Commit Graph

  • 48fbe0801d fix(userspace/falco): print right list of ignored events when in simple cons mode Jason Dellaluce 2022-10-11 14:20:33 +00:00
  • c47492ab6d update(userspace/falco): populate list of interesting event types in app state Jason Dellaluce 2022-10-11 14:19:36 +00:00
  • 4cb556aed2 update(userspace/engine): use sinsp api to access event table information Jason Dellaluce 2022-10-11 14:15:34 +00:00
  • 7da3041cb3 feature(falco_service): add a service unit to inject the kmod Andrea Terzolo 2022-10-10 12:51:03 +00:00
  • 48ce85f4da fix(falco_service): falco service needs to write under /sys/module/falco Andrea Terzolo 2022-10-10 09:20:12 +00:00
  • 8cfaf29a68 bump libs test_falco_bump Andrea Terzolo 2022-10-11 21:15:49 +00:00
  • d7ebe88f45 test(engine): fix unit tests Jason Dellaluce 2022-10-11 16:06:46 +00:00
  • 302d30f849 chore(userspace/falco): polish ignored event warning message Jason Dellaluce 2022-10-11 14:55:24 +00:00
  • 738932cc7c fix(userspace/falco): print right list in ignored events warning Jason Dellaluce 2022-10-11 14:41:13 +00:00
  • 88b9f200ae fix(userspace/falco): print right list of ignored events when in simple cons mode Jason Dellaluce 2022-10-11 14:20:33 +00:00
  • a98ce2c877 update(userspace/falco): populate list of interesting event types in app state Jason Dellaluce 2022-10-11 14:19:36 +00:00
  • ae1326def5 update(userspace/engine): use sinsp api to access event table information Jason Dellaluce 2022-10-11 14:15:34 +00:00
  • 5f2bc6a2d3 fix(userspace/falco): properly handle termination at source opening failures Jason Dellaluce 2022-10-11 15:48:16 +00:00
  • 88c7202fdc fix(userspace/falco): check conditions in right order Jason Dellaluce 2022-10-11 15:42:39 +00:00
  • a98a1b2c4c fix(userspace/falco/falco): allow output reopening to happen multiple times Jason Dellaluce 2022-10-11 15:40:58 +00:00
  • 77857a7236 fix(userspace/falco): solve warning Jason Dellaluce 2022-10-10 11:53:37 +00:00
  • e011b3b5e5 chore(userspace/falco): fix typo Jason Dellaluce 2022-10-10 11:13:28 +00:00
  • fd4d521a5f fix(userspace/falco): make multi-source termination condition more stable Jason Dellaluce 2022-10-10 11:02:15 +00:00
  • 3f3386cfe0 fix(userspace/falco): make signal handlers safe with multi-threading Jason Dellaluce 2022-10-10 10:31:39 +00:00
  • 11160f8463 fix(userspace): safely check string bounded access Jason Dellaluce 2022-10-07 14:13:37 +00:00
  • bc714d06fc chore(userspace/falco): do not allow multiple Falco instances. chore/falco_lock_file Federico Di Pierro 2022-10-10 14:21:32 +02:00
  • 6ab0244ed0 fix: fix falco service fix_falco_service Andrea Terzolo 2022-10-09 23:13:34 +02:00
  • 79d875c28f cleanup(scripts): cleanup systemd unit in RPM installer Stanley Chan 2022-08-05 12:47:49 -07:00
  • 7610ee53e5 cleanup(scripts): cleanup systemd unit in DEB installer Stanley Chan 2022-07-20 11:47:57 -05:00
  • 251b4d5b4e cleanup(scripts): cleanup systemd unit in RPM installer test_deb_rpm Stanley Chan 2022-08-05 12:47:49 -07:00
  • b837b5d0f9 cleanup(scripts): cleanup systemd unit in DEB installer Stanley Chan 2022-07-20 11:47:57 -05:00
  • 3c02b40a21 chore(userspace/falco): make log message termination consistent Jason Dellaluce 2022-10-06 16:50:54 +00:00
  • e85a8c914f chore(userspace/falco): move enabled sources list printout when capture is opened Jason Dellaluce 2022-10-06 16:47:04 +00:00
  • 21c2b1f472 update(userspace/falco): use unordered_set where possible for faster lookups Jason Dellaluce 2022-10-06 16:46:29 +00:00
  • 909f6d0961 chore(userspace/falco): make log messages formatting more consistent Jason Dellaluce 2022-10-06 16:34:04 +00:00
  • 83a83a5853 update(userspace): pass string as const refs when possible Jason Dellaluce 2022-10-06 16:31:42 +00:00
