Commit Graph

  • cacbb3928d spelling: arg lists Josh Soref 2022-02-24 02:11:17 -05:00
  • 72725a7f87 spelling: archiving Josh Soref 2022-02-24 02:06:47 -05:00
  • 00c3fa4908 spelling: among Josh Soref 2022-02-24 01:47:56 -05:00
  • eabd3ad24b spelling: altogether Josh Soref 2022-02-24 01:47:56 -05:00
  • a84adbd231 spelling: allowed Josh Soref 2022-02-24 01:47:55 -05:00
  • 04ce76becc chore: bump libs to latest master e71045b Andrea Terzolo 2022-02-25 10:33:25 +01:00
  • 6dbccfcac5 new: add a new drop category n_drops_scratch_map Andrea Terzolo 2022-02-24 15:59:21 +01:00
  • bd725cb655 Add Fairwinds to ADOPTERS.md Andrew Suderman 2022-02-24 09:03:45 -07:00
  • 4d29b872ab fix(build): fix civetweb linking in cmake module Luca Guerra 2022-02-28 15:48:44 +00:00
  • dd1119374b Application changes to support actions Mark Stemm 2022-02-28 17:17:25 -08:00
  • 7b20367ae9 Move falco_init() code to individual app actions Mark Stemm 2022-02-28 17:15:05 -08:00
  • 40e018a531 Falco main changes for app actions Mark Stemm 2022-02-28 17:12:22 -08:00
  • 5c104d3f90 Initial framework for unit tests of action manager. Mark Stemm 2022-02-08 18:00:00 -08:00
  • 64722728dd Initial action manager object Mark Stemm 2022-02-08 17:58:35 -08:00
  • 16703be1f9 WIP: Initial skeleton of "action" object. Mark Stemm 2022-02-07 15:42:31 -08:00
  • f78c816abd update(build): updated libs to latest master. Federico Di Pierro 2022-02-10 13:53:51 +01:00
  • 1d76df3831 new(userspace/falco): allow to pass multiple --cri options. Federico Di Pierro 2022-02-24 11:35:50 +01:00
  • 335d79e79c chore(userspace/engine): remove unused lua functions and state vars Jason Dellaluce 2022-02-18 13:36:27 +00:00
  • ef6888181d fix(userspace/falco): correct plugins init config conversion from YAML to JSON Jason Dellaluce 2022-02-18 13:51:43 +00:00
  • d3083cde92 chore(userspace/falco): fixes truncated -b option description. Andrea Bonanno 2022-02-24 09:28:29 +01:00
  • 83353985f7 Update falco main to use falco application + cmdline_opts Mark Stemm 2022-02-02 16:10:08 -08:00
  • 83b036bc0e Small changes to falco engine/config wrt new cmdline option parsing Mark Stemm 2022-02-02 16:05:21 -08:00
  • 216f56b73b Initial falco::app::cmdline_options class Mark Stemm 2022-02-02 15:27:25 -08:00
  • 17d8eea3bc Add notion of falco application object/cmdline opts skeleton Mark Stemm 2022-02-01 15:51:48 -08:00
  • d74c8d6d4d Add cxxopts command line parsing library Mark Stemm 2022-02-01 15:43:09 -08:00
  • 888c15c6ee update(falco): updates usage description for -o, --option Andrea Bonanno 2022-02-16 13:32:05 +01:00
  • eedb794fd5 fix(userspace/falco): applies FALCO_INSTALL_CONF_FILE as the default config. Andrea Bonanno 2022-02-14 16:53:58 +01:00
  • 83c527dd91 Use cmake function to copy files, as a single target Mark Stemm 2022-02-16 17:35:36 -08:00
  • cbcc680c77 Cmake function to copy files from source to build dir, as a target Mark Stemm 2022-02-16 17:32:54 -08:00
  • ad90209177 Always skip update command for git based external projects Mark Stemm 2022-02-16 17:21:09 -08:00
  • 204f9ff875 fix(scripts): correct typo in falco-driver-loader help message Leonardo Grasso 2022-02-13 18:04:44 +01:00
  • 87c410e49e upgrade macro(keepalived_writing_conf) pablopez 2021-09-28 16:52:33 +02:00
  • b9925577ef Update rules/falco_rules.yaml schie 2022-02-02 15:59:12 +01:00
  • ae5342c54b Fixed rule condition Signed-off-by: darryk10 <stefano.chierici@sysdig.com> Stefano 2022-01-31 11:01:58 +01:00
  • 1324522721 Added new Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) Co-authored-by: javery-sysdig <jason.avery@sysdig.com> Stefano 2022-01-28 12:23:03 +01:00
  • 7999e33aea Rule Update - Adds npm support rileydakota 2022-01-24 16:36:58 -05:00
  • f49a95f334 rule(macro modify_shell_history): Fix missing s on endswith m4wh6k 2021-12-31 20:12:02 -08:00
