Luca Guerra

fix(scripts): add eBPF jit warning

8

Signed-off-by: Luca Guerra **What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug /kind cleanup > /kind design > /kind documentation > /kind...

refactor(libsinsp): manage memory in ast/parser via unique_ptrs

5

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: /kind bug /kind cleanup **Any specific area of the project related to this PR?** > Uncomment...

new(libsinsp/tests): add basic dup/dup2/dup3 tests

3

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design > /kind documentation > /kind failing-test /kind...

Support Linux Security Modules hook for more accurate security tracing

44

**Motivation** Currently, Falco traces every supported system call using kernel tracepoints, both in the kernel module and eBPF probe. This works well, but in some specific cases it can lead...

new(libsinsp/test): add basic tests for networking and container events

4

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: /kind feature **Any specific area of the project related to this PR?** > Uncomment one (or...

This item keeps track of the effort for implementing this section of the artifact distribution proposal: https://github.com/falcosecurity/falco/blob/master/proposals/20221129-artifacts-distribution.md#deprecate-falco-driver-loader . > At the time of writing, `falco-driver-loader` is a shell script shipped...

In https://github.com/falcosecurity/libs/ we are able to perform some basic builds on platforms that are not Linux, namely Windows and MacOS. While we don't provide specific artifacts for those platforms there's...

update(falco): update libs to 7aaa5bd

4

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: /kind feature /area build **What this PR does / why we need it**: Update libs to...

SLSA Provenance Attestation for Falco

15

**Motivation** We have signatures with cosign, and our next step is to add provenance attestations to images and artifacts as well, in the same way we have in Falcoctl cc...

Discussion: Updating the default falco-driver-loader image

8

As we know we have three main avenues install the system instrumentation to get live syscall info into Falco: - The kernel module, for most kernel versions starting from selected...