new: ship falcoctl bundled with Falco #2345

FedeDP · 2023-01-10T13:41:33Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:

This PR bundles falcoctl inside Falco; moreover, it adds a new systemd service for falcoctl that will be used during DEB/RPM installation; moreover, the user will be asked (through a dialog) to enable the automatic feed; by default (when dialog is missing or we are in a non interactive mode), falcoctl is not enabled.

Finally, if no driver is chosen at package installation time, falcoctl dialog won't be shown.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new!: ship falcoctl inside Falco

CMakeLists.txt

FedeDP · 2023-01-10T13:42:09Z

cmake/modules/falcoctl.cmake

+
+string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} FALCOCTL_SYSTEM_NAME)
+
+set(FALCOCTL_VERSION "0.2.0-rc1")


RC version for now. To be bumped before release.

FedeDP · 2023-01-10T13:42:31Z

cmake/modules/falcoctl.cmake

+        BUILD_COMMAND ""
+        INSTALL_COMMAND "")
+
+install(PROGRAMS "${PROJECT_BINARY_DIR}/falcoctl-prefix/src/falcoctl/falcoctl" DESTINATION "${FALCO_BIN_DIR}" COMPONENT "${FALCO_COMPONENT_NAME}")


Install it under the FALCO_COMPONENT_NAME, just like we do for falco-driver-loader.

FedeDP · 2023-01-10T13:42:41Z

scripts/debian/postinst.in

@@ -17,19 +17,19 @@
 #

 chosen_driver=
+enable_falcoctl=0


Disabled by default.

FedeDP · 2023-01-10T13:42:48Z

scripts/debian/postinst.in


 if [ "$1" = "configure" ]; then
        if [ -x /usr/bin/dialog ]; then
          # If dialog is installed, create a dialog to let users choose the correct driver for them
-          CHOICE=$(dialog --clear --backtitle "Choose your preferred driver" --title "Falco drivers" --menu "Choose one of the following options:" 15 40 5 \
+          CHOICE=$(dialog --clear --title "Falco drivers" --menu "Choose your preferred driver:" 12 40 5 \


Small tweaks.

scripts/systemd/falcoctl.service

jasondellaluce · 2023-01-10T17:34:00Z

/milestone 0.34.0

FedeDP · 2023-01-11T10:59:17Z

CI timed out :/

FedeDP · 2023-01-11T14:12:15Z

@LucaGuerra @loresuso @alacuku
Let me know if this works for you, given you are the most active devs on falcoctl :D

Minor refinements might be needed on systemd service permissions; moreover, i am not getting who is supposed to ship:

etc/falcoctl/config.yaml
/etc/falcoctl/follow.yaml

FedeDP · 2023-01-18T09:59:15Z

scripts/systemd/falcoctl.service

+ProtectKernelTunables=true
+RestrictRealtime=true
+#RestrictAddressFamilies=~AF_PACKET
+#StandardOutput=null


Do we really need StandardOutput=null for all other services?
/cc @leogr

@FedeDP
I'm unsure, but we likely need to keep it. The reason is to avoid polluting /var/logs/messages. See this my old comment.

Ok thank you!

FedeDP · 2023-01-18T14:41:32Z

Side note: if we want falcoctl.service to start after falco service, we would need to create a falco.target so that falcoctl.service can have a After=falco.target line, and every falco-*.service will be PartOf falco target.

Do you think this is important?
@leogr @loresuso

leogr · 2023-01-19T09:58:54Z

Side note: if we want falcoctl.service to start after falco service, we would need to create a falco.target so that falcoctl.service can have a After=falco.target line, and every falco-*.service will be PartOf falco target.

Do you think this is important? @leogr @loresuso

@FedeDP
Yes, I think so. Although falcoctl should correctly handle the case falco is not yet ready, I believe we should also enforce that via systemd for consistency.

