Commit Graph

  • d9d8dedc32 update(test): fixed tests. Federico Di Pierro 2022-05-13 13:05:36 +02:00
  • 39f55f4b5c update(userspace): split filterchecks list for each source idx. Federico Di Pierro 2022-05-13 13:01:29 +02:00
  • 5f00cea3c9 fix(userspace/falco): do not start webserver in capture mode. Federico Di Pierro 2022-05-13 12:56:00 +02:00
  • f6dba24b81 update(build): updated libs to latest master. Federico Di Pierro 2022-05-13 12:51:27 +02:00
  • 9d41b0a151 use endswith ash_history to catch both bash and ash Brad Clark 2022-05-09 10:04:19 -04:00
  • b9bcf79035 rule(macro truncate_shell_history): include .ash_history Brad Clark 2022-03-23 14:43:15 -04:00
  • 3cca4c23cc rule(macro modify_shell_history): include .ash_history Brad Clark 2022-03-23 14:32:29 -04:00
  • a7ebfbf137 update(ci): add workflow_dispatch to be able to manually trigger ci. Federico Di Pierro 2022-05-13 16:50:05 +02:00
  • fbc7ede75a Update .github/workflows/ci.yml Federico Di Pierro 2022-05-13 16:49:41 +02:00
  • 7b45520f37 fix(ci): fetch all history from git to correctly populate FALCO_VERSION. Federico Di Pierro 2022-05-13 15:56:20 +02:00
  • 2b6c0f3f9e fix(ci): fixed ubuntu kernel headers install. Federico Di Pierro 2022-05-13 14:58:05 +02:00
  • f5f836ca8b fix(ci): fixed centos debug job. Federico Di Pierro 2022-05-13 14:51:56 +02:00
  • 3b73433c48 update(ci): dropped circleCI jobs that are now provided by gh actions. Federico Di Pierro 2022-05-13 14:31:49 +02:00
  • 1a3556affc update(ci): ported all no-output jobs to github actions. Federico Di Pierro 2022-05-13 14:28:16 +02:00
  • b3aec1967b fix(ci): use sudo. Federico Di Pierro 2022-05-13 14:26:26 +02:00
  • 004e93f19f new(ci): initial build minimal action ported to gh action. Federico Di Pierro 2022-05-13 14:20:47 +02:00
  • 96e2864c16 test(falco_k8s_audit): fix k8s audit tests to used plugin ruleset Jason Dellaluce 2022-05-09 16:10:22 +00:00
  • e2b7b1208a build(cmake/modules): add plugins rules and bump plugins versions Leonardo Grasso 2022-05-09 16:49:49 +02:00
  • d4f76f1f93 update!: moving out plugins ruleset files Leonardo Grasso 2022-05-09 16:31:54 +02:00
  • 65de03aa29 update(rules): remove plugins ruleset files Leonardo Grasso 2022-05-09 13:20:28 +02:00
  • 298913471c wip: bump libs version to ff0b1f8d4612d197368b3f7feff28178f3bd3ad184f3707942ab52219e98f461 Leonardo Grasso 2022-05-09 13:18:48 +02:00
  • 3e603188d4 Changed field in thread.cap_effective Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com> Stefano 2022-04-15 12:08:28 +02:00
  • c3bcf604a5 Changed Rule focus to be broader then just a specific CVE Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com> Stefano 2022-04-15 12:04:30 +02:00
  • 2e2b13236b Fixed CVE number Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com> Stefano 2022-04-13 12:22:51 +02:00
  • 24bd1abc43 Added new rule for CVE-2022-4092 Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com> Stefano 2022-04-13 12:04:00 +02:00
  • acbbcf7481 Update userspace/falco/app_cmdline_options.h Federico Di Pierro 2022-05-12 10:42:31 +02:00
  • 3ba64d8a49 new(userspace/falco): new inotify watcher is now able to properly watch rules folders, when specified. Federico Di Pierro 2022-05-06 12:58:18 +02:00
  • 293a6c2b40 update(userspace/falco): moved to a config option. Federico Di Pierro 2022-05-06 11:20:16 +02:00
  • a9fe979071 chore(userspace/falco): small cleanup. Federico Di Pierro 2022-05-06 10:38:40 +02:00
  • e32f5a66c5 new(userspace/falco): added an option to listen to changes on the config file and rules files, and trigger a Falco reload. Federico Di Pierro 2022-05-06 09:40:34 +02:00
  • 8c6cfae18f Include origin host in output json Milkshak3s 2022-05-03 14:32:13 -04:00
