mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-09 18:17:57 +00:00
7a684fdf13
There are systems, like Nix derivations where the build process does not have network access in order to enforce reproducibility. This patch allows people building Falco to optionally skip the build of falcoctl with `-DADD_FALCOCTL_DEPENDENCY=OFF` and point to their own self-backed, or pre-fetched rules files with `-DFALCOSECURITY_RULES_FALCO_PATH=<some-path>` and `-DFALCOSECURITY_RULES_LOCAL_PATH=<some-path>`. For context, I needed to apply these patches while building the project with Nix in https://github.com/tembleking/falco-nix but I think that would be benefitial for the community to have also these options open, and that would also make Falco feasible to be added to the nixpkgs repository at https://github.com/nixos/nixpkgs Signed-off-by: Fede Barcelona <fede_rico_94@hotmail.com>
80 lines
2.8 KiB
CMake
80 lines
2.8 KiB
CMake
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Copyright (C) 2024 The Falco Authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
|
|
# the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
#
|
|
|
|
include(GNUInstallDirs)
|
|
include(ExternalProject)
|
|
|
|
if(NOT DEFINED FALCOSECURITY_RULES_FALCO_PATH)
|
|
# falco_rules.yaml
|
|
set(FALCOSECURITY_RULES_FALCO_VERSION "falco-rules-3.1.0")
|
|
set(FALCOSECURITY_RULES_FALCO_CHECKSUM "SHA256=3b617920c0b66128627613e591a954eb9572747a4c287bc13b53b38786250162")
|
|
set(FALCOSECURITY_RULES_FALCO_PATH "${PROJECT_BINARY_DIR}/falcosecurity-rules-falco-prefix/src/falcosecurity-rules-falco/falco_rules.yaml")
|
|
ExternalProject_Add(
|
|
falcosecurity-rules-falco
|
|
URL "https://download.falco.org/rules/${FALCOSECURITY_RULES_FALCO_VERSION}.tar.gz"
|
|
URL_HASH "${FALCOSECURITY_RULES_FALCO_CHECKSUM}"
|
|
CONFIGURE_COMMAND ""
|
|
BUILD_COMMAND ""
|
|
INSTALL_COMMAND ""
|
|
TEST_COMMAND ""
|
|
)
|
|
endif()
|
|
|
|
if(NOT DEFINED FALCOSECURITY_RULES_LOCAL_PATH)
|
|
# falco_rules.local.yaml
|
|
set(FALCOSECURITY_RULES_LOCAL_PATH "${PROJECT_BINARY_DIR}/falcosecurity-rules-local-prefix/falco_rules.local.yaml")
|
|
file(WRITE "${FALCOSECURITY_RULES_LOCAL_PATH}" "# Your custom rules!\n")
|
|
endif()
|
|
|
|
if(NOT DEFINED FALCO_ETC_DIR)
|
|
set(FALCO_ETC_DIR "${CMAKE_INSTALL_FULL_SYSCONFDIR}/falco")
|
|
endif()
|
|
|
|
if(WIN32 OR APPLE)
|
|
set(FALCO_ETC_DIR "etc/falco")
|
|
endif()
|
|
|
|
if(NOT DEFINED FALCO_RULES_DEST_FILENAME)
|
|
set(FALCO_RULES_DEST_FILENAME "falco_rules.yaml")
|
|
set(FALCO_LOCAL_RULES_DEST_FILENAME "falco_rules.local.yaml")
|
|
endif()
|
|
|
|
if(DEFINED FALCO_COMPONENT) # Allow a slim version of Falco to be embedded in other projects, intentionally *not* installing all rulesets.
|
|
install(
|
|
FILES "${FALCOSECURITY_RULES_FALCO_PATH}"
|
|
COMPONENT "${FALCO_COMPONENT}"
|
|
DESTINATION "${FALCO_ETC_DIR}"
|
|
RENAME "${FALCO_RULES_DEST_FILENAME}")
|
|
|
|
install(
|
|
FILES "${FALCOSECURITY_RULES_LOCAL_PATH}"
|
|
COMPONENT "${FALCO_COMPONENT}"
|
|
DESTINATION "${FALCO_ETC_DIR}"
|
|
RENAME "${FALCO_LOCAL_RULES_DEST_FILENAME}")
|
|
else() # Default Falco installation
|
|
install(
|
|
FILES "${FALCOSECURITY_RULES_FALCO_PATH}"
|
|
DESTINATION "${FALCO_ETC_DIR}"
|
|
RENAME "${FALCO_RULES_DEST_FILENAME}"
|
|
COMPONENT "${FALCO_COMPONENT_NAME}")
|
|
|
|
install(
|
|
FILES "${FALCOSECURITY_RULES_LOCAL_PATH}"
|
|
DESTINATION "${FALCO_ETC_DIR}"
|
|
RENAME "${FALCO_LOCAL_RULES_DEST_FILENAME}"
|
|
COMPONENT "${FALCO_COMPONENT_NAME}")
|
|
|
|
install(DIRECTORY DESTINATION "${FALCO_ETC_DIR}/rules.d" COMPONENT "${FALCO_COMPONENT_NAME}")
|
|
endif()
|