{"push_id":1470186324,"size":27,"distinct_size":1,"ref":"refs/heads/master","head":"e00181d553484cfdb5210981ff293b985bf20135","before":"94fcc5399e631e8a646be048be64247e877465e6","commits":[{"sha":"858a69bb2c2d294b060b8b92e728e6938a4e0828","author":{"name":"Carl Sverre","email":"bcfad97a2ece4e8bdf6562419451aafa0af31073@carlsverre.com"},"message":"Added envvar SYSDIG_SKIP_LOAD to Dockerfile to skip kernel module manipulation\n\nThis helps when running on a system which has the module loaded, but getting\naccess to the module file is hard for some reason.  Since I know that the right\nversion of the module is loaded I just want falco to connect.\n\nI tested this with this run command:\n\ndocker run -e SYSDIG_SKIP_LOAD=1 -it -v /dev:/host/dev -v /proc:/host/proc --privileged falco\n\nAnd it successfully connected to Sysdig and started printing out warnings for my\nsystem.\n\nfalco-CLA-1.0-signed-off-by: Carl Sverre accounts@carlsverre.com","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/858a69bb2c2d294b060b8b92e728e6938a4e0828"},{"sha":"349372d7335b487019a16421e18cdaf709dc577e","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Honor USE_BUNDLED_DEPS option for third-party libs\n\nHonor a USE_BUNDLED_DEPS option for third-party libraries which can be\napplied globally. There are also USE_BUNDLED_XXX options that can be\nused individually for each library.\n\nVerified that this works by first building with USE_BUNDLED_DEPS=ON (the\ndefault), installing external packages ncurses-dev libssl-dev\nlibcurl4-openssl-dev so CMake's find_package could use them, modifying\nthe CMakeLists.txt to add \"PATHS ${PROJECT_BINARY_DIR}/...\" options to\neach find_path()/find_library() command to point to the previously\ninstalled third party libraries. It found them as expected.\n\nThe sysdig fix in https://github.com/draios/sysdig/pull/672 forced this\nchange, but it does also happen to fix a falco feature request\nhttps://github.com/draios/falco/issues/144.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/349372d7335b487019a16421e18cdaf709dc577e"},{"sha":"882c6c94ea3d2f817eee5bd72aa83209357587af","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Fully specify FALCO_SHARE_DIR.\n\nInstead of having FALCO_SHARE_DIR be a relative path, fully specify it\nby prepending CMAKE_INSTALL_PREFIX in the top level CMakeLists.txt and\ndon't prepend CMAKE_INSTALL_PREFIX in config_falco_engine.h.in. This\nmakes it consistent with its use in the agent.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/882c6c94ea3d2f817eee5bd72aa83209357587af"},{"sha":"14c9d05f9ff7db308b09bd5ad46b3f3990969ad3","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Improve error messages when loading rules.\n\nRelated to the changes in https://github.com/draios/agent/pull/267,\nimprove error messages when trying to load sets of rules with errors:\n\n - Check that yaml parsing of rules_content actually resulted in\n   something.\n - Return an error for rules that have an empty name.\n - Return an error for yaml objects that aren't a rule/macro/list.\n - When compiling, don't print an error message, simply return one,\n   including a wrapper \"can not compile ...\" string.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/14c9d05f9ff7db308b09bd5ad46b3f3990969ad3"},{"sha":"c6c074ef6057d4a215cea575740058a72a743e6a","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Allow run_performance_tests to run test_mm.\n\nMake necessary changes to allow run_performance_tests to invoke the\n'test_mm' program we use internally.\n\nAlso add ability to run with a build directory separate from the source\ndirectory and to specify an alternate rules file.\n\nFinally, set up the kubernetes demo using sudo, a result of recent changes.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/c6c074ef6057d4a215cea575740058a72a743e6a"},{"sha":"0d46fcf8197dbe1e44a94760ba7b26bfc188989a","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Move container.info handling to falco engine.\n\ncontainer.info handling used to be handled by the the falco_outputs\nobject. However, this caused problems for applications that only used\nthe falco engine, doing their own output formatting for matching events.