{"push_id":1199979722,"size":10,"distinct_size":4,"ref":"refs/heads/event-specific-filters","head":"e3bd38222a7e9a54d02bbd1d04fd80a0aef07d77","before":"38ce14430ae946b3bf3cf12ae9a3834555a022a8","commits":[{"sha":"4a941df78788584ca8529ae0b92e850565f4ba4f","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@gmail.com"},"message":"Example showing running bash via a bad rest api.\n\nSimple docker-compose environment that starts a simple express server\nwith a poorly-designed /api/exec/<cmd> endpoint that executes arbitrary\ncommands, and uses falco to detect running bash.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/4a941df78788584ca8529ae0b92e850565f4ba4f"},{"sha":"d16bb8fd2c78b91127bb146df4fe212e048d39cc","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Merge pull request #97 from draios/nodejs-bad-rest-api\n\nExample showing running bash via a bad rest api.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/d16bb8fd2c78b91127bb146df4fe212e048d39cc"},{"sha":"502941b804ae724dc05635f0850d2c079a9e5e64","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@gmail.com"},"message":"Add list support to rules file.\n\nOnce sysdig adds support for handling \"in (...)\" filter expressions as\nset membership tests, it will be advantageous to combine lists of items\ntogether into a single list so they can all be checked in a single set\nmembership test.\n\nThis commit adds support for a new yaml item type \"list\" containing a\nfield \"name\" and field \"items\" containing a list of items. These are\nrepresented as a yaml list, which allows yaml to handle some of the\ninitial parsing with the list items maintained natively in lua.\n\nAllow lists to contain list references by expanding any references to\nthe items in the list, before storing the list items in\nstate.lists.\n\nWhen parsing macro or rule conditions, replace all references to a list\nname with the list items as a comma separated string.\n\nModify the falco rules to switch to lists whenever possible. The\nnew convention is to use the suffix _binaries for lists of program names\nand _procs for macros that define a filter expression using the list.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/502941b804ae724dc05635f0850d2c079a9e5e64"},{"sha":"3cf0dd8ab029def28149ff32be36cd25ac4fd80b","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Utilize sysdig's startswith operator.\n\nhttps://github.com/draios/sysdig/pull/623 adds support for a startswith\noperator to allow for string prefix matching. Modify the parser to\nrecognize that operator, and use that operator for rules that really\nwant to check the beginning of a pathname, directory, etc. to make them\nfaster and avoid FPs.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/3cf0dd8ab029def28149ff32be36cd25ac4fd80b"},{"sha":"022614a98d97535b8621b0b485e1f64ee1ffbdbb","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Merge pull request #100 from draios/use-startswith\n\nUtilize sysdig's startswith operator.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/022614a98d97535b8621b0b485e1f64ee1ffbdbb"},{"sha":"8225dc0762b568c7f84164c203605fbd63bb54bf","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Merge pull request #98 from draios/add-lists\n\nAdd list support to rules file.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/8225dc0762b568c7f84164c203605fbd63bb54bf"},{"sha":"839d64f3198d76f8b1b79847931887208b53ede0","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"WIP on event-specific filters.\n\nChecking in WIP towards event specific filters.\n\nInstead of combining all rules into one huge filter expression and\ngiving it to the inspector, keep each filter expression separate and\nannotate it with the events for which the rule applies.\n\nWithin the compiler, a new pass over the ast get_evttypes looks for\nevt.type clauses, converts the evt.type as a string to any event type\nids for which it may apply, and passes that back with the compiled rule.\n\nIn the rule loader, create a new global events that maps each event as a\nstring to the list of event ids for which it may apply. Also there's a\ncallback add_filter from lua which is called for each rule. In turn, it\npasses the rule and list of event ids to the inspector using\nadd_evttype_filter().\n\nThis implies a new restriction, that each rule must name an event type\nfor which the rule applies.\n\nTODO:\n\n - There are some remnants of the old parsing code left in the rule\n - loader that should be removed.\n - The string splitting within the compiler is ugly and should be\n   cleaned up.\n - not evt.type=XXX isn't handled right now.\n - or clauses combined with event conditions (evt.type=XXX or\n   evt.args=XXX) are mistakenly restricted to the event condition.\n - Should we just prevent use of syscall.type entirely? If so, we don't\n   really need the ignored syscall table.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/839d64f3198d76f8b1b79847931887208b53ede0"},{"sha":"f5bf0a8eb521af0f3adb05ed3a674260d0b4cda1","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Useful scripts to collect/display perf results.\n\nAdd shell scripts to make it easier to collect performance results from\ntraces, live tests, and phoronix tests.\n\nWith run_performance_tests.sh you specify the following:\n  - a subject program to run, using --root\n  - a name to give to this set of results, using --variant\n  - a test to run, using --test\n  - a file to write the results to, using --results.\n\nFor tests that start with \"trace\", the script runs falco/sysdig on the\ntrace file and measures the time taken to read the file. For other\ntests, he script handles starting falco/sysdig, starting a cpu\nmeasurement script (a wrapper around top, just to provide identical\nvalues to what you would see using top) to measure the cpu usage of\nfalco/sysdig, and running a live test.\n\nThe measurement interval for cpu usage depends on the test being run--10\nseconds for most tests, 2 seconds for shorter tests.\n\nThe output is written as json to the file specified in --results.\n\nAlso add R scripts to easily display the results from the shell\nscript. plot-live.r shows a linechart of the cpu usage for the provided\nvariants over time. plot-traces.r shows grouped barcharts showing\nuser/system/total time taken for the provided variants and traces.\n\nOne bug--you have to make the results file actual json by adding\nleading/trailing []s.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/f5bf0a8eb521af0f3adb05ed3a674260d0b4cda1"},{"sha":"9a97984e76e7ef2998f7f3fc662967c6910aeb20","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Don't pass along a rule_id when adding a filter.\n\nWe don't actually need to keep track of a check id for each filter\nas the filter checks are still stamped with the check id. So drop that\nargument from falco_rules::add_filter() and related calls.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/9a97984e76e7ef2998f7f3fc662967c6910aeb20"},{"sha":"e3bd38222a7e9a54d02bbd1d04fd80a0aef07d77","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Separate enter and exit events.\n\nCurrently, if a rule refers to evt.type=open, both enter and exit events\nare passed to the rule, even if the rule also explicitly specifies a\ndirection using evt.dir.\n\nMake it possible to separately handle enter vs exit events by keeping\nseparate tables of enter vs exit events. If a rule doesn't mention a\ndirection, or mentions both directions, both sets of events are\nassociated with the rule. However, if the rule does mention a direction,\nonly that direction's event ids are associated with the rule.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/e3bd38222a7e9a54d02bbd1d04fd80a0aef07d77"}]}
{"actor":{"display_login":"mstemm"}}