Commit Graph

  • 9de80b7b92 Application changes to support actions Mark Stemm 2022-03-22 14:26:02 -07:00
  • 0a51f4f1f1 Convert direct pointer refs to shared_ptr Mark Stemm 2022-03-02 17:38:22 -08:00
  • 531bc3eb5a Falco test changes (small output matches) for actions Mark Stemm 2022-03-07 13:08:56 -08:00
  • 62d4fffcb2 Add missing pragma Mark Stemm 2022-03-22 16:30:56 -07:00
  • 2c3c8b92e0 build: MUSL builds can't have plugins Leonardo Grasso 2022-04-21 18:13:04 +02:00
  • d443bcfe5f build: components opt-in mechanism for packages Leonardo Grasso 2022-04-21 17:15:12 +02:00
  • 01b407a358 build: define "plugins" component Leonardo Grasso 2022-04-21 17:10:35 +02:00
  • b4d9261ce2 build: define "falco" component Leonardo Grasso 2022-04-21 17:09:32 +02:00
  • 3300c72db0 build(cmake/modules): explicitly set libs package and driver component names Leonardo Grasso 2022-04-21 17:04:06 +02:00
  • 0bf53f0f88 refactor(userspace/engine): restrict unsafe-na-check warning to k8s audit fields Jason Dellaluce 2022-04-21 12:24:54 +00:00
  • 37d03cf7bc chore(userspace/engine): fix typo spotted with codespell Jason Dellaluce 2022-04-21 11:31:23 +00:00
  • 71274b4369 test(userspace/engine): add unit tests for filter_warning_resolver Jason Dellaluce 2022-04-21 11:13:49 +00:00
  • 95727b268f new(userspace/engine): add a resolver to generate warnings from a filter AST Jason Dellaluce 2022-04-21 11:12:35 +00:00
  • 391ab028fc refactor!: deprecate PSP regression tests Jason Dellaluce 2022-04-21 09:12:41 +00:00
  • 72eab043dc build: correct conffiles for DEB package leogr-patch-1 Leonardo Grasso 2022-04-21 18:41:42 +02:00
  • 44ac9ff24d build: correct conffiles for DEB package build/fix-conffiles Leonardo Grasso 2022-04-21 18:37:13 +02:00
  • 8dd4beac73 build(cmake): upgrade catch2 to 2.13.9 Leonardo Grasso 2022-04-21 14:15:28 +02:00
  • b080d20525 Add codespell GitHub Action Mateusz Gozdek 2022-03-29 10:52:07 +02:00
  • 1fdfbd3a3d Fix more typos Mateusz Gozdek 2022-04-16 21:23:19 +02:00
  • 53eb6112a6 add gVisor to ADOPTERS.md Kevin Krakauer 2022-04-15 15:22:57 -07:00
  • 13256fb7ef update(userspace/engine): bump engine version to 12 Jason Dellaluce 2022-04-15 10:15:37 +00:00
  • df6dced96b update(build): bump cloudtrail and json plugin versions Jason Dellaluce 2022-04-15 10:14:49 +00:00
  • d9d23cd31d update: bump libs version to b19f87e8aee663e4987a3db54570725e071ed105 Jason Dellaluce 2022-04-12 09:47:51 +00:00
  • b8a95d262f refactor(userspace/engine): polish evttype resolver and use it in rule loader Jason Dellaluce 2022-04-11 11:41:40 +00:00
  • dd3d235d7f refactor(tests): adapting test_rulesets to new method signatures Jason Dellaluce 2022-04-06 08:07:26 +00:00
  • 71ca58cebd test(userspace/engine): port unit tests for evttypes resolver from linsinsp Jason Dellaluce 2022-04-05 15:10:00 +00:00
  • b5870a8656 new(userspace/engine): add a resolver class to search evttypes from filters and event names Jason Dellaluce 2022-04-05 15:09:14 +00:00
  • f638706ba3 chore(userspace/engine): renamings and code polishing in rule_loader and rule_reader Jason Dellaluce 2022-04-14 09:21:45 +00:00
  • e1a5427874 update(userspace): add method to clear rule loader state Jason Dellaluce 2022-04-14 09:01:15 +00:00
  • 30fb58ed48 refactor(userspace/engine): update falco_engine to use new rule_reader Jason Dellaluce 2022-04-13 13:59:04 +00:00
  • 2c0e6d3b88 update(userspace/engine): introduce new rule_reader class Jason Dellaluce 2022-04-13 13:56:56 +00:00
  • 9ed7d57838 refactor(userspace/engine): reduce responsibilities of rule_loader Jason Dellaluce 2022-04-13 13:56:32 +00:00
  • af96a930eb rules(allowed_kube_namespace_image_list): add container threat detection image Clemence Saussez 2022-03-25 10:00:00 +01:00
  • 5d65671d3a rules(falco_privileged_images): add container threat detection image Clemence Saussez 2022-03-25 09:57:52 +01:00
  • d3383b4b23 Fixed ouput Rules K8s Serviceaccount Created/Deleted Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: AlbertoPellitteri <alberto.pellitteri@sysdig.com> Stefano 2022-04-14 19:54:59 +02:00
