Skip to content

Commit fa604d0

Browse files
therealbobotherealbobo
committed
wip
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
1 parent 827bd45 commit fa604d0

File tree

4 files changed

+96
-50
lines changed

4 files changed

+96
-50
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -99,34 +99,34 @@ jobs:
9999
path: |
100100
build/sysdig-*.tar.gz
101101
102-
#build-sysdig-others:
103-
# name: build-sysdig-${{ matrix.os }}-${{ matrix.arch }}
104-
# strategy:
105-
# matrix:
106-
# os: [windows-latest, macos-13, macos-14]
107-
# include:
108-
# - os: windows-latest
109-
# artifact_name: win
110-
# artifact_ext: exe
111-
# arch: x86_64
112-
# - os: macos-13
113-
# artifact_name: osx
114-
# artifact_ext: dmg
115-
# arch: x86_64
116-
# - os: macos-14
117-
# artifact_name: osx
118-
# artifact_ext: dmg
119-
# arch: arm64
120-
# runs-on: ${{ matrix.os }}
121-
# steps:
122-
# - name: Checkout Sysdig
123-
# uses: actions/checkout@v4
124-
# - name: Build
125-
# run: |
126-
# cmake -Wno-dev -S . -B build
127-
# cmake --build build --target package --config Release
128-
# - name: Upload Artifacts
129-
# uses: actions/upload-artifact@v4
130-
# with:
131-
# name: sysdig-dev-${{ matrix.artifact_name }}-${{ matrix.arch }}
132-
# path: build/sysdig-*.${{ matrix.artifact_ext }}
102+
build-sysdig-others:
103+
name: build-sysdig-${{ matrix.os }}-${{ matrix.arch }}
104+
strategy:
105+
matrix:
106+
os: [windows-latest, macos-13, macos-14]
107+
include:
108+
- os: windows-latest
109+
artifact_name: win
110+
artifact_ext: exe
111+
arch: x86_64
112+
- os: macos-13
113+
artifact_name: osx
114+
artifact_ext: dmg
115+
arch: x86_64
116+
- os: macos-14
117+
artifact_name: osx
118+
artifact_ext: dmg
119+
arch: arm64
120+
runs-on: ${{ matrix.os }}
121+
steps:
122+
- name: Checkout Sysdig
123+
uses: actions/checkout@v4
124+
- name: Build
125+
run: |
126+
cmake -Wno-dev -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -S . -B build
127+
cmake --build build --target package --config Release
128+
- name: Upload Artifacts
129+
uses: actions/upload-artifact@v4
130+
with:
131+
name: sysdig-dev-${{ matrix.artifact_name }}-${{ matrix.arch }}
132+
path: build/sysdig-*.${{ matrix.artifact_ext }}

‎CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ if(EXISTS ${CMAKE_CURRENT_BINARY_DIR}/CMakeLists.txt)
3333
"The following wiki page has more information on manually building sysdig: http://bit.ly/1oJ84UI")
3434
endif()
3535

36-
cmake_minimum_required(VERSION 3.5.1)
36+
cmake_minimum_required(VERSION 3.28)
3737

3838
project(sysdig)
3939

‎cmake/modules/container_plugin.cmake‎

Lines changed: 37 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,28 +17,48 @@ include(ExternalProject)
1717

1818
string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} PLUGINS_SYSTEM_NAME)
1919

20-
set(CONTAINER_LIBRARY
21-
"${CMAKE_CURRENT_BINARY_DIR}/container_plugin-prefix/src/container_plugin/libcontainer.so"
22-
)
20+
set(CONTAINER_VERSION "0.3.7")
2321

