Leonardo Di Giovanna

[Tracking] Extend syscall exit events with syscall enter events parameters

86

This is a tracking issue for all tasks related to extending the syscall exit events with the parameter coming from the corresponding syscall enter events. The consensus on this work...

fix(driver): cast rets and fds to 32 bits before sending them in dup*

4

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: /kind bug > /kind cleanup > /kind design > /kind documentation > /kind failing-test > /kind...

test(userspace/libsinsp/parsers): check fd info set by epoll_create{1}

3

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design > /kind documentation > /kind failing-test /kind...

[Tracking] Isolate libsinsp components from sinsp

4

This is a tracking issue for all works aiming to isolate the different libsinsp components from `sinsp`, as concerns raised in https://github.com/falcosecurity/libs/pull/2335 indicate that the work requires a more structured...

Redesign the plugins CI using a modular approach

5

**Motivation** Currently, the CI uses a monolithic approach to build all the plugins, installing the dependencies needed by the build process of each plugin in a shared environment, and building...

Refactor `krsi` plugin auxiliary buffer

3

The `krsi` plugin auxiliary buffer has some dependencies on external components (e.g.: shared_state and bpf helpers) that can be avoided). Moreover, it massively uses unsafe code and has some unsound...

**Describe the bug** `falco --list --markdown` reports `Event Sources: syscall` for fields applicable to any event type. **How to reproduce it** Install the latest Falco release (e.g.: 0.42.0-rc3) and run...

wip: ci(drivers_ci): move drivers build for `ppc64le` to dedicated runner

2

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design > /kind documentation > /kind failing-test /kind...

wip: wip

2

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design > /kind documentation > /kind failing-test /kind...

`evt.rawarg.*` doesn't correctly handle all parameter types

2

**Describe the bug** The current implementation doesn't support the evaluation of `evt.rawarg.*` filterchecks for parameters having specific underlying types. Specifically, it throws an exception for the followings: - ~~`PT_PID`~~ ->...