Aldo Lacuku, Andrea Terzolo, Federico Di Pierro Jan 26, 2024

Falco Weekly 4 - 2024

Falco

What happened in Falco this week?

Let's go through the major changes that happened in various repositories under the falcosecurity organization.

Libs

Libs will need a 0.14.2 tag for the Falco 0.37.0 release, with the revert of https://github.com/falcosecurity/libs/pull/1533 PR.
During our release process, we found out that the new std::filesystem based implementaton was up to 8x time slower than the old ones; that's because it supports much more cases and does many more checks.
Therefore, in https://github.com/falcosecurity/libs/pull/1645, we revert to the old sorcery implementation, plus some minor improvements and added tests.

Moreover, many more changes landed in libs, that won't be part of the upcoming Falco 0.37.0 release:

Modernized C++ struct/enum/union declarations: https://github.com/falcosecurity/libs/pull/1588
Added support for newfstatat syscall: https://github.com/falcosecurity/libs/pull/1628
Fixed a potential deadlock for kmod: https://github.com/falcosecurity/libs/pull/1629
Big effort by our hero, Jason, to cleanup some stale macros: https://github.com/falcosecurity/libs/pull/1633,https://github.com/falcosecurity/libs/pull/1634,https://github.com/falcosecurity/libs/pull/1635,https://github.com/falcosecurity/libs/pull/1637,https://github.com/falcosecurity/libs/pull/1638
A small fix for old ebpf driver to support some GKE envs: https://github.com/falcosecurity/libs/pull/1642
Solved a data race and segfault in logger: https://github.com/falcosecurity/libs/pull/1643
Allow to selectively disable bpf and kmod engines from cmake: https://github.com/falcosecurity/libs/pull/1644

Falco

Falco tag 0.37.0-rc2 is out! Try it!

Moreover:

syscall_event_drops was soft-deprecated to get ready for Falco 0.38.0 upcoming cleanups: https://github.com/falcosecurity/falco/pull/3015
Avoid storing escaped strings in engine: https://github.com/falcosecurity/falco/pull/3028
Bumped falcoctl to v0.7.1 and rules to 3.0.0: https://github.com/falcosecurity/falco/pull/3030,https://github.com/falcosecurity/falco/pull/3034
Fixed nlohmann_json library include paths when using system one: https://github.com/falcosecurity/falco/pull/3032
Fixes to new libsinsp state metrics handling: https://github.com/falcosecurity/falco/pull/3033

We are in the testing phase so any feedback would be appreciated! Moreover, we crafted a dedicated helm chart to test the new k8smeta plugin and the k8s-metacollector, you can read more about it here. Please note these 2 new components will be officially released with Falco 0.37.0 as EXPERIMENTAL features.

As a final reminder, please take a look at our polls if you have some spare seconds.

Falcoctl

Falcoctl 0.7.1 is out! Try it! and contains a small fix for the driver-loader on COS.

Moreover, we added dependabot configs, that then bumped lots of deps to their latest compatible versions: https://github.com/falcosecurity/falcoctl/pull/385.