falcosecurity/falco issues and pull requests

#2989 - Falco pods failing for Openshift version 4.12 and 4.14

Issue - State: open - Opened by ajinkya1986 about 1 year ago - 2 comments
Labels: kind/bug, lifecycle/stale

#2988 - update(config): clarify deprecation notices + list all env vars

Pull Request - State: closed - Opened by incertum about 1 year ago - 3 comments
Labels: kind/cleanup, area/engine, release-note, dco-signoff: yes, lgtm, size/M, approved

#2987 - cleanup(engine): clarify deprecation notice for engines

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 3 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, size/S, approved

#2986 - docs(proposal): 20231220-features-adoption-and-deprecation.md

Pull Request - State: closed - Opened by leogr about 1 year ago - 13 comments
Labels: kind/documentation, kind/design, dco-signoff: yes, lgtm, release-note-none, approved, size/L, area/proposals

#2985 - Change the format of the 'output' field in the JSON payload

Issue - State: closed - Opened by Issif about 1 year ago - 25 comments
Labels: kind/feature

#2982 - I upgraded my AKS cluster to version 1.26.1 and Falco stopped working properly

Issue - State: open - Opened by hkinjo2 about 1 year ago - 22 comments
Labels: kind/bug

#2981 - new(engine): add selective rule overrides

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 11 comments
Labels: kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/XXL, area/tests

#2980 - build(deps): Bump submodules/falcosecurity-testing from `930170b` to `9b9630e`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2979 - chore(ci): use actuated get-kernel-sources action.

Pull Request - State: open - Opened by FedeDP about 1 year ago - 3 comments
Labels: kind/cleanup, dco-signoff: yes, release-note-none, size/S, approved, area/ci

#2978 - [Feedback] New `driver-loader`

Issue - State: closed - Opened by incertum about 1 year ago - 36 comments
Labels: kind/feature, lifecycle/rotten

#2977 - chore: bump Falco to latest libs

Pull Request - State: closed - Opened by Andreagit97 about 1 year ago - 4 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/build

#2976 - build(deps): Bump submodules/falcosecurity-rules from `262f569` to `cd33bc3`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2975 - IPv6 Kubernetes API server address parsed as invalid URI

Issue - State: closed - Opened by abroglesc almost 2 years ago - 9 comments
Labels: kind/bug

#2974 - update(config): Improve http output, add compression and keep_alive

Pull Request - State: closed - Opened by sgaist about 1 year ago - 7 comments
Labels: kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, size/S, approved

#2973 - K8S client issues

Issue - State: closed - Opened by alacuku almost 2 years ago - 56 comments
Labels: kind/feature

#2972 - chore(unit_tests): added more tests for yaml env vars expansion.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 2 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/tests

#2971 - chore(falco.yaml): use HOME env var for ebpf probe path.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 3 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, approved, size/XS

#2970 - chore: bump falco to latest libs

Pull Request - State: closed - Opened by Andreagit97 about 1 year ago - 3 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/build

#2969 - build(deps): Bump submodules/falcosecurity-rules from `dd38952` to `262f569`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2968 - chore(cmake,docker): bumped falcoctl to v0.7.0-beta5.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 2 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved

#2967 - update(readme): add actuated.dev badge

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS

#2966 - fix(docker): small fixes in docker entrypoints for new driver loader.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 2 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/build

#2965 - feat(userspace/falco): monitor more types of events for rule directories and files

Pull Request - State: closed - Opened by NitroCao about 1 year ago - 5 comments
Labels: kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/XS

#2964 - [Legacy eBPF] GKE libscap: bpf_load_program() Operation not permitted

Issue - State: closed - Opened by Maximebb about 1 year ago - 5 comments
Labels: kind/bug

#2963 - BUG(master): provide a better error message when `-v /proc:/host/proc:ro` is not provided, avoiding segfaults

Issue - State: closed - Opened by Andreagit97 about 1 year ago
Labels: kind/bug

#2962 - Miscorrelation between real/efective user's name and id for executed privileged command

Issue - State: closed - Opened by aberezovski about 1 year ago - 8 comments
Labels: kind/bug

#2961 - chore(ci): enable aarch64 falco driver loader tests.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 8 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/ci

#2960 - [DISCUSSION] New `base_syscalls.exclude_enter_exit_set` config

Issue - State: open - Opened by incertum about 1 year ago - 13 comments
Labels: kind/feature, lifecycle/stale

#2959 - build(deps): Bump submodules/falcosecurity-rules from `64e2adb` to `dd38952`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 4 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2958 - Non-ASCII file paths/names are displayed as dots in the output

Issue - State: closed - Opened by adsick about 1 year ago - 2 comments
Labels: kind/bug

#2957 - Falco 0.36.2 BPF probe conflict with deepflow

Issue - State: closed - Opened by Spartan-65 about 1 year ago - 15 comments
Labels: kind/bug, lifecycle/rotten