  • b4ea2f4da2 fix(userspace/falco): stabilize termination signal handler Jason Dellaluce 2022-10-06 14:37:40 +00:00
  • 59ba2f9aab fix(userspace/falco): properly terminate threads Jason Dellaluce 2022-10-06 14:21:03 +00:00
  • 32ec3240b4 fix(rules): add falco no-driver images to k8s_containers macro Jason Dellaluce 2022-10-06 12:48:37 +00:00
  • fbac2a9570 tests: fix broken tests Andrea Terzolo 2022-10-05 16:43:06 +00:00
  • 805f0cdd78 chore: bump libs to latest release branch commit Andrea Terzolo 2022-10-05 15:45:31 +00:00
  • e68151eb07 chore(test,userspace/falco): fixed tests after libs bump. Federico Di Pierro 2022-10-05 15:47:55 +02:00
  • ec7ddbbaf8 chore: bump libs/driver to pre-release tag Andrea Terzolo 2022-10-04 09:07:58 +00:00
  • 663c1d073a fix(userspace/falco): check plugin requirements when validating rule files Jason Dellaluce 2022-10-05 07:29:52 +00:00
  • bbb821fb8e refactor(userspace/falco): move rules plugin requirements check in an internal funcion Jason Dellaluce 2022-10-05 07:29:15 +00:00
  • 5781c53ddc fix(userspace): add explicit constructors and initializations Jason Dellaluce 2022-10-03 09:17:17 +00:00
  • 545b58ee14 update(open_inspector): use variable buffer dim in modern bpf Andrea Terzolo 2022-09-28 10:22:44 +00:00
  • cf83ff5447 chore: bump libs to latest master Andrea Terzolo 2022-09-27 10:47:15 +02:00
  • 8d8e7622e1 update(cmd_line): put modern bpf to false Andrea Terzolo 2022-09-27 10:44:38 +02:00
  • fd097e94d7 new(cmdline): add support for modern BPF probe Andrea Terzolo 2022-09-24 13:48:58 +00:00
  • 6634c896b7 fix(falco): print container info and gvisor info in the same way Luca Guerra 2022-09-27 10:12:11 +00:00
  • 38c823533c Add PIDs to falco_rules.yaml rules spyder-kyle 2022-09-16 10:31:34 -05:00
  • 3aa9267b48 fix(syscall_buffer): set dimension if page size not available Andrea Terzolo 2022-09-24 16:39:02 +00:00
  • 725714726d update(configuration): define m_syscall_buf_size_preset as uint16_t Andrea Terzolo 2022-09-24 14:16:11 +00:00
  • c9fa585801 update: address some review comments Andrea Terzolo 2022-09-20 15:52:12 +00:00
  • 90e4634a79 update(syscall_buffer_size): don't crash in case of getpagesize error Andrea Terzolo 2022-09-20 15:16:29 +00:00
  • b0b2f05eb5 new: configure syscall buffer dimension from Falco Andrea Terzolo 2022-09-18 22:51:18 +00:00
  • 8aea0935c9 chore(userspace/engine): remove unused var Jason Dellaluce 2022-09-13 13:05:40 +00:00
  • 9c240198a0 refactor(userspace/engine): refactor falco_engine with new loader defs Jason Dellaluce 2022-09-13 12:31:25 +00:00
  • f6f763fe84 refactor(userspace/engine): clean up rule collector Jason Dellaluce 2022-09-13 08:51:33 +00:00
  • 9b5f3ee99e refactor(userspace/engine): clean up rule compiler Jason Dellaluce 2022-09-13 08:50:57 +00:00
  • 89e8f70de0 refactor(userspace/engine): clean up and rename rule reader Jason Dellaluce 2022-09-13 08:50:29 +00:00
  • b0f0105116 refactor(userspace/engine): clean up rule loader Jason Dellaluce 2022-09-13 08:49:58 +00:00
  • 5f2267f716 update(userspace/engine): add new loader files to CMakeLists Jason Dellaluce 2022-09-13 08:48:51 +00:00
  • b65157af5e refactor(userspace/engine): split rule loader git history (5) Jason Dellaluce 2022-09-13 08:45:35 +00:00
  • b2b1feb1f2 refactor(userspace/engine): split rule loader git history (4) Jason Dellaluce 2022-09-13 08:44:40 +00:00
  • b900e46dfe refactor(userspace/engine): split rule loader git history (3) Jason Dellaluce 2022-09-13 08:44:17 +00:00
  • a98c9cdd20 refactor(userspace/engine): split rule loader git history (2) Jason Dellaluce 2022-09-13 08:43:04 +00:00
  • 2a427925a0 refactor(userspace/engine): split rule loader git history (1) Jason Dellaluce 2022-09-13 08:42:27 +00:00
  • 3775dc83fc cleanup(docker): avoid linking /lib/modules to /host/lib/modules at docker image creation time. Federico Di Pierro 2022-09-22 17:09:33 +02:00
