs::output_stdout();
-	}
-	else if(oc.name == "syslog")
-	{
-		oo = new falco::outputs::output_syslog();
-	}
-#ifndef MINIMAL_BUILD
-	else if(oc.name == "http")
-	{
-		oo = new falco::outputs::output_http();
-	}
-	else if(oc.name == "grpc")
-	{
-		oo = new falco::outputs::output_grpc();
-	}
-#endif
-	else
-	{
-		throw falco_exception("Output not supported: " + oc.name);
+		nargs = 4;
+		lua_createtable(m_ls, 0, oc.options.size());
+
+		for(auto it = oc.options.cbegin(); it != oc.options.cend(); ++it)
+		{
+			lua_pushstring(m_ls, (*it).second.c_str());
+			lua_setfield(m_ls, -2, (*it).first.c_str());
+		}
 	}

-	oo->init(oc, m_buffered, m_hostname);
-	m_outputs.push_back(oo);
+	if(lua_pcall(m_ls, nargs, 0, 0) != 0)
+	{
+		const char *lerr = lua_tostring(m_ls, -1);
+		throw falco_exception(string(lerr));
+	}
 }

-void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
+void falco_outputs::handle_event(gen_event *ev, string &rule, string &source,
 				 falco_common::priority_type priority, string &format)
 {
 	if(!m_notifications_tb.claim())
@@ -129,46 +145,31 @@ void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
 		return;
 	}

-	string sformat;
-	if(source == "syscall")
+
+
+	std::lock_guard<std::mutex> guard(m_ls_semaphore);
+	lua_getglobal(m_ls, m_lua_output_event.c_str());
+
+	if(lua_isfunction(m_ls, -1))
 	{
-		if(m_time_format_iso_8601)
+		lua_pushlightuserdata(m_ls, ev);
+		lua_pushstring(m_ls, rule.c_str());
+		lua_pushstring(m_ls, source.c_str());
+		lua_pushstring(m_ls, falco_common::priority_names[priority].c_str());
+		lua_pushnumber(m_ls, priority);
+		lua_pushstring(m_ls, format.c_str());
+		lua_pushstring(m_ls, m_hostname.c_str());
+
+		if(lua_pcall(m_ls, 7, 0, 0) != 0)
 		{
-			sformat = "*%evt.time.iso8601: " + falco_common::priority_names[priority];
-		}
-		else
-		{
-			sformat = "*%evt.time: " + falco_common::priority_names[priority];
+			const char *lerr = lua_tostring(m_ls, -1);
+			string err = "Error invoking function output: " + string(lerr);
+			throw falco_exception(err);
 		}
 	}
 	else
 	{
-		if(m_time_format_iso_8601)
-		{
-			sformat = "*%jevt.time.iso8601: " + falco_common::priority_names[priority];
-		}
-		else
-		{
-			sformat = "*%jevt.time: " + falco_common::priority_names[priority];
-		}
-	}
-
-	// if format starts with a *, remove it, as we added our own prefix
-	if(format[0] == '*')
-	{
-		sformat += " " + format.substr(1, format.length() - 1);
-	}
-	else
-	{
-		sformat += " " + format;
-	}
-
-	string msg;
-	msg = falco_formats::format_event(evt, rule, source, falco_common::priority_names[priority], sformat);
-
-	for(auto it = m_outputs.cbegin(); it != m_outputs.cend(); ++it)
-	{
-		(*it)->output_event(evt, rule, source, priority, sformat, msg);
+		throw falco_exception("No function " + m_lua_output_event + " found in lua compiler module");
 	}
 }

@@ -196,7 +197,7 @@ void falco_outputs::handle_msg(uint64_t now,
 		iso8601evttime += time_ns;

 		jmsg["output"] = msg;
-		jmsg["priority"] = falco_common::priority_names[priority];
+		jmsg["priority"] = "Critical";
 		jmsg["rule"] = rule;
 		jmsg["time"] = iso8601evttime;
 		jmsg["output_fields"] = output_fields;
@@ -209,7 +210,7 @@ void falco_outputs::handle_msg(uint64_t now,
 		bool first = true;

 		sinsp_utils::ts_to_string(now, &timestr, false, true);
-		full_msg = timestr + ": " + falco_common::priority_names[priority] + " " + msg + " (";
+		full_msg = timestr + ": " + falco_common::priority_names[LOG_CRIT] + " " + msg + " (";
 		for(auto &pair : output_fields)
 		{
 			if(first)
@@ -225,16 +226,149 @@ void falco_outputs::handle_msg(uint64_t now,
 		full_msg += ")";
 	}