\n\nFix this by moving output formatting into the falco engine itself. The\npart that replaces %container.info/adds extra formatting to the end of a\nrule's output now happens while loading the rule.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/0d46fcf8197dbe1e44a94760ba7b26bfc188989a"},{"sha":"37388c56ff18538bdd46c2fc3636a9d8f4577e23","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Validate rule outputs when loading rules.\n\nValidate rule outputs when loading rules by attempting to create a\nformatter based on the rule's output field. If there's an error, it will\npropagate up through load_rules and cause falco to exit rather than\ndiscover the problem only when trying to format the event and the rule's\noutput field.\n\nThis required moving formats.{cpp,h} into the falco engine directory\nfrom the falco general directory. Note that these functions are loaded\ntwice in the two lua states used by falco (engine and outputs).\n\nThere's also a couple of minor cleanups:\n\n - falco_formats had a private instance variable that was unused, remove\n   it.\n - rename the package for the falco_formats functions to formats instead\n   of falco so it's more standalone.\n - don't throw a c++ exception in falco_formats::formatter. Instead\n   generate a lua error, which is handled more cleanly.\n - free_formatter doesn't return any values, so set the return value of\n   the function to 0.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/37388c56ff18538bdd46c2fc3636a9d8f4577e23"},{"sha":"8b116c2ad1a354c6e57197e0e7ab17033bf106fa","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add unit test for rule with invalid output.\n\nAdd the ability to check falco's return code with exit_status and to\ngenerally match stderr with stderr_contains in a test.\n\nUse those to create a test that has an invalid output expression using\n%not_a_real_field. It expects falco to exit with 1 and the output to\ncontain a message about the invalid output.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/8b116c2ad1a354c6e57197e0e7ab17033bf106fa"},{"sha":"0ee32178b761d34e37effc621e584480df10afd4","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Prevent rule_result from leaking on error.\n\nChange falco_engine::process_event to return a unique_ptr that wraps the\nrule result, so it won't be leaked if this method throws an exception.\n\nThis means that callers don't need to create their own.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/0ee32178b761d34e37effc621e584480df10afd4"},{"sha":"3840622984538ee7bfde770a6ed9d612a06eb5c6","author":{"name":"Daniel Cross","email":"af5d1115e9b5f8b315299a83d39cc8141991e761@rea-group.com"},"message":"Adding DNF as non-alerting for RPM and package management\n\nfalco-CLA-1.0-signed-off-by: Daniel Cross <daniel.cross@rea-group.com>","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/3840622984538ee7bfde770a6ed9d612a06eb5c6"},{"sha":"ea973257088828502c8eeaa4a03a9e7709cdcaae","author":{"name":"Luca Marturana","email":"c771c40e96519b1604ddc56f39dfdaf1b7b0d439@sysdig.com"},"message":"Push formatter on lua stack only if does not throw exceptions","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/ea973257088828502c8eeaa4a03a9e7709cdcaae"},{"sha":"7db8e0921c020d6f9bac3932189d4f7c0ce48470","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add ability to write capture stats to a file.\n\nWith -s, periodically fetch capture stats from the inspector and write\nthem to the provided file.\n\nSeparate class StatsFileWriter handles the details. It does rely on a\ntimer + SIGALRM handler so you can only practically create a single\nobject, but it does keep the code/state separate.\n\nThe output format has a sample number, the set of current stats, a\ndelta with the difference from the prior sample, and the percentage of\nevents dropped during that sample.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/7db8e0921c020d6f9bac3932189d4f7c0ce48470"},{"sha":"e6aefef4eb12e82e982d3072db8a0410fcd580e0","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add ability to write \"extra\" stuff to stats file.\n\nWhen run via scripts like run_performance_tests.sh, it's useful to\ninclude extra info like the test being run and the specific program\nvariant to the stats file. So support that via the\nenvironment. Environment keys starting with FALCO_STATS_EXTRA_XXX will\nhave the XXX and environment value added to the stats file.