cncf-falco-dev@lists.cncf.io | What happened in Falco this week? Dec. 16, 2022

Home Messages Hashtags Subgroups

Date Date 1 - 1 of 1

What happened in Falco this week? Dec. 16, 2022

Jacque Salinas #408 Repost from Slack We skipped last week due to some regional holidays! Here is the last update of the year. A big thank you to Federico for helping coordinate this every week. What happened in Falco this week? Libs: lots of small bugfixes happened, nearing the 0.10.0 and 4.0.0+driver tag (that should come today :wink: ) a small, yet possible dangling pointer dereference has been fixed: https://github.com/falcosecurity/libs/pull/773 fixes in fork and vfork modern bpf fillers: https://github.com/falcosecurity/libs/pull/779 number of attempts to retrieve CRI containers info has been increased: https://github.com/falcosecurity/libs/pull/780 bpf and modern bpf code optimizations! https://github.com/falcosecurity/libs/pull/784 allow to build modenr bpf skeleton on a different machine and then include it inside another build flow: https://github.com/falcosecurity/libs/pull/775 properly implemented PT_ABSTIME formatter for events in libsinsp: https://github.com/falcosecurity/libs/pull/789 some small improvements to scap test engine: https://github.com/falcosecurity/libs/pull/795 manage not bundled libelf dep; this allows to build BUNDLED libbpf against a system libelf! https://github.com/falcosecurity/libs/pull/791 Moreover, Falco has seen multiple PRs merged too! falco-driver-loader does now support old rhel systems: https://github.com/falcosecurity/falco/pull/2312 a fix for the development Falco version retrieval was finally implemented https://github.com/falcosecurity/falco/pull/2292 graceful error handling for macros/lists reference loops :loop: https://github.com/falcosecurity/falco/pull/2311 the artifact distribution proposal has been merged! https://github.com/falcosecurity/falco/pull/2304 Falco CI has seen some cleanups: https://github.com/falcosecurity/falco/pull/2322 https://github.com/falcosecurity/falco/pull/2324 systemd units improvement has finally landed! https://github.com/falcosecurity/falco/pull/2242 users can now customize curl options when running falco-driver-loader: https://github.com/falcosecurity/falco/pull/1901 And, rules too have seen some improvements!! enhanced rules tagging for inventory/threat modeling: https://github.com/falcosecurity/falco/pull/2167 added openSSH private keys to `private_key_or_password macro: https://github.com/falcosecurity/falco/pull/2284 enhancements to outbound connection to c2 servers https://github.com/falcosecurity/falco/pull/2241 Falcoctl is steadily growing and improving! new artifact --follow command! This is the much needed way to track artifact updates! https://github.com/falcosecurity/falcoctl/pull/189 some more small fixes and improvements here and there :smile: Let's take a peek at what we will probably see during the first few days of the 2023! More rules for Falco! https://github.com/falcosecurity/falco/pull/2224, https://github.com/falcosecurity/falco/pull/2225, https://github.com/falcosecurity/falco/pull/2290 modern-bpf probe finally merged into Falco! https://github.com/falcosecurity/falco/pull/2320 BottlerocketOS support from kernel-crawler down to falco-driver-loader! https://github.com/falcosecurity/kernel-crawler/pull/79, https://github.com/falcosecurity/falco/pull/2318, https://github.com/falcosecurity/driverkit/pull/239 improved --support and --version Falco output: https://github.com/falcosecurity/falco/pull/2325 more modern-bpf syscalls! https://github.com/falcosecurity/libs/pull/797, https://github.com/falcosecurity/libs/pull/778, https://github.com/falcosecurity/libs/pull/776, https://github.com/falcosecurity/libs/pull/752 Currently, modern-bpf has a testing framework that tests behavior of each implemented filler (this is an incredibly great work by @Andrea Terzolo. BTW...Andrea was not satisfied with just that, therefore he opened a new PR to port the current framework to work with all drivers!! https://github.com/falcosecurity/libs/pull/783 (look at the PR diff stats: +2,739 −2,327 WTF. Ok, he will probably split this into multiple smaller PRs, yet it's astonishing work! More cleanups coming to libscap https://github.com/falcosecurity/libs/pull/787, https://github.com/falcosecurity/libs/pull/769, https://github.com/falcosecurity/libs/pull/759 New filters container.ip and container.ips_cniresult_interfaces: https://github.com/falcosecurity/libs/pull/708 fixes to the async_key_value_source used by async container engines: https://github.com/falcosecurity/libs/pull/786 Allow users to enable/disable container engines on startup: https://github.com/falcosecurity/libs/pull/772 Fixes to CRI image metadata fetching: https://github.com/falcosecurity/libs/pull/771 Fixes for podman: https://github.com/falcosecurity/libs/pull/763 As you can see, it will be a pretty busy road to Falco 0.34 and 0.35 Remember: you can actively participate in these PRs; you don't need to code anything (even if it is highly appreciated!); you can just chime in and leave your comment/ideas/use case! In the meantime, let me wish you all a great 2023!!! See you next year! -- Jacqueline Salinas Director of Open Source Ecosystem
More All Messages By This Member

1 - 1 of 1

1

Previous Topic Next Topic

Home Hashtags Subgroups Terms