FedeDP · 2023-01-19T11:46:20Z

Ok, i will add support for it :)

FedeDP · 2023-01-19T15:05:45Z

Support added in latest commit; basically:

all the falco-X units are PartOf falco.target
falco.target declares how units are installed
falcoctl.service runs after and binds to falco.target; this means that it is run after the falco target and if the falco target is stopped it gets stopped
preuninstall deb/rpm scripts will then stop just the falco.target, that will then stop falcoctl and falco-X services

FedeDP · 2023-01-19T15:32:13Z

scripts/debian/postinst.in

@@ -17,19 +17,19 @@
 #

 chosen_driver=
+enable_falcoctl=1


Enabled by default.

FedeDP · 2023-01-19T15:32:45Z

scripts/debian/postinst.in

-            clear
+          esac
+
+          CHOICE=$(dialog --clear --title "Falcoctl" --menu "Do you want to follow automatic ruleset updates?" 10 40 2 \


Choice is always requested for falcoctl, even when no driver was chosen.

FedeDP · 2023-01-19T15:33:23Z

scripts/debian/prerm.in

-      systemctl --system stop 'falco-bpf.service' || true
-      systemctl --system stop 'falco-modern-bpf.service' || true
-      systemctl --system stop 'falco-plugin.service' || true
+      systemctl --system stop 'falco.target' || true


Since all units are PartOf falco.target, and falcoctl service is bound to it, we can just stop falco.target.

jasondellaluce

Fantastic work! LGTM so far!

Andreagit97 · 2023-01-20T13:30:17Z

/hold

Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Roberto Scolaro <[email protected]>

Signed-off-by: Andrea Terzolo <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Andrea Terzolo <[email protected]>

cmake/modules/falcoctl.cmake

Signed-off-by: Andrea Terzolo <[email protected]>

jasondellaluce

/approve

poiana · 2023-01-25T16:36:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, jasondellaluce, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [FedeDP,jasondellaluce,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Andreagit97 · 2023-01-25T16:37:23Z

/unhold

poiana added kind/feature release-note dco-signoff: yes area/build approved labels Jan 10, 2023

poiana requested review from Andreagit97 and Kaizhe January 10, 2023 13:41

poiana added the size/L label Jan 10, 2023

FedeDP commented Jan 10, 2023

View reviewed changes

poiana added this to the 0.34.0 milestone Jan 10, 2023

FedeDP commented Jan 18, 2023

View reviewed changes

poiana requested a review from leogr January 18, 2023 09:59

FedeDP force-pushed the new/falcoctl branch from 976c328 to b34997d Compare January 18, 2023 10:32

FedeDP commented Jan 19, 2023

View reviewed changes

FedeDP force-pushed the new/falcoctl branch from b45da2c to 90f5ec4 Compare January 19, 2023 15:34

jasondellaluce reviewed Jan 20, 2023

View reviewed changes

poiana added the do-not-merge/hold label Jan 20, 2023

Andreagit97 force-pushed the new/falcoctl branch 2 times, most recently from be97f3a to 80ef2e2 Compare January 23, 2023 21:31

FedeDP force-pushed the new/falcoctl branch from 80ef2e2 to 591b832 Compare January 24, 2023 11:06

FedeDP and others added 6 commits January 24, 2023 12:42

chore(scripts): small fixes to systemd units.

8dd76a2

Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Roberto Scolaro <[email protected]>

chore: fix cmake file copy

c07c7c9

Signed-off-by: Andrea Terzolo <[email protected]>

scripts: remove falco.target and use require falcoctl with Wants=

468eefb

Signed-off-by: Andrea Terzolo <[email protected]>

docs: fix some comments

abb2078

Signed-off-by: Andrea Terzolo <[email protected]>

cleanup: rename plugin unit into custom unit

086d78c

Signed-off-by: Andrea Terzolo <[email protected]>

chore: couple of small fixes.

ef4a089

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the new/falcoctl branch from ead2eb8 to ef4a089 Compare January 24, 2023 11:42

FedeDP and others added 2 commits January 24, 2023 13:36

update(cmake): bumped falcoctl to latest version.