  • 9e8687401d fix(macro truncate_shell_history): avoid false positives from .zsh_history.new and .LOCK files m4wh6k 2021-12-31 18:09:57 -08:00
  • 6ead925f51 fix(macro modify_shell_history): avoid false positives from .zsh_history.new and .LOCK files m4wh6k 2021-12-31 17:54:14 -08:00
  • 8a3a4c4d57 rule(maco write_etc_common): Fix false-positive of sssd updating /etc/krb5.keytab Mac Chaffee 2021-12-16 16:05:50 -05:00
  • ff21544186 update(build)!: replaced various PROBE with DRIVER where necessary. Federico Di Pierro 2022-02-03 12:11:56 +01:00
  • ee2f7c50e8 Potential fix for falcosecurity/falco#1884 Mike Stewart 2022-02-01 17:47:05 -04:00
  • 5da10a3b89 rule_output(Delete Bucket Public Access Block) typo pablopez 2022-02-03 13:22:39 +01:00
  • cdd4f51db0 Better fix for falco tests after rebase add-grpc-rules-loading Mark Stemm 2022-01-31 11:55:11 -08:00
  • 1b112d752a Fixing falco tests after rebase Mark Stemm 2022-01-31 11:49:20 -08:00
  • eb86768dfb Fixing falco bugs after rebase Mark Stemm 2022-01-31 11:49:04 -08:00
  • b55df884ef falco_engine fix typos Mark Stemm 2022-01-28 16:01:44 -08:00
  • debcb1e729 Update test output matches to match new aligned code Mark Stemm 2022-01-28 15:51:39 -08:00
  • 9f88c7cbd0 Falco cleanups. this should pass all tests Mark Stemm 2022-01-28 15:50:43 -08:00
  • 946a431e55 swappable falco engine cleanups. this should pass all tests Mark Stemm 2022-01-28 15:50:23 -08:00
  • 7e37fc8210 Rules loading cleanups. This version should pass all tests Mark Stemm 2022-01-28 15:49:49 -08:00
  • 1ed2bec4d7 Remove temp debug logs (falco_engine) Mark Stemm 2022-01-28 15:49:14 -08:00
  • cc4332c8ce More falco_engine cleanups. this should pass all tests Mark Stemm 2022-01-28 15:47:26 -08:00
  • c648f2fcfd falco cleanups. this passes most tests Mark Stemm 2022-01-25 17:10:28 -08:00
  • 03d826d249 swappable falco engine cleanups. this passes mosts tests Mark Stemm 2022-01-25 17:10:04 -08:00
  • 83fe8d649a Rules loading cleanups. This passes mosts tests Mark Stemm 2022-01-25 17:09:40 -08:00
  • 4356307412 falco_engine cleanups. this passes most tests Mark Stemm 2022-01-25 17:09:16 -08:00
  • d338185524 Move validation to after swengine init Mark Stemm 2022-01-14 15:33:29 -08:00
  • 54dea70482 This version builds Mark Stemm 2022-01-14 14:13:53 -08:00
  • 08a67b77d6 This version builds Mark Stemm 2022-01-14 14:13:34 -08:00
  • 22e6205921 Add grpc methods to reload/validate rules files Mark Stemm 2022-01-11 13:39:10 -08:00
  • 91ee079ea6 Use swappable_falco_engine to hold falco engine Mark Stemm 2022-01-11 13:36:51 -08:00
  • 4cc05d6f4a Add a notion for a swappable falco engine Mark Stemm 2022-01-11 13:31:15 -08:00
  • 06b7427ede Move falco formats code out of engine Mark Stemm 2022-01-11 13:29:26 -08:00
  • f86423db76 fix(build): fixed build folder path for publish bin static. 0.31.0 Federico Di Pierro 2022-01-31 16:12:13 +01:00
  • 5eed3a6638 fix(build): hotfix for release 0.31.0. Federico Di Pierro 2022-01-31 15:55:40 +01:00
  • d585343483 docs(CHANGELOG.md): last update Leonardo Grasso 2022-01-31 12:56:00 +01:00
  • 9e57b5b4ba docs(changelog.md): update for release 0.31.0 Teryl 2022-01-28 15:17:26 +00:00
  • 47f38c8ae2 chore(build): dropped centos8 circleci build because it is useless and right now it is causing issues with yum. Federico Di Pierro 2022-01-31 12:06:00 +01:00
  • 332d828204 update(userspace/engine): properly value required_version because it is used by caller. Federico Di Pierro 2022-01-28 14:51:44 +01:00
  • 75c6cfb414 update(userpace/engine): properly implement semver check for required plugin versions. Federico Di Pierro 2022-01-28 14:28:54 +01:00
  • a4199814a0 fix(tests/engine): correct unit tests Leonardo Grasso 2022-01-28 13:00:43 +01:00
  • 24e7e84153 update(rules): updated aws cloudtrail rule bumping plugins version Leonardo Grasso 2022-01-28 12:55:19 +01:00