24-
if(NOT CONTAINER_VERSION)
25-
set(CONTAINER_VERSION "0.3.7")
26-
endif()
27-
if(NOT CONTAINER_HASH)
22+
if(UNIX)
23+
24+
set(CONTAINER_LIBRARY
25+
"${CMAKE_CURRENT_BINARY_DIR}/container_plugin-prefix/src/container_plugin/libcontainer.so"
26+
)
2827
if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
2928
set(CONTAINER_HASH "658f96c4b4a56d1bf945a788d60571076f808ae1bcc877c4ba3625b0fd752d8d")
3029
else() # arm64
3130
set(CONTAINER_HASH "34a153aca0164843a169193aba092a3063b24bca9ef80fd4f1d1f1919aba3bde")
3231
endif()
33-
endif()
34-
if(NOT TARGET container_plugin)
35-
message(STATUS "Fetching container plugin ${CONTAINER_VERSION} in '${CONTAINER_LIBRARY}'")
36-
ExternalProject_Add(
37-
container_plugin
38-
URL "https://download.falco.org/plugins/stable/container-${CONTAINER_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
39-
#URL_HASH "SHA256=${CONTAINER_HASH}"
40-
CONFIGURE_COMMAND ""
41-
BUILD_COMMAND ""
42-
INSTALL_COMMAND ""
32+
33+
if(NOT TARGET container_plugin)
34+
message(STATUS "Fetching container plugin ${CONTAINER_VERSION} in '${CONTAINER_LIBRARY}'")
35+
ExternalProject_Add(
36+
container_plugin
37+
URL "https://download.falco.org/plugins/stable/container-${CONTAINER_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
38+
#URL_HASH "SHA256=${CONTAINER_HASH}"
39+
CONFIGURE_COMMAND ""
40+
BUILD_COMMAND ""
41+
INSTALL_COMMAND ""
42+
)
43+
endif()
44+
else()
45+
46+
set(CONTAINER_LIBRARY
47+
"${CMAKE_CURRENT_BINARY_DIR}/container_plugin-prefix/src/container_plugin/plugins/container/libcontainer.so"
4348
)
49+
if(NOT TARGET container_plugin)
50+
message(STATUS "Fetching container plugin source ${CONTAINER_VERSION} in '${CONTAINER_LIBRARY}'")
51+
ExternalProject_Add(
52+
container_plugin
53+
URL "https://github.com/falcosecurity/plugins/archive/refs/tags/plugins/container/v${CONTAINER_VERSION}.tar.gz"
54+
#URL_HASH "${FALCOSECURITY_LIBS_CHECKSUM}"
55+
SOURCE_SUBDIR plugins/container
56+
BUILD_IN_SOURCE 1
57+
CONFIGURE_COMMAND
58+
${CMAKE_COMMAND} . -DENABLE_ASYNC=OFF -G "${CMAKE_GENERATOR}"
59+
BUILD_COMMAND ${CMAKE_COMMAND} --build . --config ${CMAKE_BUILD_TYPE}
60+
INSTALL_COMMAND ""
61+
)
62+
endif()
63+
4464
endif()

‎userspace/sysdig/sysdig.cpp‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -767,6 +767,7 @@ captureinfo do_inspect(sinsp* inspector,
767767

768768
inspector->start_capture();
769769

770+
uint64_t index = 0;
770771
//
771772
// Loop through the events
772773
//
@@ -786,6 +787,31 @@ captureinfo do_inspect(sinsp* inspector,
786787
break;
787788
}
788789
res = inspector->next(&ev);
790+
index++;
791+
if (index == 100000) {
792+
for (const auto& plugin : inspector->get_plugin_manager()->plugins())
793+
{
794+
if (plugin->name() == "security-fim")
795+
{
796+
std::cout << "LOADING NEW CONF\n";
797+
std::string newconf = R"V0G0N({"policies":[{"roots":[""],"monitored":["/etc/.*conf","/etc/passwd"],"excluded":[],"use_regex":true}]})V0G0N";
798+
plugin->set_config(newconf);
799+
}
800+
}
801+
802+
}
803+
if (index == 500000) {
804+
for (const auto& plugin : inspector->get_plugin_manager()->plugins())
805+
{
806+
if (plugin->name() == "security-fim")
807+
{
808+
std::cout << "LOADING NEW CONF\n";
809+
std::string newconf = R"V0G0N({"policies":[{"roots":[""],"monitored":["/etc/.*conf","/etc/passwd"],"excluded":["/etc/bobo.conf"],"use_regex":true}]})V0G0N";
810+
plugin->set_config(newconf);
811+
}
812+
}
813+
814+
}
789815
if(dumper && ev && res != SCAP_EOF)
790816
{
791817
dumper->dump(ev);
@@ -1148,7 +1174,7 @@ sysdig_init_res sysdig_init(int argc, char **argv)
11481174
plugins.read_plugins_from_dirs(inspector.get());
11491175

11501176
// Load container plugin
1151-
auto container_config = R"({"engines":{"docker":{"enabled":true,"sockets":["/var/run/docker.sock"]},"podman":{"enabled":true,"sockets":["/run/podman/podman.sock","/run/user/1000/podman/podman.sock"]},"containerd":{"enabled":false,"sockets":["/run/containerd/containerd.sock"]},"cri":{"enabled":true,"sockets":["/run/crio/crio.sock"]},"lxc":{"enabled":false},"libvirt_lxc":{"enabled":false},"bpm":{"enabled":false}}})";
1177+
auto container_config = R"({"hooks":["create","start"],"engines":{"docker":{"enabled":true,"sockets":["/var/run/docker.sock"]},"podman":{"enabled":true,"sockets":["/run/podman/podman.sock","/run/user/1000/podman/podman.sock"]},"containerd":{"enabled":false,"sockets":["/run/containerd/containerd.sock"]},"cri":{"enabled":true,"sockets":["/run/crio/crio.sock"]},"lxc":{"enabled":false},"libvirt_lxc":{"enabled":false},"bpm":{"enabled":false}}})";
11521178
plugins.load_plugin(inspector.get(), "container");
11531179
plugins.config_plugin(inspector.get(), "container", container_config);
11541180

0 commit comments

Comments
 (0)