mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-18 18:58:41 +00:00
0c3fe8a4e7
Minimally working version that can link a go program against a so with the embedded falco engine. Running the program opens the engine for syscalls and prints any output strings on alert. It assumes the device already exists and the kernel module is loaded. Also assumes the lua code is below /user/share--we'll want to bake that into the shared library. Lots of memory leaks still, the interface from go to c is still monolithic, and I had to change the config of openssl crypto and luajit to compile with -fPIC in order to link into the shared library, but this version shows its feasible.
103 lines
1.7 KiB
Go
103 lines
1.7 KiB
Go
package main
|
|
|
|
//#cgo CFLAGS: -I../
|
|
//#cgo LDFLAGS: -L/home/mstemm/work/falco-build/userspace/engine/embeddable -lfalco_engine_embeddable -Wl,-rpath=/home/mstemm/work/falco-build/userspace/engine/embeddable
|
|
/*
|
|
#include "stdio.h"
|
|
#include "falco_engine_embeddable.h"
|
|
|
|
int open_engine(void **engine, void *rules_content)
|
|
{
|
|
int32_t rc;
|
|
*engine = falco_engine_embed_init(&rc);
|
|
|
|
if (rc != 0)
|
|
{
|
|
return rc;
|
|
}
|
|
|
|
char *errstr;
|
|
rc = falco_engine_embed_load_rules_content(*engine, (const char *) rules_content, &errstr);
|
|
|
|
if (rc != 0)
|
|
{
|
|
fprintf(stderr, "%s", errstr);
|
|
return rc;
|
|
}
|
|
|
|
rc = falco_engine_embed_open(*engine, &errstr);
|
|
|
|
if (rc != 0)
|
|
{
|
|
fprintf(stderr, "%s", errstr);
|
|
return rc;
|
|
}
|
|
|
|
return rc;
|
|
}
|
|
|
|
int next_result(void *engine, char **output)
|
|
{
|
|
|
|
int32_t rc;
|
|
falco_engine_embed_result *res;
|
|
char *errstr;
|
|
|
|
rc = falco_engine_embed_next_result(engine, &res, &errstr);
|
|
|
|
if (rc != 0)
|
|
{
|
|
fprintf(stderr, "NEXT ERROR %s", errstr);
|
|
return rc;
|
|
}
|
|
|
|
*output = res->output_str;
|
|
return rc;
|
|
|
|
}
|
|
|
|
*/
|
|
import "C"
|
|
|
|
import (
|
|
"fmt"
|
|
"io/ioutil"
|
|
"os"
|
|
"unsafe"
|
|
)
|
|
|
|
func doMain(rules_filename string) int {
|
|
|
|
rules_content, err := ioutil.ReadFile(rules_filename)
|
|
if err != nil {
|
|
fmt.Printf("Could not open rules file %s: %v", rules_filename, err)
|
|
return 1
|
|
}
|
|
|
|
var handle unsafe.Pointer
|
|
rc := C.open_engine(&handle, C.CBytes(rules_content))
|
|
|
|
if rc != 0 {
|
|
fmt.Printf("Could not open falco engine")
|
|
return 1
|
|
}
|
|
|
|
for true {
|
|
var output *C.char
|
|
rc := C.next_result(handle, &output)
|
|
if rc != 0 {
|
|
fmt.Printf("Could not get next result")
|
|
return 1
|
|
}
|
|
fmt.Printf("GOT RESULT %s\n", C.GoString(output))
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
func main() {
|
|
os.Exit(doMain(os.Args[1]))
|
|
}
|
|
|
|
|