leodido.dev - kernelLeo's take on security, eBPF, Linux, kernel, and whatever tech he meetsZola2016-01-19T00:00:00+00:00https://leodido.dev/tags/kernel/atom.xmlfalco2016-01-19T00:00:00+00:002016-01-19T00:00:00+00:00https://leodido.dev/projects/falco/
<figure class="center">
<img src="https://raw.githubusercontent.com/falcosecurity/community/master/logo/primary-logo.png" style="width:360px" />
<figcaption class="center" >Cloud Native Runtime Security.</figcaption>
</figure>
<p>Want to talk? Join us on the <a rel="noopener noreferrer" target="_blank" href="https://kubernetes.slack.com/archives/CMWH3EH32">#falco</a> channel in the <a rel="noopener noreferrer" target="_blank" href="https://slack.k8s.io">Kubernetes Slack</a>.</p>
<h3 id="latest-releases">Latest releases<a class="zola-anchor" href="#latest-releases" aria-label="Anchor link for: latest-releases">§</a>
</h3>
<p>Read the <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/falco/tree/master/CHANGELOG.md">change log</a>.</p>
<!--
Badges in the following table are constructed by using the
https://img.shields.io/badge/dynamic/xml endpoint.
Parameters are configured for fetching packages from S3 before
(filtered by prefix, sorted in ascending order) and for picking
the latest package by using an XPath selector after.
- Common query parameters:
color=#300aec7
style=flat-square
label=Falco
- DEB packages parameters:
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/deb/stable/falco-
query=substring-before(substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'],"falco-"),".asc")
- RPM packages parameters:
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/rpm/falco-
query=substring-before(substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'],"falco-"),".asc")
- BIN packages parameters:
url=https://falco-distribution.s3-eu-west-1.amazonaws.com/?prefix=packages/bin/x86_64/falco-
query=substring-after((/*[name()='ListBucketResult']/*[name()='Contents'])[last()]/*[name()='Key'], "falco-")
Notes:
- if more than 1000 items are present under as S3 prefix,
the actual latest package will be not picked;
see https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
- for `-dev` packages, the S3 prefix is modified accordingly
- finally, all parameters are URL encoded and appended to the badge endpoint
-->
<table><thead><tr><th></th><th>development</th><th>stable</th></tr></thead><tbody>
<tr><td>rpm</td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/rpm-dev/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-before%28substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%22falco-%22%29%2C%22.asc%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Frpm-dev%2Ffalco-" alt="rpm-dev" /></a></td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/rpm/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-before%28substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%22falco-%22%29%2C%22.asc%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Frpm%2Ffalco-" alt="rpm" /></a></td></tr>
<tr><td>deb</td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/deb-dev/stable/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-before%28substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%22falco-%22%29%2C%22.asc%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Fdeb-dev%2Fstable%2Ffalco-" alt="deb-dev" /></a></td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/deb/stable/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-before%28substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%22falco-%22%29%2C%22.asc%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Fdeb%2Fstable%2Ffalco-" alt="deb" /></a></td></tr>
<tr><td>binary</td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/bin-dev/x86_64/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%20%22falco-%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Fbin-dev%2Fx86_64%2Ffalco-" alt="bin-dev" /></a></td><td><a rel="noopener noreferrer" target="_blank" href="https://download.falco.org/?prefix=packages/bin/x86_64/"><img src="https://img.shields.io/badge/dynamic/xml?color=%2300aec7&style=flat-square&label=Falco&query=substring-after%28%28%2F%2A%5Bname%28%29%3D%27ListBucketResult%27%5D%2F%2A%5Bname%28%29%3D%27Contents%27%5D%29%5Blast%28%29%5D%2F%2A%5Bname%28%29%3D%27Key%27%5D%2C%20%22falco-%22%29&url=https%3A%2F%2Ffalco-distribution.s3-eu-west-1.amazonaws.com%2F%3Fprefix%3Dpackages%2Fbin%2Fx86_64%2Ffalco-" alt="bin" /></a></td></tr>
</tbody></table>
<p>The Falco Project, originally created by <a rel="noopener noreferrer" target="_blank" href="https://sysdig.com">Sysdig</a>, is an incubating <a rel="noopener noreferrer" target="_blank" href="https://cncf.io">CNCF</a> open source cloud native runtime security tool.
Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack.
Falco has a rich set of security rules specifically built for Kubernetes, Linux, and cloud-native.
