search

falcosecurity / rules

Falco rule repository
https://falcosecurity.github.io/rules/
Apache License 2.0
88 stars 64 forks source link

Update: bpf cmd format #208

Closed Rohith-Raju closed 4 months ago

Rohith-Raju commented 6 months ago

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area rules

Proposed rule maturity level

/area maturity-sandbox

What this PR does / why we need it:

This PR updates new bpf cmd format based on changes implemented in https://github.com/falcosecurity/libs/pull/1545

Which issue(s) this PR fixes:

Fixes #203

Special notes for your reviewer:

github-actions[bot] commented 6 months ago

Rules files suggestions

falco-sandbox_rules.yaml

Comparing 88e580cedcb33d81f692882fb07c2fb6f8b16c61 with latest tag falco-sandbox-rules-2.0.0

No changes detected

incertum commented 6 months ago

Thanks @Rohith-Raju ❤️

/hold for a while since we won't have that until libs 0.15.0 and the next Falco release will use libs 0.14.x

Anticipate to hold it until at least February / March.

Rohith-Raju commented 6 months ago

Sounds good!! @incertum

leogr commented 5 months ago

Anticipate to hold it until at least February / March.

Reminder: we will also need to update required_engine_version accordingly.

incertum commented 4 months ago

@Rohith-Raju we finally have the libs changes in Falco master, please bump the required_engine_version to 0.35.0 in the rules file you touched, see https://github.com/falcosecurity/falco/blob/master/userspace/engine/falco_engine_version.h#L23 plus a rebase is needed. Thanks!

github-actions[bot] commented 4 months ago

Rules files suggestions

falco-sandbox_rules.yaml

Comparing 0530058deb7ef66c5912060d6c1dab1312de6cba with latest tag falco-sandbox-rules-3.0.1

No changes detected

poiana commented 4 months ago

LGTM label has been added.

Git tree hash: b21dd8d81418e7506c9949596d664c90ac8177e2

poiana commented 4 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: incertum, leogr, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/rules/blob/main/OWNERS)~~ [incertum,leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment