WIP: Added an event for default stable rule "Linux Kernel Module Injection Detected"

falcosecurity / event-generator

Generate a variety of suspect actions that are detected by Falco rulesets

Apache License 2.0

94 stars 40 forks source link

WIP: Added an event for default stable rule "Linux Kernel Module Injection Detected" #161

Open GLVSKiriti opened 8 months ago

GLVSKiriti commented 8 months ago

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind documentation

/kind tests

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area commands

/area pkg

/area events

What this PR does / why we need it: Added an event for default stable rule "Linux Kernel Module Injection Detected" as mentioned here Which issue(s) this PR fixes:

Fixes #160

Special notes for your reviewer:

poiana commented 8 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: GLVSKiriti Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/falcosecurity/event-generator/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

leogr commented 7 months ago

Note that:

We likely don't want a building toolchain or a compiler as a pre-requisite for this
And possibly avoiding loading a real kernel module (have you tried just to "attempt" doing that with an empty file or whatever similar?)

poiana commented 4 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 3 months ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

leogr commented 3 months ago

/remove-lifecycle stale /remove-lifecycle rotten