-	for(auto it = m_outputs.cbegin(); it != m_outputs.cend(); ++it)
+	std::lock_guard<std::mutex> guard(m_ls_semaphore);
+	lua_getglobal(m_ls, m_lua_output_msg.c_str());
+	if(lua_isfunction(m_ls, -1))
 	{
-		(*it)->output_msg(priority, full_msg);
+		lua_pushstring(m_ls, full_msg.c_str());
+		lua_pushstring(m_ls, falco_common::priority_names[priority].c_str());
+		lua_pushnumber(m_ls, priority);
+
+		if(lua_pcall(m_ls, 3, 0, 0) != 0)
+		{
+			const char *lerr = lua_tostring(m_ls, -1);
+			string err = "Error invoking function output: " + string(lerr);
+			throw falco_exception(err);
+		}
+	}
+	else
+	{
+		throw falco_exception("No function " + m_lua_output_msg + " found in lua compiler module");
 	}
 }

 void falco_outputs::reopen_outputs()
 {
-	for(auto it = m_outputs.cbegin(); it != m_outputs.cend(); ++it)
+	lua_getglobal(m_ls, m_lua_output_reopen.c_str());
+	if(!lua_isfunction(m_ls, -1))
 	{
-		(*it)->reopen();
+		throw falco_exception("No function " + m_lua_output_reopen + " found. ");
+	}
+
+	if(lua_pcall(m_ls, 0, 0, 0) != 0)
+	{
+		const char *lerr = lua_tostring(m_ls, -1);
+		throw falco_exception(string(lerr));
 	}
 }
+
+int falco_outputs::handle_http(lua_State *ls)
+{
+	CURL *curl = NULL;
+	CURLcode res = CURLE_FAILED_INIT;
+	struct curl_slist *slist1;
+	slist1 = NULL;
+
+	if(!lua_isstring(ls, -1) ||
+	   !lua_isstring(ls, -2))
+	{
+		lua_pushstring(ls, "Invalid arguments passed to handle_http()");
+		lua_error(ls);
+	}
+
+	string url = (char *)lua_tostring(ls, 1);
+	string msg = (char *)lua_tostring(ls, 2);
+
+	curl = curl_easy_init();
+	if(curl)
+	{
+		slist1 = curl_slist_append(slist1, "Content-Type: application/json");
+		curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
+		curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+		curl_easy_setopt(curl, CURLOPT_POSTFIELDS, msg.c_str());
+		curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, -1L);
+
+		res = curl_easy_perform(curl);
+
+		if(res != CURLE_OK)
+		{
+			falco_logger::log(LOG_ERR, "libcurl error: " + string(curl_easy_strerror(res)));
+		}
+		curl_easy_cleanup(curl);
+		curl = NULL;
+		curl_slist_free_all(slist1);
+		slist1 = NULL;
+	}
+	return 1;
+}
+
+int falco_outputs::handle_grpc(lua_State *ls)
+{
+	// check parameters
+	if(!lua_islightuserdata(ls, -8) ||
+	   !lua_isstring(ls, -7) ||
+	   !lua_isstring(ls, -6) ||
+	   !lua_isstring(ls, -5) ||
+	   !lua_isstring(ls, -4) ||
+	   !lua_istable(ls, -3) ||
+	   !lua_isstring(ls, -2) ||
+	   !lua_istable(ls, -1))
+	{
+		lua_pushstring(ls, "Invalid arguments passed to handle_grpc()");
+		lua_error(ls);
+	}
+
+	response grpc_res = response();
+
+	// time
+	gen_event *evt = (gen_event *)lua_topointer(ls, 1);
+	auto timestamp = grpc_res.mutable_time();
+	*timestamp = google::protobuf::util::TimeUtil::NanosecondsToTimestamp(evt->get_ts());
+
+	// rule
+	auto rule = grpc_res.mutable_rule();
+	*rule = (char *)lua_tostring(ls, 2);
+
+	// source
+	falco::schema::source s = falco::schema::source::SYSCALL;
+	string sstr = (char *)lua_tostring(ls, 3);
+	if(!falco::schema::source_Parse(sstr, &s))
+	{
+		lua_pushstring(ls, "Unknown source passed to to handle_grpc()");
+		lua_error(ls);
+	}
+	grpc_res.set_source(s);
+
+	// priority
+	falco::schema::priority p = falco::schema::priority::EMERGENCY;
+	string pstr = (char *)lua_tostring(ls, 4);
+	if(!falco::schema::priority_Parse(pstr, &p))
+	{
+		lua_pushstring(ls, "Unknown priority passed to to handle_grpc()");
+		lua_error(ls);
+	}
+	grpc_res.set_priority(p);
+
+	// output
+	auto output = grpc_res.mutable_output();
+	*output = (char *)lua_tostring(ls, 5);
+
+	// output fields
+	auto &fields = *grpc_res.mutable_output_fields();
+
+	lua_pushnil(ls); // so that lua_next removes it from stack and puts (k, v) on it
+	while(lua_next(ls, 6) != 0)
+	{
+		fields[lua_tostring(ls, -2)] = lua_tostring(ls, -1);
+		lua_pop(ls, 1); // remove value, keep key for lua_next
+	}
+	lua_pop(ls, 1); // pop table
+
+	// hostname
+	auto host = grpc_res.mutable_hostname();
+	*host = (char *)lua_tostring(ls, 7);
+
+	falco::output::queue::get().push(grpc_res);
+
+	return 1;
+}
--- a/userspace/falco/falco_outputs.h
+++ b/userspace/falco/falco_outputs.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,36 +19,50 @@ limitations under the License.
 #include <memory>
 #include <map>

