falcosecurity
[Feature] Improve args in `bpf` exit event
Based on a discussion between @Andreagit97 @darryk10 and myself a few ideas shared by Andrea to improve bpf syscall based alerting in falco rules:
- [ ] add the possibility to check the return value, possibly expose evt.arg.cmd also in the exit event to have all fields of interest in one event
- [x] introduce the BPF commands name, so use evt.arg.cmd == BPF_PROG_LOAD instead of evt.arg.cmd == 5 -> https://github.com/falcosecurity/libs/pull/1545
- [ ] expose also the name of the BPF prog injected (not easy at all) -> comment @incertum not sure how valuable it would be for detections, maybe not really needed at the moment.
this is a duplicate of #1342 but it is more detailed, I will close mine :)
Awesome, you have any additional questions? Else please feel free to go ahead :) Thanks!
I'm going to solve them one by one and will reach out if I get stuck 😄.
Great! Suggesting to focus on the first 2 items in one PR -> easy wins, add direct value to Falco rules in the next release.
The last one may need to be queued depending on prioritization, not a top priority feature.
Changed milestone to TBD since 2 items are still open and to be discussed. @Rohith-Raju are you still interested in exploring the other 2 items in the future? No immediate urgency.
Awesome @Rohith-Raju likely these items would be for the summer after Falco 0.38.0, but dev and PR review can happen any time before of course!
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
add the possibility to check the return value, possibly expose evt.arg.cmd also in the exit event to have all fields of interest in one event
This could be solved with https://github.com/falcosecurity/libs/pull/2068
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
could be partially solved by https://github.com/falcosecurity/libs/pull/1867, at least the first point
add the possibility to check the return value, possibly expose evt.arg.cmd also in the exit event to have all fields of interest in one event
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.