Commit Graph

  • a66dda3daa test(userspace/engine): update integration tests to support enabled-only rules Jason Dellaluce 2021-11-15 18:38:41 +00:00
  • eec2f5062f update(userspace/engine): allow overwriting rules with enabled flag only Jason Dellaluce 2021-11-15 18:36:38 +00:00
  • 7dcf8f4bf7 update(userspace/engine): use s_ prefix for static var. Federico Di Pierro 2021-11-15 10:08:04 +01:00
  • bea91ca844 fix(userspace/engine): properly constify m_default_ruleset. Federico Di Pierro 2021-10-13 12:41:48 +02:00
  • ea2ca56d5b style(userspace/engine): avoid creating multiple versions of methods only to assume default ruleset. Use a default argument instead. Federico Di Pierro 2021-10-13 12:17:36 +02:00
  • cb51522423 Skip plugins list/load/tests for MUSL_OPTIMIZED_BUILD Mark Stemm 2021-11-03 14:53:54 -07:00
  • 9f53089bcb Detect strlcpy on the fly (musl libc) Mark Stemm 2021-11-02 15:21:38 -07:00
  • 2a4e4d555d Add automated tests for plugins Mark Stemm 2021-10-26 17:08:33 -07:00
  • 6a1f4f7374 Plugins support in falco executable Mark Stemm 2021-10-15 16:48:51 -07:00
  • 98599d5e25 Plugins support (outputs) Mark Stemm 2021-10-15 16:47:14 -07:00
  • e7d41f8166 Rules loading changes for plugins Mark Stemm 2021-10-15 16:42:55 -07:00
  • 9075eea62f Falco engine support for plugins Mark Stemm 2021-10-15 16:36:30 -07:00
  • 69e32f7ed1 Add initial set of Cloudtrail rules Mark Stemm 2021-10-15 16:35:06 -07:00
  • 38a7f7ada0 cmake/build changes for plugins Mark Stemm 2021-10-15 16:33:12 -07:00
  • 6a4e4eaa4f Finish moving token bucket impl from falco to libs Mark Stemm 2021-10-15 16:31:25 -07:00
  • 1313e77113 Falco yaml config for plugins Mark Stemm 2021-10-15 16:28:09 -07:00
  • a1fa8edf7e Update falcosecurity/libs version Mark Stemm 2021-10-15 16:23:42 -07:00
  • d4aa7b9747 build: always populate partial version variables Dominic Evans 2021-11-09 13:12:43 +00:00
  • 2312afe9cd Set digest-algo for gpg to use SHA256 for linux packages. Manuel Gauto 2021-10-18 16:20:23 -04:00
  • 6ee0b353ac test: adding a test for correct json pointer parsing Jason Dellaluce 2021-11-10 10:02:24 +00:00
  • 28d6a293fc update(userspace/engine): support jsonpointer escaping in rule parser Jason Dellaluce 2021-11-09 11:00:23 +00:00
  • 5ee62f66f7 adding raft in the adopters list Hitesh Sharma 2021-11-08 14:46:27 -05:00
  • b33fb6052a Update ubuntu image for driver-loader tests (20.04LTS) Mark Stemm 2021-10-25 13:33:07 -07:00
  • 8448d02980 falco-driver-loader: don't fail if chcon is missing in load_kernel_module() David Windsor 2021-10-19 08:12:25 -04:00
  • 74661a7d8f Apply suggestions from code review David Windsor 2021-10-19 07:55:15 -04:00
  • e7b320b00c Fix falco-driver-loader SELinux insmod denials David Windsor 2021-10-13 13:03:16 -04:00
  • 762500a361 add known k8s service accounts Sverre Boschman 2021-10-19 14:35:49 +02:00
  • 8563af8a79 reformat known_sa_list Sverre Boschman 2021-10-19 14:25:41 +02:00
  • f7893fbd14 Change expected result for old trace file with old execve event num Mark Stemm 2021-10-11 16:24:40 -07:00
  • 3b390793b9 Fix bug in macro that was masked by old evttype checking Mark Stemm 2021-10-04 17:31:25 -07:00
  • 10d47cb1f5 Update automated tests to reflect evttypes behavior Mark Stemm 2021-10-04 17:29:06 -07:00
  • 204892816b Update falco engine checksum Mark Stemm 2021-10-04 11:37:56 -07:00
  • 6156fbb4cb Update falcosecurity-libs cmake revision Mark Stemm 2021-10-04 10:56:50 -07:00
  • 20b5ea8f85 Check for ignored syscall event types after loading rules Mark Stemm 2021-08-26 11:16:38 -07:00
  • cc43c721c9 Add a default ruleset version of evttypes_for_ruleset Mark Stemm 2021-08-26 11:10:43 -07:00
  • 230c22b674 Update lua rule loading to reflect other changes Mark Stemm 2021-08-26 11:01:44 -07:00
  • 04f3cc503c Add ability to check if field is defined Mark Stemm 2021-08-25 17:58:54 -07:00
  • 84d7020e3e Use the new falco engine interface w/ generic events Mark Stemm 2021-08-25 17:27:12 -07:00
  • 0cae713412 Use new outputs interface with engine Mark Stemm 2021-08-25 17:26:08 -07:00
  • bbbac6203c Update rules loader to be general purpose, through factories Mark Stemm 2021-08-25 17:17:52 -07:00
  • 8275730bf8 Use factories to provide filters/formatting Mark Stemm 2021-08-25 17:16:17 -07:00
  • de4b2fa831 Make json_event_formatter a gen_event_formatter Mark Stemm 2021-08-25 17:02:53 -07:00
  • 943a37fcf7 General-purpose list_fields(), via factories Mark Stemm 2021-08-25 16:48:02 -07:00
  • 3202921355 falco_formats only formats events now, no lua bindings Mark Stemm 2021-08-25 16:27:05 -07:00
  • 1c60dab87e Move json -> k8s audit event conversion out of falco engine Mark Stemm 2021-08-25 16:20:24 -07:00
  • 044a7c153e Don't track event "tags" i.e. event types in rulesets Mark Stemm 2021-08-25 16:03:24 -07:00
  • 1f7024189c Disable plugins download for now new/plugin-system-api-additions-prerebase Mark Stemm 2021-10-08 16:44:01 -07:00
  • a0f7d7cf85 update(adopters.md): add falco libs users section Frederico Araujo 2021-10-06 20:56:21 -04:00
  • 8a9b7dfcfa Squash w/ prior commit Mark Stemm 2021-10-06 15:27:13 -07:00
  • 635c413c5f Update default falco config for plugins Mark Stemm 2021-10-06 09:44:15 -07:00
  • 797b861fbc Change config handling for load_plugins Mark Stemm 2021-10-06 09:42:27 -07:00
  • f4182707e9 Add plugins to falco build/package Mark Stemm 2021-10-06 09:37:03 -07:00
  • fce2b925f0 Add initial set of Cloudtrail rules Mark Stemm 2021-10-01 15:49:28 -07:00
  • fc4cfa04b7 Merge branch 'new/plugin-system-api-additions' of https://github.com/leogr/falco into new/plugin-system-api-additions Mark Stemm 2021-09-30 15:24:46 -07:00
  • e580d042ac Bump falco engine version (plugins support) Mark Stemm 2021-09-30 15:22:43 -07:00
  • bb81133201 docs(changelog.md): update for release 0.30.0 0.30.0 Frederico Araujo 2021-09-29 20:34:24 -04:00
  • 46d5266ac8 build(cmake): bump libs version to 3aa7a83 Michele Zuccala 2021-09-29 14:59:22 +00:00
  • 3414ca5361 update(proposal): clarify that old drivers are not removed anymore Leo Di Donato 2021-09-28 15:08:14 +02:00
  • 0eb170cf5f update(test): enhance test cases for tags in json outputs Jason Dellaluce 2021-09-23 07:21:11 +00:00
  • 21fa6e9505 update(outputs): make tags configurable in json output Jason Dellaluce 2021-09-23 07:15:14 +00:00
  • b82cbb1b59 build(cmake): bump libs version to 5727c45 Michele Zuccala 2021-09-23 15:00:33 +00:00
  • d3be537f7e Update to use latest version of falcosecurity/libs Mark Stemm 2021-09-23 14:44:19 -07:00
  • d033868ab9 falso.service: set StandardOutput to null Domenico Chirabino 2021-07-19 15:34:50 +02:00
  • 7c98d0047c update(outputs): fixing spacing issue Jason Dellaluce 2021-09-15 15:30:08 +00:00
  • c7d9b6ee7f test(outputs): add source and tags to json output Jason Dellaluce 2021-08-31 16:30:13 +00:00
  • 8273e57598 new(outputs): add source and tags to json output Jason Dellaluce 2021-08-31 15:51:16 +00:00