  • 65435d4418 Removed use cases not triggering Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Brucedh <alessandro.brucato@sysdig.com> Co-authored-by: AlbertoPellitteri <alberto.pellitteri@sysdig.com> Stefano 2022-04-12 22:53:58 +02:00
  • 06b6565fa6 refactor(userspace): sync falco codebase to new falco_common definitions Jason Dellaluce 2022-04-11 10:12:08 +00:00
  • 55ec8c0e1b refactor(userspace/engine): polish falco_common and improve priority parsing/formatting Jason Dellaluce 2022-04-11 10:11:22 +00:00
  • 4343fe8a8b new(rules/k8s_audit): add rules to detect pods sharing host pid and IPC namespaces Lorenzo Susini 2022-03-21 13:24:59 +00:00
  • 2934ef29b9 chore(userspace/engine): fix indentations and use improve indexed_vector Jason Dellaluce 2022-04-08 09:59:04 +00:00
  • 47426fbe0d update(userspace/engine): minor improvements and bug fixes on engine and rule loader Jason Dellaluce 2022-04-08 08:38:26 +00:00
  • e50d22f013 fix(userspace/engine): solve integration test errors Jason Dellaluce 2022-04-06 16:02:55 +00:00
  • c0f8171d89 test: adapt integration tests to new rule loader error messages Jason Dellaluce 2022-04-06 14:36:35 +00:00
  • 43020d8a7d refactor(userspace/engine): re-implement the rule loader in C++ Jason Dellaluce 2022-04-06 14:36:00 +00:00
  • d483b897e7 new(userspace/engine): create stats_manager inside falco engine Jason Dellaluce 2022-04-06 13:39:08 +00:00
  • 9e93b7cd52 new(userspace/engine): add falco_rule struct to represent rule definitions Jason Dellaluce 2022-04-06 13:17:27 +00:00
  • 6c9e6c5918 new(userspace/engine): add new indexed_vector class to achieve string-based O(1) access in vectors Jason Dellaluce 2022-04-06 13:16:32 +00:00
  • c2cac5af92 refactor(userspace/engine): add run() overload in filter_macro_resolver to support shared_ptrs Jason Dellaluce 2022-04-06 13:00:26 +00:00
  • cf83a91d4e refactor(userspace/engine): re-implement wrap_text() function in falco_utils Jason Dellaluce 2022-04-06 12:58:57 +00:00
  • 3201479392 refactor(userspace/engine): turn falco_common into a namespace containing common static utilities Jason Dellaluce 2022-04-06 12:57:23 +00:00
  • b74dcbd851 cleanup(userspace/engine): remove lua files and lua-related code sections Jason Dellaluce 2022-04-06 12:44:38 +00:00
  • 7db9dd66ff refactor(build): drop dependencies to chisels, luajit, lyaml, and libyaml Jason Dellaluce 2022-04-06 12:39:51 +00:00
  • e8cb96a57b perf: change falco_engine::process_event to lookup sources by index Angelo Puglisi 2022-03-16 17:36:56 +00:00
  • cb4cec6f57 Fix typos Mateusz Gozdek 2022-03-28 13:22:56 +02:00
  • 36bd07d82d Fix spaces Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Stefano 2022-03-25 11:03:55 +01:00
  • bcff88922a Added eks_allowed_k8s_users list to whitelist EKS users Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Alberto Pellitteri <alberto.pellitteri@sysdig.com> Stefano 2022-03-25 10:34:47 +01:00
  • 1988f3b0be Disabled by default noisy rules Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Stefano 2022-03-29 11:29:21 +02:00
  • 64f0cefab0 Update rules/okta_rules.yaml Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Thomas Labarussias <issif+github@gadz.org> schie 2022-03-23 17:03:18 +01:00
  • 48041a517b Update rules/okta_rules.yaml Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Co-authored-by: Thomas Labarussias <issif+github@gadz.org> schie 2022-03-23 17:03:11 +01:00
  • 6a1492a828 Added okta_rules.yaml Signed-off-by: darryk10<stefano.chierici@sysdig.com> Stefano 2022-03-23 14:16:53 +01:00
  • 5023851000 chore(rules): remove leftover Leonardo Grasso 2022-03-24 15:22:58 +01:00
  • ecf13762b8 test(userspace/engine): add unit test cases for filter_macro_resolver Jason Dellaluce 2022-03-18 10:09:20 +00:00
  • a0a87e443f update(userspace/engine): support undefining macros Jason Dellaluce 2022-03-17 17:35:50 +00:00
  • 20c59970f5 update(engine): rename and improve sinsp filter macro resolvers Jason Dellaluce 2022-03-01 09:35:42 +00:00