  • eae193ade0 build(userspace/engine): cleanup unused include dir Leonardo Grasso 2022-04-29 10:47:36 +02:00
  • 2bc4fec33c rule(Anonymous Request Allowed): exclude {/livez, /readyz} Sebastien Le Digabel 2022-03-15 12:27:43 +00:00
  • dbbc93f69d fix(userspace/falco): listen to proper host in webserver Jason Dellaluce 2022-04-29 13:10:54 +02:00
  • de754fb4e7 chore(falco.yaml): comment-out k8s plugin default config values Jason Dellaluce 2022-04-22 16:29:56 +00:00
  • 63b7aabc81 chore: solve compilation issues and polish code Jason Dellaluce 2022-04-22 14:30:46 +00:00
  • 69db6adf9d refactor(test): use SKIP_PLUGINS_TESTS to skip k8s audit regression tests Jason Dellaluce 2022-04-22 10:39:54 +00:00
  • 67d2fe45a5 refactor: add k8saudit plugin and adapt config, tests, and rulesets Jason Dellaluce 2022-04-22 07:49:39 +00:00
  • b91ff34b97 refactor: drop civetweb dependency and implement healtz using cpp-httplib Jason Dellaluce 2022-03-23 13:37:30 +00:00
  • 42fcc7291f refactor(userspace/falco): remove k8s audit references from falco Jason Dellaluce 2022-03-23 13:35:31 +00:00
  • 21b127ef65 docs(falco_scripts): update Copyright Andrea Terzolo 2022-04-25 22:40:35 +02:00
  • 9937565416 docs(falco_scripts): add some punctuation marks in comments Andrea Terzolo 2022-03-23 23:30:42 +01:00
  • b94226569f update(falco_scripts): delete all versions of the module from dkms Andrea Terzolo 2022-03-23 22:35:20 +01:00
  • f8b97bfbce docs(falco_scripts): update comments in falco-driver-loader. Andrea Terzolo 2022-03-21 19:12:41 +01:00
  • 1ebdb5648f update(falco_scripts): remove only the current version Andrea Terzolo 2022-03-21 12:41:51 +01:00
  • a11d513bff chore(falco_scripts): Update falco-driver-loader cleaning phase Andrea Terzolo 2022-03-20 17:50:36 +01:00
  • 7aed3b6d01 fix(test): fixed wrong test expected output. Federico Di Pierro 2022-04-28 21:03:17 +02:00
  • 98916e547d build(cmake): bump libs version to c778e452985aa7f17be781754d4ad0658fcc3254 Leonardo Grasso 2022-04-28 19:09:59 +02:00
  • 9ec05c7048 fix(test): dropped get_type() api from test_source/extract tests. Federico Di Pierro 2022-04-26 15:57:56 +02:00
  • fd9bb83d85 update(build): updated libs version to latest master. Federico Di Pierro 2022-04-26 15:50:09 +02:00
  • 08ded97596 new(userspace/falco): use new plugin caps API. Federico Di Pierro 2022-04-01 17:56:13 +02:00
  • 9fb9215dbf new(rule): excessively capable containers Lorenzo Susini 2022-03-30 13:29:20 +00:00
  • 3a6274ab36 build: correct conffiles for DEB packages Leonardo Grasso 2022-04-21 18:46:04 +02:00
  • 86d632d343 fix: allow empty exceptions property Mark Stemm 2022-04-26 13:56:34 -07:00
  • e909babe20 fix: add implied exception comp to item for single item variant Mark Stemm 2022-04-26 13:54:31 -07:00
  • 990a8fd6d5 update(rules): k8s: secret get detection Furkan 2022-03-19 23:01:34 +03:00
  • a16eac221e refactor(userspace/engine): apply C++ best practices to newest engine classes Jason Dellaluce 2022-04-21 08:49:11 +00:00
  • be177795c2 refactor(userspace/engine): use supported_operators helper from libsinsp filter parser Jason Dellaluce 2022-04-21 08:23:18 +00:00
  • c36300a48c update(build): bump libs version to d6b75db133602dee81b4408902f2510275feae57 Jason Dellaluce 2022-04-21 08:15:09 +00:00
  • 120027dc2e Add constructor/destructor to stats_manager Mark Stemm 2022-04-19 11:39:58 -07:00
  • b89b3f82ee Falco main changes for app actions Mark Stemm 2022-03-23 10:01:47 -07:00
  • 1639e22462 Move most code from falco_init() to individual app actions Mark Stemm 2022-04-08 11:44:33 -07:00