+extern "C" {
+#include "lua.h"
+#include "lualib.h"
+#include "lauxlib.h"
+}
+
 #include "gen_filter.h"
 #include "json_evt.h"
 #include "falco_common.h"
 #include "token_bucket.h"
 #include "falco_engine.h"
-#include "outputs.h"

 //
 // This class acts as the primary interface between a program and the
 // falco output engine. The falco rules engine is implemented by a
 // separate class falco_engine.
 //
-class falco_outputs
+
+class falco_outputs : public falco_common
 {
 public:
-	falco_outputs();
+	falco_outputs(falco_engine *engine);
 	virtual ~falco_outputs();

+	// The way to refer to an output (file, syslog, stdout, etc.)
+	// An output has a name and set of options.
+	struct output_config
+	{
+		std::string name;
+		std::map<std::string, std::string> options;
+	};
+
 	void init(bool json_output,
 		  bool json_include_output_property,
 		  uint32_t rate, uint32_t max_burst, bool buffered,
 		  bool time_format_iso_8601, std::string hostname);

-	void add_output(falco::outputs::config oc);
+	void add_output(output_config oc);

 	//
-	// evt is an event that has matched some rule. Pass the event
+	// ev is an event that has matched some rule. Pass the event
 	// to all configured outputs.
 	//
-	void handle_event(gen_event *evt, std::string &rule, std::string &source,
+	void handle_event(gen_event *ev, std::string &rule, std::string &source,
 			  falco_common::priority_type priority, std::string &format);

 	// Send a generic message to all outputs. Not necessarily associated with any event.
@@ -56,14 +70,18 @@ public:
 			falco_common::priority_type priority,
 			std::string &msg,
 			std::string &rule,
-			std::map<std::string, std::string> &output_fields);
+			std::map<std::string,std::string> &output_fields);

 	void reopen_outputs();

-private:
-	bool m_initialized;
+	static int handle_http(lua_State *ls);
+	static int handle_grpc(lua_State *ls);

-	std::vector<falco::outputs::abstract_output *> m_outputs;
+private:
+
+	falco_engine *m_falco_engine;
+
+	bool m_initialized;

 	// Rate limits notifications
 	token_bucket m_notifications_tb;
@@ -72,4 +90,11 @@ private:
 	bool m_json_output;
 	bool m_time_format_iso_8601;
 	std::string m_hostname;
+
+	std::string m_lua_add_output = "add_output";
+	std::string m_lua_output_event = "output_event";
+	std::string m_lua_output_msg = "output_msg";
+	std::string m_lua_output_cleanup = "output_cleanup";
+	std::string m_lua_output_reopen = "output_reopen";
+	std::string m_lua_main_filename = "output.lua";
 };
--- a/userspace/falco/grpc_context.h
+++ b/userspace/falco/grpc_context.h
@@ -36,7 +36,7 @@ class context
 {
 public:
 	context(::grpc::ServerContext* ctx);
-	virtual ~context() = default;
+	~context() = default;

 	void get_metadata(std::string key, std::string& val);

@@ -50,7 +50,7 @@ class stream_context : public context
 public:
 	stream_context(::grpc::ServerContext* ctx):
 		context(ctx){};
-	virtual ~stream_context() = default;
+	~stream_context() = default;

 	enum : char
 	{
@@ -61,15 +61,6 @@ public:

 	mutable void* m_stream = nullptr; // todo(fntlnz, leodido) > useful in the future
 	mutable bool m_has_more = false;
-	mutable bool m_is_running = true;
-};
-
-class bidi_context : public stream_context
-{
-public:
-	bidi_context(::grpc::ServerContext* ctx):
-		stream_context(ctx){};
-	virtual ~bidi_context() = default;
 };

 } // namespace grpc
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Kris Nova	258103be08	adding changes for laptop	2020-06-16 11:17:16 -07:00
Kris Nova	f35cc98126	feat(debug): More debug for testing in GKE Signed-off-by: Kris Nova <kris@nivenly.com>	2020-06-10 21:26:06 -07:00
Kris Nova	94149e4b00	feat(debug): Just pushing my work up so I can go work from the couch I will squash this and most of this is throw away code anyway. Signed-off-by: Kris Nova <kris@nivenly.com>	2020-06-10 19:06:24 -07:00