  • c0c37d87f5 fix(process_events): check the return value of open_live_inspector Andrea Terzolo 2022-09-20 15:07:59 +00:00
  • 7e8bf42ff9 update: address some review comments buffer_dimension Andrea Terzolo 2022-09-20 15:52:12 +00:00
  • a151418270 update(syscall_buffer_size): don't crash in case of getpagesize error Andrea Terzolo 2022-09-20 15:16:29 +00:00
  • 69623e9b93 new: configure syscall buffer dimension from Falco Andrea Terzolo 2022-09-18 22:51:18 +00:00
  • f57c67cc96 docs(falco.yaml): fix a typo Andrea Terzolo 2022-09-20 08:44:30 +00:00
  • 7686c03a36 update(app_actions): add a depraction comment for BPF Andrea Terzolo 2022-09-19 21:30:07 +00:00
  • aa0abb4288 tests: fix traces-positive/run-shell-untrusted.scap test Andrea Terzolo 2022-09-19 20:15:14 +00:00
  • 8b927fb010 chore: bump libs version Andrea Terzolo 2022-09-19 14:25:32 +00:00
  • a325086363 test(falco): fix broken tests Andrea Terzolo 2022-09-19 13:19:44 +00:00
  • 1930ec56c7 test(plugin): bump plugin API in test Andrea Terzolo 2022-09-19 09:01:44 +00:00
  • 3902779409 chore(plugins.cmake): bump plugin versions Andrea Terzolo 2022-09-18 17:44:51 +00:00
  • 7e37c72431 update: falco works with the latest libs commit Andrea Terzolo 2022-09-18 16:50:17 +00:00
  • e068df514c chore(userspace/engine,userspace/falco): upgraded to latest libs. Federico Di Pierro 2022-09-16 15:44:58 +02:00
  • 9048d84ed4 chore(cmake): bumped libs to latest master. Federico Di Pierro 2022-09-16 15:34:05 +02:00
  • 00459f3447 chore(cmake): dropped SCAP_BPF_PROBE_ENV_VAR_NAME variable; unused. Federico Di Pierro 2022-09-12 17:54:25 +02:00
  • 0274959981 update(userspace/falco, cmake): updated libs to latest master. Federico Di Pierro 2022-09-12 17:39:24 +02:00
  • 30b56d2960 revert and create new known macro Hi120ki 2022-09-12 20:17:40 +09:00
  • d6b5789b7a add user_known_mount_in_privileged_containers Hi120ki 2022-09-12 12:12:20 +09:00
  • af4524491d put open_read in the beginning of the rule Hi120ki 2022-09-15 09:56:20 +09:00
  • 36a08aee13 Update rules/falco_rules.yaml to delete enabled field Hi120ki 2022-09-09 16:52:30 +09:00
  • 39de011751 Update rules/falco_rules.yaml to add argoexec into allowlist Hi120ki 2022-09-09 16:52:10 +09:00
  • a83d38c6d7 add allowlist Hi120ki 2022-09-09 09:47:54 +09:00
  • 86c3a9cd69 revert to container Hi120ki 2022-09-08 15:35:27 +09:00
  • 8473706526 add systemd-sysctl to allowlist Hi120ki 2022-09-08 11:09:21 +09:00
  • 4e622fc033 add host to target Hi120ki 2022-09-08 10:12:27 +09:00
  • 16dca8f905 add rule Read environment variable from /proc files Hi120ki 2022-09-06 17:58:35 +09:00
  • 2d5fc0b647 Use the same falco_rule struct for every call to filter_ruleset Mark Stemm 2022-09-13 15:02:25 -07:00
  • e5cd5eacf5 Save syscall source separately and check explicitly in process_event Mark Stemm 2022-09-14 13:41:58 -07:00
  • 366bcfd7a3 Added disable by default option to reduce noise Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Stefano 2022-09-02 15:08:07 +02:00
  • c844eb9ef3 Added rule to detect CVE-2019-5736 Co-authored-by: wcc526 <wcc526@gmail.com> Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Stefano 2022-09-02 15:00:27 +02:00
  • b71eb7e6ed chore(OWNERS): cleanup inactive reviewer Leonardo Grasso 2022-09-13 18:47:06 +02:00
  • c732e5d800 update: gRPC server sock defaults to /run/falco/falco.sock Leonardo Grasso 2022-09-12 16:55:13 +02:00
  • c0ea753262 update(userspace/falco): gVisor sock now defaults to /run/falco/gvisor.sock Leonardo Grasso 2022-09-12 16:54:19 +02:00
  • e4008217b9 Replacing /tmp/gvisor.sock with /run/gvisor.sock Vicente JJ. Miras 2022-08-11 09:49:27 +02:00
  • 9c184af2a1 fix(userspace/falco): adopt stricter memory order semantics Jason Dellaluce 2022-09-01 14:08:17 +00:00