  • b0562242e8 test(grpc): Test tags on outputs service Jason Dellaluce 2021-08-26 11:01:38 +00:00
  • ca66b84e5a new(grpc): Add tags to outputs service Jason Dellaluce 2021-08-26 10:56:04 +00:00
  • 7c9ec9fc17 fix bugs spartan 2021-08-30 11:25:04 +08:00
  • 9ea43c2663 update(test): check output order in output_strictly_contains Jason Dellaluce 2021-09-10 16:29:02 +00:00
  • 4d55847bd4 fix(test): avoid output_strictly_contains failures Jason Dellaluce 2021-09-08 08:25:41 +00:00
  • a684bec007 update(userspace/falco): throw logic errors on invalid config values for metadata download Michele Zuccala 2021-07-09 10:16:55 +00:00
  • 812aa9b566 new(userspace/falco): add customizable metadata fetching params Michele Zuccala 2021-07-08 15:42:02 +00:00
  • e0f8b81692 Remove duplicate allowed ecr registry rule Tom Keyte 2021-09-09 12:55:45 +01:00
  • 874809351f rules(list https_miner_domains): fix typo in the list Alberto Pellitteri 2021-09-15 19:48:16 +02:00
  • 4527228ef8 rules(list https_miner_domains): add new miner domains Alberto Pellitteri 2021-09-15 14:55:06 +02:00
  • e684c95e23 rules(list miner_domains): add new miner domains Alberto Pellitteri 2021-09-15 14:52:38 +02:00
  • 2390ca447a new: ability to filter by a node when fetching K8S metadata Leonardo Grasso 2021-06-09 16:38:07 +02:00
  • af0e6da375 build(cmake/modules): upgrade driver version to f7029e Leonardo Grasso 2021-06-09 16:37:54 +02:00
  • 84e7d3f18f Switching from stable to old-stable (buster). Michal Schott 2021-09-01 10:19:27 +02:00
  • 2a8c0e8bb7 add Qonto as adopter Thomas Labarussias 2021-08-30 11:10:53 +02:00
  • f28688551c fix(build): adapt to new debian 11 package names Michele Zuccala 2021-08-25 08:16:36 +00:00
  • b12d37a3b8 docs(RELEASE.md): switch to 3 releases per year Leonardo Grasso 2021-08-20 14:21:41 +02:00
  • 5e027c7fe2 Proposal for a libs plugin system Loris Degioanni 2021-05-02 11:46:10 -07:00
  • 849fb98bc2 Update to latest falcosecurity/libs Mark Stemm 2021-08-17 15:25:24 -07:00
  • 0c3fe8a4e7 This version works embeddable-falco-engine Mark Stemm 2021-08-11 13:16:29 -07:00
  • 5787dfa098 Update libs version Mark Stemm 2021-08-11 13:15:37 -07:00
  • 2434942bdc Example program using embed engine Mark Stemm 2021-08-10 16:59:29 -07:00
  • 2f7b72d670 Add to cmake Mark Stemm 2021-08-10 16:59:06 -07:00
  • 50e8da1049 Fix compile errors Mark Stemm 2021-08-10 16:57:44 -07:00
  • 5c398bd396 Embeddable falco engine experiments Mark Stemm 2021-08-09 14:51:33 -05:00
  • c1d1fafade Update to latest falcosecurity libs Mark Stemm 2021-08-04 16:55:02 -05:00
  • 2aaee02d65 Only set inputs for source plugins/one plugin at a time Mark Stemm 2021-08-04 15:53:11 -05:00
  • efbe887d6e docs: CHANGELOG for 0.29.1 cleanup Leo Di Donato 2021-07-01 17:50:55 +02:00
  • 7dcbeb1f44 build(.circleci): ncurses is not required anymore Leonardo Grasso 2021-05-24 16:14:05 +02:00
  • 93667f2d3e build(docker/builder): ncurses-dev is not required anymore Leonardo Grasso 2021-05-24 16:12:17 +02:00
  • 8ac6ea732e Add plugin version compat w/ rules files Mark Stemm 2021-07-27 13:34:03 -05:00
  • 3c1b47c8d2 chore(cmake/modules): libscap.patch is no longer needed build/apply-libs-pr-41 Leonardo Grasso 2021-07-22 12:38:03 +02:00
  • 7af263651e wip: switch libs to refactor/naming branch Leonardo Grasso 2021-07-22 12:37:35 +02:00
  • 458e0b86cb wip: build: upgrade driver version build/upgrade-deps-mid2021 build/upgrade-driver-version-mid2021 Leonardo Grasso 2021-07-15 15:33:51 +02:00