  • c801c09e7d update(test): adapt integration test error messages to comply to new parser errors Jason Dellaluce 2022-02-28 17:19:22 +00:00
  • b7db0f9b14 refactor(engine/lua): update lua rule loader to use new sinsp parser Jason Dellaluce 2022-02-28 17:18:47 +00:00
  • 2ee95122df refactor(engine): remove unused lua modules Jason Dellaluce 2022-02-28 17:16:15 +00:00
  • 911bd16556 update(engine): create a lua helper for rule filter manipulation Jason Dellaluce 2022-02-28 17:14:29 +00:00
  • 3879a283bf refactor(engine): remove dependency from lua parser Jason Dellaluce 2022-02-28 17:13:04 +00:00
  • c5818e6273 new(engine): add rule filter macro-resolver Jason Dellaluce 2022-02-28 17:11:57 +00:00
  • 0a132f453a update(cmake): remove lpeg dependency Jason Dellaluce 2022-02-28 17:07:53 +00:00
  • 26a3b7a01e refator(image): commented and moved symlinks inside SKIP_DRIVER_LOADER check Frederico Araujo 2022-03-22 11:25:25 -04:00
  • 55700f80e4 refactor(image): remove -x flag in ubi docker entrypoint Frederico Araujo 2022-03-22 11:06:52 -04:00
  • 54a817bf3c feat(image): set default value for UBI_VERSION build arg Frederico Araujo 2022-03-16 15:50:45 -04:00
  • 04cadee6fa fix(image): update package cache cleanup command Frederico Araujo 2022-03-16 15:48:33 -04:00
  • 4f5fb12a13 docs(docker/readme): updated table to include experimental UBI-based image for Falco Frederico Araujo 2022-03-16 11:53:11 -04:00
  • 5b99c0d481 refactor(build): moved Dockerfile and entrypoint script for UBI-based image to its own directory Frederico Araujo 2022-03-16 11:43:52 -04:00
  • 7c85349674 fix(docker/readme): fix grammatically incorrect split of infinitive Frederico Araujo 2022-03-16 10:57:02 -04:00
  • 9aa9ad9ee0 build(image): added label for ubi version and updated description labels Frederico Araujo 2022-03-15 14:54:21 -04:00
  • b18f2084c0 build(image): fixed handling of default falco version Frederico Araujo 2022-03-15 14:43:16 -04:00
  • dc5b332cd1 build(image): simplified untarring command to install falco binary and scripts in ubi TPT 2022-03-15 18:06:08 +00:00
  • 5b7260f706 build(image): updated UBI image to build dkms, and use falco binaries rather than rpm. This reduces dependencies. TPT 2022-03-14 20:45:06 +00:00
  • dc40f82318 build(image): added falco ubi Dockerfile to provide a falco ubi image TPT 2022-03-14 17:04:35 +00:00
  • 9607cbc2c7 update(build): temporarely bump cloudtrail and json plugin version to dev builds Jason Dellaluce 2022-03-18 14:40:44 +00:00
  • 481e32cab9 update(build): bump libs version to caa0e4d0044fdaaebab086592a97f0c7f32aeaa9 Jason Dellaluce 2022-03-18 10:11:12 +00:00
  • 98bc8703c9 Falco test changes (small output matches) for actions add-app-actions Mark Stemm 2022-03-07 13:08:56 -08:00
  • b7a92cc154 Convert direct pointer refs to shared_ptr Mark Stemm 2022-03-02 17:38:22 -08:00
  • 9e4f0888e8 Application changes to support actions Mark Stemm 2022-02-28 17:17:25 -08:00
  • db2e2b19b3 Move falco_init() code to individual app actions Mark Stemm 2022-02-28 17:15:05 -08:00
  • 481d25f8ee Falco main changes for app actions Mark Stemm 2022-02-28 17:12:22 -08:00
  • c07c327d87 Initial framework for unit tests of action manager. Mark Stemm 2022-02-08 18:00:00 -08:00
  • 149fc1e237 Initial action manager object Mark Stemm 2022-02-08 17:58:35 -08:00
  • f9a9ed984c Initial skeleton of "action" object. Mark Stemm 2022-02-07 15:42:31 -08:00
  • df219b5e1d New tests for rule + exception, macro with unknown source Mark Stemm 2022-03-01 16:48:10 -08:00
  • 3fbc90e99e Skip macros with unknown sources Mark Stemm 2022-03-01 16:47:00 -08:00
  • ad42baed7a Check for unknown sources earlier (to handle exceptions) Mark Stemm 2022-03-01 16:46:01 -08:00
  • 31111ab87b docs(README.md): update slack channel URLs Leonardo Grasso 2022-03-15 10:52:21 +01:00
  • 7d6b46218f docs(brand): add plugin definition Leonardo Grasso 2022-03-15 10:51:55 +01:00
  • fded42c203 docs(README.md): adding plugins Leonardo Grasso 2022-03-15 10:41:50 +01:00
  • 5ff9101b95 docs(README.md): moving section on top Leonardo Grasso 2022-03-15 10:20:32 +01:00