72540f5

Signed-off-by: Federico Di Pierro <[email protected]>

fix: create directory for systemd scripts

ad449df

Signed-off-by: Andrea Terzolo <[email protected]>

Andreagit97 force-pushed the new/falcoctl branch from b97db9a to ad449df Compare January 24, 2023 14:04

update: add falco alias to kmod unit

02a1b3c

Signed-off-by: Andrea Terzolo <[email protected]>

leogr reviewed Jan 24, 2023

View reviewed changes

cmake/modules/falcoctl.cmake Outdated Show resolved Hide resolved

poiana added size/XL and removed size/L labels Jan 25, 2023

chore: bump rules and falcoctl

7c4f1de

Signed-off-by: Andrea Terzolo <[email protected]>

Andreagit97 force-pushed the new/falcoctl branch from 903ff0b to 7c4f1de Compare January 25, 2023 14:00

LucaGuerra mentioned this pull request Jan 25, 2023

Cut 0.34.0 Release #2368

Closed

48 tasks

Andreagit97 added 2 commits January 25, 2023 15:41

tests: fix rule paths

a62bdd0

Signed-off-by: Andrea Terzolo <[email protected]>

chore: bump libs version

79b55ca

Signed-off-by: Andrea Terzolo <[email protected]>

jasondellaluce approved these changes Jan 25, 2023

View reviewed changes

poiana assigned jasondellaluce Jan 25, 2023

poiana added the lgtm label Jan 25, 2023

leogr approved these changes Jan 25, 2023

View reviewed changes

poiana assigned leogr Jan 25, 2023

poiana removed the do-not-merge/hold label Jan 25, 2023

poiana merged commit a7e991b into master Jan 25, 2023

poiana deleted the new/falcoctl branch January 25, 2023 16:37

happy-dude mentioned this pull request Jan 26, 2023

(bug) falcoctl does not report version when built from source falcosecurity/falcoctl#236

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new: ship falcoctl bundled with Falco #2345

new: ship falcoctl bundled with Falco #2345

FedeDP commented Jan 10, 2023 •

edited by leogr

Loading

FedeDP Jan 10, 2023

FedeDP Jan 10, 2023

FedeDP Jan 10, 2023

FedeDP Jan 10, 2023

jasondellaluce commented Jan 10, 2023

FedeDP commented Jan 11, 2023

FedeDP commented Jan 11, 2023

FedeDP Jan 18, 2023

leogr Jan 18, 2023

FedeDP Jan 18, 2023

FedeDP commented Jan 18, 2023 •

edited

Loading

leogr commented Jan 19, 2023

FedeDP commented Jan 19, 2023

FedeDP commented Jan 19, 2023 •

edited

Loading

FedeDP Jan 19, 2023

FedeDP Jan 19, 2023

FedeDP Jan 19, 2023

jasondellaluce left a comment

Andreagit97 commented Jan 20, 2023

jasondellaluce left a comment

poiana commented Jan 25, 2023

Andreagit97 commented Jan 25, 2023


		string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} FALCOCTL_SYSTEM_NAME)

		set(FALCOCTL_VERSION "0.2.0-rc1")

new: ship falcoctl bundled with Falco #2345

new: ship falcoctl bundled with Falco #2345

Conversation

FedeDP commented Jan 10, 2023 • edited by leogr Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasondellaluce commented Jan 10, 2023

FedeDP commented Jan 11, 2023

FedeDP commented Jan 11, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Jan 18, 2023 • edited Loading

leogr commented Jan 19, 2023

FedeDP commented Jan 19, 2023

FedeDP commented Jan 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasondellaluce left a comment

Choose a reason for hiding this comment

Andreagit97 commented Jan 20, 2023

jasondellaluce left a comment

Choose a reason for hiding this comment

poiana commented Jan 25, 2023

Andreagit97 commented Jan 25, 2023

FedeDP commented Jan 10, 2023 •

edited by leogr

Loading

FedeDP commented Jan 18, 2023 •

edited

Loading

FedeDP commented Jan 19, 2023 •

edited

Loading