\n\nIt's undocumented as I doubt other programs will need this functionality\nand it keeps the docs simpler.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/e6aefef4eb12e82e982d3072db8a0410fcd580e0"},{"sha":"2a2dcaf25daa54d2945c6d489d79d3c130d55b74","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Modify plotting script to handle drop stats.\n\nNew argument --metric, which can be cpu|drops, controls whether to graph\ncpu usage or event drop percentage. Titles/axis labels/etc. change\nappropriately.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/2a2dcaf25daa54d2945c6d489d79d3c130d55b74"},{"sha":"db6703433833868f7251e16c919eb871f7d69ac9","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Cache formatters.\n\nInstead of creating a formatter for each event, cache them and create\nthem only when needed. A new function output_cleanup cleans up the\ncached formatters, and is called in the destructor if init() was called.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/db6703433833868f7251e16c919eb871f7d69ac9"},{"sha":"6c04f53d2423d011cd60b377ae4c0db6bc35aa87","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add log levels.\n\nPreviously, log messages had levels, but it only influenced the level\nargument passed to syslog(). Now, add the ability to control log level\nfrom falco itself.\n\nNew falco.yaml argument \"log_level\" can be one of the strings\ncorresponding to the well-known syslog levels, which is converted to a\nsyslog-style level as integer.\n\nIn falco_logger::log(), skip messages below the specified level.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/6c04f53d2423d011cd60b377ae4c0db6bc35aa87"},{"sha":"6f54a752a21ab19a6f11ad29717b9394b1a4f167","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Make google_containers/kube-proxy a trusted image.\n\nAdd google_containers/kube-proxy as a trusted image (can be run\nprivileged, can mount sensitive filesystems). While our k8s deployments\nrun kube-proxy via the hyperkube image, evidently it's sometimes run via\nits own image.\n\nThis is one of the fixes for #156.\n\nAlso update the output message for this rule.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/6f54a752a21ab19a6f11ad29717b9394b1a4f167"},{"sha":"f2bfa584e435f9d5050862f987555c633cb50c91","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Fix misleading variable name.\n\nThe second argument to handle_event is actually a rule name, but the\nvariable was a misleading \"level\". Fix.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/f2bfa584e435f9d5050862f987555c633cb50c91"},{"sha":"104c99c42e4f673f819f5bf71d9225643e9b3510","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add rate-limiting for notifications\n\nAdd token-bucket based rate limiting for falco notifications.\n\nThe token bucket is implemented in token_bucket.cpp (actually in the\nengine directory, just to make it easier to include in other\nprograms). It maintains a current count of tokens (i.e. right to send a\nnotification). Its main method is claim(), which attemps to claim a\ntoken and returns true if one was claimed successfully. It has a\nconfigurable configurable max burst size and rate. The token bucket\ngains \"rate\" tokens per second, up to a maximum of max_burst tokens.\n\nThese parameters are configurable in falco.yaml via the config\noptions (defaults shown):\n\noutputs:\n  rate: 1\n  max_burst: 1000\n\nIn falco_outputs::handle_event(), try to claim a token, and if\nunsuccessful log a debug message and return immediately.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/104c99c42e4f673f819f5bf71d9225643e9b3510"},{"sha":"c6953e810b3f524272484d939bbce9cba6af01a5","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Use sinsp utils version of get time.\n\nsinsp_utils::get_current_time_ns() has the same purpose as\nget_epoch_ns(), and now that we're including the token bucket in\nfalco_engine, it's easy to package the dependency. So use that function\ninstead.","distinct":false,"url":"https://api.github.com/repos/draios/falco/commits/c6953e810b3f524272484d939bbce9cba6af01a5"}]}
{"actor":{"display_login":"mstemm"}}