mirror of
https://github.com/falcosecurity/falco.git
synced 2026-04-03 10:32:20 +00:00
a787dc84d5
Add support for daemonizing via the --daemon flag. If daemonized, the pid is written to the file provided via the --pidfile flag. When daemonized, falco immediately returns an error if stderr output or logging was chosen on the command line. Clean up handling of outputs to match the expected use case (daemon): - syslog output is enabled by default - stdout output is disabled by default - If not configured at all, both outputs are enabled. Also fix some bugs I found while running via packages: - There were still some references to the old rules filename falco_rules.conf. - The redhat package mistakenly defined some system directories like /etc, /etc/init.d. Add them to the exclusion list (See https://cmake.org/Bug/view.php?id=13609 for context). - Clean up some of the error messages to be more consistent. After this I was able to build and install debian and rpm packages. Starting the falco service ran falco as a daemon with syslog output.
106 lines
1.6 KiB
Bash
Executable File
106 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# falco syscall monitoring agent
|
|
#
|
|
# chkconfig: 2345 55 45
|
|
# description: Falco syscall monitoring agent
|
|
#
|
|
|
|
### BEGIN INIT INFO
|
|
# Provides:
|
|
# Required-Start:
|
|
# Required-Stop:
|
|
# Should-Start:
|
|
# Should-Stop:
|
|
# Default-Start:
|
|
# Default-Stop:
|
|
# Short-Description:
|
|
# Description:
|
|
### END INIT INFO
|
|
|
|
# Source function library.
|
|
. /etc/rc.d/init.d/functions
|
|
|
|
exec="/usr/bin/falco"
|
|
prog="falco"
|
|
# config="<path to major config file>"
|
|
|
|
[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
|
|
|
|
lockfile=/var/lock/subsys/$prog
|
|
pidfile="/var/run/falco.pid"
|
|
|
|
start() {
|
|
[ -x $exec ] || exit 5
|
|
# [ -f $config ] || exit 6
|
|
echo -n $"Starting $prog: "
|
|
daemon $exec --daemon --pidfile=$pidfile
|
|
retval=$?
|
|
echo
|
|
[ $retval -eq 0 ] && touch $lockfile
|
|
return $retval
|
|
}
|
|
|
|
stop() {
|
|
echo -n $"Stopping $prog: "
|
|
killproc -p $pidfile
|
|
retval=$?
|
|
echo
|
|
[ $retval -eq 0 ] && rm -f $lockfile
|
|
return $retval
|
|
}
|
|
|
|
restart() {
|
|
stop
|
|
start
|
|
}
|
|
|
|
reload() {
|
|
restart
|
|
}
|
|
|
|
force_reload() {
|
|
restart
|
|
}
|
|
|
|
rh_status() {
|
|
status -p $pidfile $prog
|
|
}
|
|
|
|
rh_status_q() {
|
|
rh_status >/dev/null 2>&1
|
|
}
|
|
|
|
|
|
case "$1" in
|
|
start)
|
|
rh_status_q && exit 0
|
|
$1
|
|
;;
|
|
stop)
|
|
rh_status_q || exit 0
|
|
$1
|
|
;;
|
|
restart)
|
|
$1
|
|
;;
|
|
reload)
|
|
rh_status_q || exit 7
|
|
$1
|
|
;;
|
|
force-reload)
|
|
force_reload
|
|
;;
|
|
status)
|
|
rh_status
|
|
;;
|
|
condrestart|try-restart)
|
|
rh_status_q || exit 0
|
|
restart
|
|
;;
|
|
*)
|
|
echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
|
|
exit 2
|
|
esac
|
|
exit $?
|