#2956 - Falco 0.36.2 BPF probe for driver.kind fails in Kubernetes clusters with permission denied error

Issue - State: closed - Opened by navaneeth-c about 1 year ago - 3 comments
Labels: kind/bug

#2955 - new http_output options (compression, batching, keep_alive)

Issue - State: open - Opened by artemNN about 1 year ago - 14 comments
Labels: kind/feature

#2954 - build(deps): Bump submodules/falcosecurity-rules from `64e2adb` to `eff31ca`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: do-not-merge/release-note-label-needed, dco-signoff: yes, size/XS, dependencies, submodules

#2953 - build(deps): Bump submodules/falcosecurity-testing from `3e2d5e2` to `930170b`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 7 comments
Labels: do-not-merge/release-note-label-needed, dco-signoff: yes, size/XS, do-not-merge/hold, dependencies, submodules

#2952 - add real user id field

Issue - State: closed - Opened by artemNN about 1 year ago - 8 comments
Labels: kind/feature

#2951 - Process to improve creating / updating Falco docs

Issue - State: closed - Opened by mikegcoleman about 1 year ago - 9 comments
Labels: kind/documentation, lifecycle/rotten

#2950 - Publish checksums for .tar.gz archives

Issue - State: open - Opened by johananl about 1 year ago - 3 comments
Labels: kind/feature

#2949 - Track environment variables managed by Falco

Issue - State: closed - Opened by FedeDP about 1 year ago - 2 comments
Labels: kind/documentation

#2948 - cleanup: fix several warnings from a Clang build

Pull Request - State: closed - Opened by federico-sysdig about 1 year ago - 6 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#2947 - chore(build): allow usage of non-bundled nlohmann-json

Pull Request - State: closed - Opened by federico-sysdig about 1 year ago - 2 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/M, approved, area/build

#2946 - chore(build): remove outdated development libs

Pull Request - State: closed - Opened by federico-sysdig about 1 year ago - 3 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/M, approved, area/build

#2945 - update(ci): enable actuated.dev

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 9 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/M, approved, area/build

#2944 - chore(falco): bump Falco to `000d576` libs commit

Pull Request - State: closed - Opened by Andreagit97 about 1 year ago - 4 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/build

#2943 - mv file /etc/falco/rule.d/ will not cause falco to restart, but cp -r file /etc/falco/rule.d/file can

Issue - State: closed - Opened by YanjiangChen about 1 year ago - 1 comment
Labels: kind/bug

#2942 - Use `proc.exe` and `proc.aexe` Instead of `proc.name` and `proc.aname`

Issue - State: open - Opened by ossie-git about 1 year ago - 3 comments
Labels: kind/feature, lifecycle/rotten

#2941 - add file attributes to fields for conditions and outputs

Issue - State: closed - Opened by artemNN about 1 year ago - 9 comments
Labels: kind/feature, lifecycle/rotten

#2940 - Unix Socket Abuse Detection Rules

Issue - State: closed - Opened by louka-jc about 1 year ago - 6 comments
Labels: kind/documentation

#2939 - Add addl source related methods

Pull Request - State: closed - Opened by mstemm about 1 year ago - 5 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#2938 - build(deps): Bump submodules/falcosecurity-testing from `5248e6d` to `3e2d5e2`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: do-not-merge/release-note-label-needed, dco-signoff: yes, size/XS, dependencies, submodules

#2937 - build(deps): Bump submodules/falcosecurity-testing from `92c313f` to `5248e6d`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2936 - refactor: cleanup libs relative include paths

Pull Request - State: closed - Opened by therealbobo about 1 year ago - 7 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#2935 - build(deps): Bump submodules/falcosecurity-testing from `92c313f` to `5df15a1`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 7 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2934 - update(userspace): enhancements in rule description feature

Pull Request - State: closed - Opened by jasondellaluce about 1 year ago - 7 comments
Labels: kind/feature, kind/cleanup, area/engine, size/XL, release-note, dco-signoff: yes, lgtm, approved

#2933 - cleanup(falco): remove decode_uri as it is no longer used

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 4 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#2932 - chore(docker/falco): add back some deps to falco docker image.

