libs
libs copied to clipboard
falcosecurity
Sampling exclude
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
Uncomment one (or more)
/area <>lines:
/area API-version
/area driver-kmod
/area driver-bpf
/area driver-modern-bpf
/area libscap-engine-bpf
/area libscap-engine-kmod
/area libscap-engine-modern-bpf
/area libscap
/area libpman
Does this PR require a change in the driver versions?
/version driver-API-version-minor
What this PR does / why we need it: Support an option to prevent certain system calls from being discarded during sampling. Because some events that seem important on the user side need to be preserved in the sample
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: wangyongfeng5 Once this PR has been reviewed and has the lgtm label, please assign incertum for approval. For more information see the Kubernetes Code Review Process.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Hi :wave: @wangyongfeng5
In addition to the global setting (not doing any sampling) https://github.com/falcosecurity/libs/blob/bf1280f5a7c637cedd2d7bc3e2d05f9fb2fcf5fe/driver/bpf/plumbing_helpers.h#L496 which for the Falco use case is disabled by default, we also have the flag https://github.com/falcosecurity/libs/blob/bf1280f5a7c637cedd2d7bc3e2d05f9fb2fcf5fe/driver/bpf/plumbing_helpers.h#L560 UF_NEVER_DROP, see syscall table https://github.com/falcosecurity/libs/blob/bf1280f5a7c637cedd2d7bc3e2d05f9fb2fcf5fe/driver/syscall_table.c#L34
Would it be possible to summarize the gaps of the existing UF_NEVER_DROP flag and mechanisms?
Lastly is this contribution intended to benefit the Falco client (where primary use cases are threat detection and compliance auditing) or a custom client?
Lastly is this contribution intended to benefit the Falco client (where primary use cases are threat detection and compliance auditing) or a custom client?
It's for a custom client. So we can't use UF_NEVER_DROP because it is static and cannot change with different scenes.
I think which system calls should be excluded from sampling should be an option rather than static, and other similar options, such as whether to enable sampling or not, are per-user, so this option should also be per-user.
Understood @wangyongfeng5 re this PR and the other one. Those are quite significant changes that align with custom clients and not the Falco client.
Would it be ok to defer discussions until after Falco 0.36 release (aka in Oct 2023)? Possibly maybe it would make sense to jump on a community call and discuss or brainstorm more broadly to see if multiple custom clients can benefit from such capabilities and how a best approach would look like as we also need to ensure that new changes and major refactors are ok to maintain going forward.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale