Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Major Changes

• new: add a drop_pct referred to the global number of events [#2130] - @Andreagit97
• new: print some info about eBPF and enabled sources when Falco starts [#2133] - @Andreagit97
• new(userspace): print architecture information [#2147] - @Andreagit97
• new(CI): add CodeQL security scanning to Falco. [#2171] - @Andreagit97
• new: configure syscall buffer dimension from Falco [#2214] - @Andreagit97
• new(cmdline): add development support for modern BPF probe [#2221] - @Andreagit97
• new(falco-driver-loader): DRIVERS_REPO now supports the use of multiple download URLs (comma separated) [#2165] - @IanRobertson-wpe
• new(userspace/engine): support alternative plugin version requirements in checks [#2190] - @jasondellaluce
• new: support running multiple event sources in parallel [#2182] - @jasondellaluce
• new(userspace/falco): automatically create paths for grpc unix socket and gvisor endpoint. [#2189] - @FedeDP
• new(scripts): allow falco-driver-loader to properly distinguish any ubuntu flavor [#2178] - @FedeDP
• new: add option to enable event sources selectively [#2085] - @jasondellaluce

Minor Changes

• docs(falco-driver-loader): add some comments in falco-driver-loader [#2153] - @Andreagit97
• update(cmake): use latest libs tag 0.9.0 [#2257] - @Andreagit97
• update(.circleci): re-enabled cppcheck [#2186] - @leogr
• update(userspace/engine): improve falco files loading performance [#2151] - @VadimZy
• update(cmake): use latest driver tag 3.0.1+driver [#2251] - @Andreagit97
• update(userspace/falco)!: adapt stats writer for multiple parallel event sources [#2182] - @jasondellaluce
• refactor(userspace/engine): remove falco engine APIs that returned a required_engine_version [#2096] - @mstemm
• update(userspace/engine): add some small changes to rules matching that reduce cpu usage with high event volumes (> 1M syscalls/sec) [#2210] - @mstemm
• rules: added process IDs to default rules [#2211] - @spyder-kyle
• update(scripts/debian): falco.service systemd unit is now cleaned-up during (re)install and removal via the DEB and RPM packages [#2138] - @Happy-Dude
• update(userspace/falco): move on from deprecated libs API for printing event list [#2253] - @jasondellaluce
• chore(userspace/falco): improve cli helper and log options with debug level [#2252] - @jasondellaluce
• update(userspace): minor pre-release improvements [#2236] - @jasondellaluce
• update: bumped libs to fd46dd139a8e35692a7d40ab2f0ed2016df827cf. [#2201] - @FedeDP
• update!: gVisor sock default path changed from /tmp/gvisor.sock to /run/falco/gvisor.sock [#2163] - @vjjmiras
• update!: gRPC server sock default path changed from /run/falco.sock.sock to /run/falco/falco.sock [#2163] - @vjjmiras
• update(scripts/falco-driver-loader): minikube environment is now correctly detected [#2191] - @alacuku
• update(rules/falco_rules.yaml): required_engine_version changed to 13 [#2179] - @incertum
• refactor(userspace/falco): re-design stats writer and make it thread-safe [#2109] - @jasondellaluce
• refactor(userspace/falco): make signal handlers thread safe [#2091] - @jasondellaluce
• refactor(userspace/engine): strengthen and document thread-safety guarantees of falco_engine::process_event [#2082] - @jasondellaluce
• update(userspace/falco): make webserver threadiness configurable [#2090] - @jasondellaluce
• refactor(userspace/falco): reduce app actions dependency on app state and inspector [#2097] - @jasondellaluce
• update(userspace/falco): use move semantics in falco logger [#2095] - @jasondellaluce
• update: use FALCO_HOSTNAME env var to override the hostname value [#2174] - @leogr
• update: bump libs and driver versions to 6599e2efebce30a95f27739d655d53f0d5f686e4 [#2177] - @jasondellaluce
• refactor(userspace/falco): make output rate limiter optional and output engine explicitly thread-safe [#2139] - @jasondellaluce
• update(falco.yaml)!: notification rate limiter disabled by default. [#2139] - @jasondellaluce

Bug Fixes

• fix: compute the drop ratio in the right way [#2128] - @Andreagit97
• fix(falco_service): falco service needs to write under /sys/module/falco [#2238] - @Andreagit97
• fix(userspace): cleanup output of ruleset validation result [#2248] - @jasondellaluce
• fix(userspace): properly print ignored syscalls messages when not in -A mode [#2243] - @jasondellaluce
• fix(falco): clarify pid/tid and container info in gvisor [#2223] - @LucaGuerra
• fix(userspace/engine): avoid reading duplicate exception values [#2200] - @jasondellaluce
• fix: hostname was not present when json_output: true [#2174] - @leogr