  • e3b82c00e1 Copying falco.cpp to process_events.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 6e10d3d884 Copying falco.cpp to process_events.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 0daff8f829 Copying falco.cpp to open_inspector.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 5d7bed8d74 Copying falco.cpp to open_inspector.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 64b7092f56 Copying falco.cpp to daemonize.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • a9417d60df Copying falco.cpp to daemonize.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 365b97a9db Copying falco.cpp to validate_rules_files.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 70dc7360c9 Copying falco.cpp to validate_rules_files.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • b845fccc72 Copying falco.cpp to start_webserver.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • d4def892be Copying falco.cpp to start_webserver.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 6b9714eadc Copying falco.cpp to start_grpc_server.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 54ef2a2b1e Copying falco.cpp to start_grpc_server.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:52 -07:00
  • 5496741aae Copying falco.cpp to print_version.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:52 -07:00
  • c975df57a0 Copying falco.cpp to print_version.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 8634d8b3a2 Copying falco.cpp to print_support.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 4ca13bc0f0 Copying falco.cpp to print_support.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • de58872b2e Copying falco.cpp to print_ignored_events.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 2963bbab98 Copying falco.cpp to print_ignored_events.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • f5c18399e1 Copying falco.cpp to print_help.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 35261c4a3a Copying falco.cpp to print_help.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 78a297ac62 Copying falco.cpp to load_rules_files.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 9325658d5b Copying falco.cpp to load_rules_files.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 2d53fecf4b Copying falco.cpp to load_plugins.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 0f8386326e Copying falco.cpp to load_plugins.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 2e8d3c6486 Copying falco.cpp to load_config.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 444daef2f0 Copying falco.cpp to load_config.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 88b951abe2 Copying falco.cpp to list_plugins.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 4a818eeeec Copying falco.cpp to list_plugins.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 8c40b18428 Copying falco.cpp to list_fields.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:51 -07:00
  • 91a7bcae86 Copying falco.cpp to list_fields.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:50 -07:00
  • 9d9fb2538d Copying falco.cpp to init_outputs.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:50 -07:00
  • 98a2224ee5 Copying falco.cpp to init_outputs.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:50 -07:00
  • ccbc8ec196 Copying falco.cpp to init_inspector.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:50 -07:00
  • 344dc3930b Copying falco.cpp to init_inspector.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:50 -07:00
  • 431b8885b4 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:50 -07:00
  • 22674f6bf8 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:50 -07:00
  • ae7c8190d3 Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 2, restoring falco.cpp) Mark Stemm 2022-03-23 09:44:50 -07:00
  • da7efbc96e Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 1, copying file) Mark Stemm 2022-03-23 09:44:50 -07:00