Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

new(rules): BPF Program Not Profiled #157

Merged
merged 1 commit into from
Sep 11, 2023
Merged

new(rules): BPF Program Not Profiled #157

merged 1 commit into from
Sep 11, 2023

Conversation

incertum
Copy link
Contributor

@incertum incertum commented Sep 7, 2023 •
edited
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

Proposed rule maturity level

Uncomment one (or more) /area <> lines (only for PRs that add or modify rules):

/area maturity-stable

/area maturity-incubating

/area maturity-sandbox

/area maturity-deprecated

What this PR does / why we need it:

See rules desc.

@Andreagit97 @darryk10 @loresuso thanks!

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

@poiana poiana added area/maturity-sandbox See the Rules Maturity Framework approved size/S labels Sep 7, 2023
darryk10
darryk10 approved these changes Sep 8, 2023
View reviewed changes
Copy link
Contributor

@darryk10 darryk10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @incertum, this looks awesome!
just to keep in mind there might be some other projects using bpf which might need to be whitelist but this is a great starting point.
thanks LGTM

@poiana poiana added the lgtm label Sep 8, 2023
@poiana
Copy link

poiana commented Sep 8, 2023

LGTM label has been added.

Git tree hash: 5759cb9f69c40146993b1da9a20bb52870b1e78c

@incertum
Copy link
Contributor Author

incertum commented Sep 8, 2023

just to keep in mind there might be some other projects using bpf which might need to be whitelist but this is a great starting point. thanks LGTM

Agreed we could over time add some of the most popular programs in Kubernetes settings at least. Meanwhile, it's stated that it requires customization.

@incertum
Copy link
Contributor Author

incertum commented Sep 8, 2023

Captured some future logging improvements here falcosecurity/libs#1343 as discussed.

@poiana poiana removed the lgtm label Sep 8, 2023
@poiana poiana requested a review from darryk10 September 8, 2023 19:18
@incertum
Copy link
Contributor Author

incertum commented Sep 8, 2023 •
edited
Loading

Just noticed for bpf syscall it would be evt.arg.res_or_fd and not evt.res @Andreagit97 plz confirm.

Also should count as contribution to our modernization effort tracked here #138.

@incertum @Andreagit97 @darryk10
new(rules): add 'BPF Program Not Profiled'
86e7ded 
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Co-authored-by: darryk10 <stefano.chierici@sysdig.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Andreagit97
Andreagit97 approved these changes Sep 11, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Sep 11, 2023
@poiana
Copy link

poiana commented Sep 11, 2023

LGTM label has been added.

Git tree hash: a5d021f267292d4ac36e7113472770bbc6045e36

@poiana
Copy link

poiana commented Sep 11, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, darryk10, incertum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [Andreagit97,incertum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit c6e01fa into falcosecurity:main Sep 11, 2023
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Andreagit97 Andreagit97 Andreagit97 approved these changes

@Kaizhe Kaizhe Awaiting requested review from Kaizhe

@darryk10 darryk10 Awaiting requested review from darryk10

Assignees

@Andreagit97 Andreagit97

@darryk10 darryk10

Labels
approved area/maturity-sandbox See the Rules Maturity Framework area/rules dco-signoff: yes kind/feature New feature or request lgtm size/S
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@incertum @poiana @Andreagit97 @darryk10