Rule Changes

• rule(macro: known_gke_mount_in_privileged_containers): add new macro [#2198] - @hi120ki
• rule(Mount Launched in Privileged Container): add GKE default pod into allowlist in Mount Launched of Privileged Container rule [#2198] - @hi120ki
• rule(list: known_binaries_to_read_environment_variables_from_proc_files): add new list [#2193] - @hi120ki
• rule(Read environment variable from /proc files): add rule to detect an attempt to read process environment variables from /proc files [#2193] - @hi120ki
• rule(macro: k8s_containers): add falco no-driver images [#2234] - @jasondellaluce
• rule(macro: open_file_failed): add new macro [#2118] - @incertum
• rule(macro: directory_traversal): add new macro [#2118] - @incertum
• rule(Directory traversal monitored file read): add new rule [#2118] - @incertum
• rule(Modify Container Entrypoint): new rule created to detect CVE-2019-5736 [#2188] - @darryk10
• rule(Program run with disallowed http proxy env)!: disabled by default [#2179] - @incertum
• rule(Container Drift Detected (chmod))!: disabled by default [#2179] - @incertum
• rule(Container Drift Detected (open+create))!: disabled by default [#2179] - @incertum
• rule(Packet socket created in container)!: removed consider_packet_socket_communication macro [#2179] - @incertum
• rule(macro: consider_packet_socket_communication)!: remove unused macro [#2179] - @incertum
• rule(Interpreted procs outbound network activity)!: disabled by default [#2166] - @incertum
• rule(Interpreted procs inbound network activity)!: disabled by default [#2166] - @incertum
• rule(Contact cloud metadata service from container)!: disabled by default [#2166] - @incertum
• rule(macro: consider_interpreted_outbound)!: remove unused macro [#2166] - @incertum
• rule(macro: consider_interpreted_inbound)!: remove unused macro [#2166] - @incertum
• rule(macro: consider_metadata_access)!: remove unused macro [#2166] - @incertum
• rule(Unexpected outbound connection destination)!: disabled by default [#2168] - @incertum
• rule(Unexpected inbound connection source)!: disabled by default [#2168] - @incertum
• rule(Read Shell Configuration File)!: disabled by default [#2168] - @incertum
• rule(Schedule Cron Jobs)!: disabled by default [#2168] - @incertum
• rule(Launch Suspicious Network Tool on Host)!: disabled by default [#2168] - @incertum
• rule(Create Hidden Files or Directories)!: disabled by default [#2168] - @incertum
• rule(Outbound or Inbound Traffic not to Authorized Server Process and Port)!: disabled by default [#2168] - @incertum
• rule(Network Connection outside Local Subnet)!: disabled by default [#2168] - @incertum
• rule(macro: consider_all_outbound_conns)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_all_inbound_conns)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_shell_config_reads)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_all_cron_jobs)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_all_inbound_conns)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_hidden_file_creation)!: remove unused macro [#2168] - @incertum
• rule(macro: allowed_port)!: remove unused macro [#2168] - @incertum
• rule(macro: enabled_rule_network_only_subnet)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_userfaultfd_activities)!: remove unused macro [#2168] - @incertum
• rule(macro: consider_all_chmods)!: remove unused macro [#2168] - @incertum
• rule(Set Setuid or Setgid bit)!: removed consider_all_chmods macro [#2168] - @incertum
• rule(Container Drift Detected (chmod))!: removed consider_all_chmods macro [#2168] - @incertum
• rule(Unprivileged Delegation of Page Faults Handling to a Userspace Process)!: removed consider_userfaultfd_activities macro [#2168] - @incertum

Non user-facing changes

• new(userspace): support SCAP_FILTERED_EVENT return code [#2148] - @Andreagit97
• chore(test/utils): remove unused script [#2157] - @Andreagit97
• Enrich pull request template [#2162] - @Andreagit97
• vote: update(OWNERS): add Andrea Terzolo to owners [#2185] - @Andreagit97
• fix(CI): codespell should ignore ro word [#2173] - @Andreagit97
• chore: bump plugin version [#2256] - @Andreagit97
• fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources [#2255] - @jasondellaluce
• fix(scripts): inject kmod script fails with some systemd versions [#2250] - @Andreagit97
• chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs [#2249] - @jasondellaluce
• chore: bump libs version [#2244] - @Andreagit97
• update(userspace): solve warnings and performance tips from cppcheck [#2247] - @jasondellaluce
• fix(userspace/falco): make signal termination more robust with multi-threading [#2235] - @jasondellaluce
• fix(userspace/falco): make termination and signal handlers more stable [#2239] - @jasondellaluce
• fix(userspace): safely check string bounded access [#2237] - @jasondellaluce
• chore: bump libs/driver to the latest release branch commit [#2232] - @Andreagit97
• fix(userspace/falco): check plugin requirements when validating rule files [#2233] - @jasondellaluce
• fix(userspace): add explicit constructors and initializations [#2229] - @jasondellaluce
• Add StackRox to adopters [#2187] - @Molter73
• fix(process_events): check the return value of open_live_inspector [#2215] - @Andreagit97
• fix(userspace/engine): properly include stdexcept header to fix build. [#2197] - @FedeDP
• refactor(userspace/engine): split rule loader classes for a more testable design [#2206] - @jasondellaluce
• chore(OWNERS): cleanup inactive reviewer [#2204] - @leogr
• fix(circleci): falco-driver-loader image build must be done starting from just-pushed falco master image. [#2194] - @FedeDP
• Support condition parse errors in rule loading results [#2155] - @mstemm
• docs: readme update [#2183] - @leogr
• cleanup: rename legacy references [#2180] - @jasondellaluce
• refactor(userspace/engine): increase const coherence in falco engine [#2081] - @jasondellaluce
• Rules result handle multiple files [#2158] - @mstemm
• fix: print full rule load errors/warnings without verbose/-v [#2156] - @mstemm

Statistics

Release Manager @jasondellaluce