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 4 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/build

#2931 - [Documentation] DEPRECATION NOTICE for FALCO_BPF_PROBE for Falco 0.38 -> add info around what to do instead of using the env variable

Issue - State: closed - Opened by incertum about 1 year ago - 2 comments
Labels: kind/documentation

#2930 - Support sanitizers in Falco tests CI

Issue - State: closed - Opened by LucaGuerra about 1 year ago
Labels: kind/feature

#2929 - chore(falco): update to libs on nov 28th

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 3 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/build

#2928 - [TRACKING] Double-check which falco metrics we want to expose to final users

Issue - State: closed - Opened by Andreagit97 about 1 year ago - 9 comments
Labels: kind/feature, lifecycle/rotten

#2927 - new(falco): print system info when Falco starts

Pull Request - State: closed - Opened by Andreagit97 about 1 year ago - 2 comments
Labels: kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, size/M, approved

#2926 - fix(userspace/falco): use resolved plugin name when opening a plugin

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 6 comments
Labels: kind/bug, area/engine, dco-signoff: yes, release-note-none, approved, size/XS, do-not-merge/hold

#2925 - Cannot run falco built from source

Issue - State: closed - Opened by baosama999 about 1 year ago - 5 comments
Labels: kind/bug

#2924 - Emit a warning when trying to set a non-existing config key

Issue - State: open - Opened by leogr about 1 year ago - 7 comments
Labels: kind/feature

#2923 - I would like to know about the necessity of updating the kernel module in high kernel. Is there any detailed documentation?

Issue - State: open - Opened by YanjiangChen about 1 year ago - 4 comments
Labels: kind/documentation, lifecycle/rotten

#2922 - I would like to know about the necessity of updating the kernel module in high kernel. Is there any detailed documentation?

Issue - State: closed - Opened by YanjiangChen about 1 year ago
Labels: kind/bug

#2921 - falco 0.36 kernel :rhel, falco-driver-loader unable to download

Issue - State: closed - Opened by YanjiangChen about 1 year ago - 7 comments
Labels: kind/bug, lifecycle/stale

#2920 - Allow enabling rules by ruleset id in addition to name

Pull Request - State: closed - Opened by mstemm about 1 year ago - 4 comments
Labels: kind/feature, size/XL, dco-signoff: yes, lgtm, release-note-none, approved

#2919 - update(doc): Add Thought Machine as adopters

Pull Request - State: closed - Opened by RichardoC about 1 year ago - 2 comments
Labels: kind/documentation, release-note, dco-signoff: yes, lgtm, approved, size/XS

#2918 - chore(unit_test,userspace): allow env var to get expanded in yaml even when part of a string

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 8 comments
Labels: kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/L

#2917 - cleanup(falco): remove `init` in the configuration constructor

Pull Request - State: closed - Opened by Andreagit97 about 1 year ago - 4 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/XS

#2916 - Accessing Sensitives Files Under /etc/pam.d Via a Symlink Evades Detection With Default YAML Rules

Issue - State: open - Opened by agadient about 1 year ago - 3 comments
Labels: kind/bug

#2915 - Deleting all Keys from the syscall_exit_ta Map Causes the Agent to No Longer Detect

Issue - State: closed - Opened by agadient about 1 year ago - 5 comments
Labels: kind/bug, lifecycle/rotten

#2914 - update!: bump libs to latest and deprecation of k8s metadata options and configs

Pull Request - State: closed - Opened by jasondellaluce about 1 year ago - 3 comments
Labels: kind/cleanup, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/L, area/build

#2913 - cleanup(userspace/engine): remove legacy k8saudit implementation

Pull Request - State: closed - Opened by jasondellaluce about 1 year ago - 5 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/XXL

#2912 - update(engine): port decode_uri in falco engine

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 7 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#2911 - fix(gha): disable branch protection rule trigger for scorecard

Pull Request - State: closed - Opened by LucaGuerra about 1 year ago - 4 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/ci

#2910 - [DISCUSSION] deprecate / remove old internal drop stats?

Issue - State: open - Opened by incertum about 1 year ago - 10 comments
Labels: kind/documentation

#2909 - crashLoopBackOff on GKE COS pods deployed with Helm

Issue - State: closed - Opened by luckpng about 1 year ago - 10 comments
Labels: kind/bug, lifecycle/rotten

#2908 - build(deps): Bump submodules/falcosecurity-rules from `8f0520f` to `64e2adb`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2907 - Falco Pod Restarts

Issue - State: closed - Opened by omfurman-ma about 1 year ago - 7 comments
Labels: kind/bug, lifecycle/rotten

#2906 - build(deps): Bump submodules/falcosecurity-rules from `8f0520f` to `35a379a`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: do-not-merge/release-note-label-needed, dco-signoff: yes, size/XS, dependencies, submodules

#2905 - new: falcoctl driver loader

Pull Request - State: closed - Opened by FedeDP about 1 year ago - 13 comments
Labels: kind/feature, release-note, dco-signoff: yes, lgtm, approved, size/XXL, area/build

#2904 - build(deps): Bump submodules/falcosecurity-rules from `e206c1a` to `8f0520f`

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#2903 - Unexpected behavior with "condition: evt.type in (openat, open) and evt.arg.flags contains "CREAT" and fd.typechar='f' and fd.num>=0"

Issue - State: closed - Opened by SerhiyProtsenko over 1 year ago - 6 comments
Labels: kind/bug, lifecycle/rotten

GitHub / falcosecurity/falco issues and pull requests