  • 70bfb2426c fix(userspace/engine): forcefully set PPME_PLUGINEVENT_E event type for "plugin" source events. Federico Di Pierro 2022-01-28 12:40:26 +01:00
  • ce3598f801 update(plugins): updated json plugin to latest v0.2.2. Federico Di Pierro 2022-01-27 16:41:16 +01:00
  • 8e6ffc6fc9 fix(userspace/engine): actually make m_filter_all_event_types useful by properly using it as fallback when no filter event types is provided. Federico Di Pierro 2022-01-27 14:08:46 +01:00
  • 1df80fd94b Escape double-quotes in aws cloudtrail rule fix-plugins-issue-56 Mark Stemm 2022-01-26 15:38:55 -08:00
  • 6a42f4a133 new(build): publish both static and glibc binaries Luca Guerra 2022-01-26 14:20:43 +00:00
  • 8d9dd4440f chore(userspace/engine): cleanup unused alternate-lua-dir option and remove config_falco_engine.h.in, now unused since lua scripts are embedded in Falco. Federico Di Pierro 2022-01-26 14:47:56 +01:00
  • c49093005d fix(build): do not include plugins in musl builds Luca Guerra 2022-01-26 13:54:48 +00:00
  • 69767bb51b fix(build): do not show plugin options in musl optimized builds Luca Guerra 2022-01-26 13:47:24 +00:00
  • 7750b6f209 rule: update Copyright in falco rules Andrea Terzolo 2022-01-25 16:42:02 +00:00
  • 8c705448cc rule: add execveat as evt.type for spawned_process macro in falco rules Andrea Terzolo 2022-01-25 16:23:19 +00:00
  • 6b9fafb75f rule update(Sudo Potential Privilege Escalation): trigger the most common CVE-2021-3156 exploit Signed-off-by: Shay Berkovich <sberkovich@blackberry.com> Co-authored-by: Meera Balsara <mbalsara@blackberry.com> Shay Berkovich 2021-10-13 11:28:55 +03:00
  • fdcd7bffd0 rule update(Detect crypto miners using the Stratum protocol): update protocols Signed-off-by: Shay Berkovich <Sberkovich@blackberry.com> Co-authored-by: Meera Balsara <mbalsara@blackberry.com> Shay Berkovich 2021-10-13 11:13:49 +03:00
  • d989e9c2d5 new(rules): Create Hardlink Over Sensitive Files New rule to prevent hardlink bypass and symlink rule set to WARNING for consistency Signed-off-by: Shay Berkovich <sberkovich@blackberry.com> Co-authored-by: Meera Balsara <mbalsara@blackberry.com> Shay Berkovich 2021-10-13 10:41:52 +03:00
  • 996ccf555c rule: updated aws_cloudtrail_rules with correct copyright year and required plugin versions. Federico Di Pierro 2022-01-25 17:12:49 +01:00
  • 2f82a9baa1 Update userspace/falco/falco.cpp Federico Di Pierro 2022-01-24 17:16:43 +01:00
  • dfb743838e Update userspace/engine/rules.cpp Federico Di Pierro 2022-01-24 17:16:18 +01:00
  • c7609192c7 Update userspace/engine/lua/rule_loader.lua Federico Di Pierro 2022-01-24 17:15:21 +01:00
  • 4d3fc354fa update(userspace/engine): updated no evt.type specified lua warning string. Federico Di Pierro 2022-01-24 15:55:43 +01:00
  • 43bdfce6e5 update(userspace/falco): divide each plugin infos when dumping list of plugin with a newline. Federico Di Pierro 2022-01-24 15:29:16 +01:00
  • a3976463d5 update(userspace/engine): fixed lua CMakeLists deps, to let it be gracefully rebuilt when lua files are updated. Federico Di Pierro 2022-01-24 15:02:26 +01:00
  • 1a485c3447 update(userspace/engine,userspace/falco): improved some string warnings. Federico Di Pierro 2022-01-24 15:01:10 +01:00
  • 96529300f6 fix(script/falco-driver-loader): fix typo Leonardo Grasso 2022-01-22 09:36:21 +01:00
  • 27922faa27 fix(scripts/falco-driver-loader): missing compression formats for .ko files Leonardo Grasso 2022-01-22 09:34:32 +01:00
  • 8a1de131f4 update(scripts/falco-driver-loader): load the latest version first Leonardo Grasso 2022-01-21 23:04:32 +01:00
  • e1e8715a0f build: updated cloudtrail plugin to latest version. Federico Di Pierro 2022-01-24 15:35:31 +01:00
  • 9ae8d281f5 fix(test): falco_hostnetwork_images list is now in k8s_audit_rules.yaml Leonardo Grasso 2022-01-24 14:16:35 +01:00
  • c705623f9e update(rules): move falco_hostnetwork_images list to k8s audit rules Leonardo Di Donato 2021-06-23 18:41:02 +02:00