If a rule is violated in a system, Falco will send an alert notifying the user of the violation and its severity.</p>
<h3 id="installing-falco">Installing Falco<a class="zola-anchor" href="#installing-falco" aria-label="Anchor link for: installing-falco">§</a>
</h3>
<p>If you would like to run Falco in <strong>production</strong> please adhere to the <a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/getting-started/installation/">official installation guide</a>.</p>
<h5 id="kubernetes">Kubernetes<a class="zola-anchor" href="#kubernetes" aria-label="Anchor link for: kubernetes">§</a>
</h5>
<table><thead><tr><th>Tool</th><th>Link</th><th>Note</th></tr></thead><tbody>
<tr><td>Helm</td><td><a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/charts/tree/master/falco#introduction">Chart Repository</a></td><td>The Falco community offers regular helm chart releases.</td></tr>
<tr><td>Minikube</td><td><a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/getting-started/third-party/#minikube">Tutorial</a></td><td>The Falco driver has been baked into minikube for easy deployment.</td></tr>
<tr><td>Kind</td><td><a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/getting-started/third-party/#kind">Tutorial</a></td><td>Running Falco with kind requires a driver on the host system.</td></tr>
<tr><td>GKE</td><td><a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/getting-started/third-party/#gke">Tutorial</a></td><td>We suggest using the eBPF driver for running Falco on GKE.</td></tr>
</tbody></table>
<h3 id="developing">Developing<a class="zola-anchor" href="#developing" aria-label="Anchor link for: developing">§</a>
</h3>
<p>Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.</p>
<p>Falco has a <a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/grpc/">gRPC</a> endpoint and an API defined in <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/falco/blob/master/userspace/falco/outputs.proto">protobuf</a>.
The Falco Project supports various SDKs for this endpoint.</p>
<h5 id="sdks">SDKs<a class="zola-anchor" href="#sdks" aria-label="Anchor link for: sdks">§</a>
</h5>
<table><thead><tr><th>Language</th><th>Repository</th></tr></thead><tbody>
<tr><td>Go</td><td><a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/client-go">client-go</a></td></tr>
<tr><td>Rust</td><td><a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/client-rs">client-rs</a></td></tr>
<tr><td>Python</td><td><a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/client-py">client-py</a></td></tr>
</tbody></table>
<h3 id="what-can-falco-detect">What can Falco detect?<a class="zola-anchor" href="#what-can-falco-detect" aria-label="Anchor link for: what-can-falco-detect">§</a>
</h3>
<p>Falco can detect and alert on any behavior that involves making Linux system calls.
Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process.
For example, Falco can easily detect incidents including but not limited to:</p>
<ul>
<li>A shell is running inside a container or pod in Kubernetes.</li>
<li>A container is running in privileged mode, or is mounting a sensitive path, such as <code>/proc</code>, from the host.</li>
<li>A server process is spawning a child process of an unexpected type.</li>
<li>Unexpected read of a sensitive file, such as <code>/etc/shadow</code>.</li>
<li>A non-device file is written to <code>/dev</code>.</li>
<li>A standard system binary, such as <code>ls</code>, is making an outbound network connection.</li>
<li>A privileged pod is started in a Kubernetes cluster.</li>
</ul>
<h3 id="documentation">Documentation<a class="zola-anchor" href="#documentation" aria-label="Anchor link for: documentation">§</a>
</h3>
<p>The <a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/">Official Documentation</a> is the best resource to learn about Falco.</p>
<h3 id="join-the-community">Join the Community<a class="zola-anchor" href="#join-the-community" aria-label="Anchor link for: join-the-community">§</a>
</h3>
<p>To get involved with The Falco Project please visit <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/community">the community repository</a> to find more.</p>
<p>How to reach out?</p>
<ul>
<li>Join the #falco channel on the <a rel="noopener noreferrer" target="_blank" href="https://slack.k8s.io">Kubernetes Slack</a></li>
<li><a rel="noopener noreferrer" target="_blank" href="https://lists.cncf.io/g/cncf-falco-dev">Join the Falco mailing list</a></li>
<li><a rel="noopener noreferrer" target="_blank" href="https://falco.org/docs/">Read the Falco documentation</a></li>
</ul>
<h3 id="contributing">Contributing<a class="zola-anchor" href="#contributing" aria-label="Anchor link for: contributing">§</a>
</h3>
<p>See the <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md">CONTRIBUTING.md</a>.</p>
<h3 id="security-audit">Security Audit<a class="zola-anchor" href="#security-audit" aria-label="Anchor link for: security-audit">§</a>
</h3>
<p>A third party security audit was performed by Cure53, you can see the full report <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/falco/tree/master/audits/SECURITY_AUDIT_2019_07.pdf">here</a>.</p>
<h3 id="reporting-security-vulnerabilities">Reporting security vulnerabilities<a class="zola-anchor" href="#reporting-security-vulnerabilities" aria-label="Anchor link for: reporting-security-vulnerabilities">§</a>
</h3>
<p>Please report security vulnerabilities following the community process documented <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/.github/blob/master/SECURITY.md">here</a>.</p>
<h3 id="license-terms">License Terms<a class="zola-anchor" href="#license-terms" aria-label="Anchor link for: license-terms">§</a>
</h3>
<p>Falco is licensed to you under the <a rel="noopener noreferrer" target="_blank" href="https://github.com/falcosecurity/falco/tree/master/COPYING">Apache 2.0</a> open source license.</p>