Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rule perf updates #95

Merged
merged 2 commits into from
Jul 12, 2016
Merged

Rule perf updates #95

merged 2 commits into from
Jul 12, 2016

Commits on Jul 12, 2016

  1. Performance/FP rule updates. 

    Make changes to rules to improve performance and reduce FPs:

- Rely on draios/sysdig#610 that allows
  specifying an open/openat for reading/writing without having to search
  through all the flags individually.

- For a two-item list (open, openat), and thinking ahead to
  draios/sysdig#624, check the event type
  individually instead of as a set membership test, which is a bit
  faster.

- Switch to consistently using evt.type instead of syscall.type.

- Move positive tests like etc_dir, bin_dir, sensitive_files,
  proc.sname, etc., which are most likely to not succeed, to the
  beginning of rules, so they have a greater chance to cause the rest of
  the rule to be skipped, which saves time.

- Using exim as a mail program--exim also can suid to root.

- add a new macro for ssl management binaries and allow them to write
  below /etc and read sensitive files.

- add a new macro for dhcp client binaries and allow them to write below
  /etc.

- Add exe (docker-related program) as a program that can set a namespace
  using setns.

- Don't count /dev/tty as an important file under /dev.
    @mstemm
    mstemm committed Jul 12, 2016
    Configuration menu
    Copy the full SHA
    a2011c3 View commit details
    Browse the repository at this point in the history

  2. Add ability to run branch-specific trace files. 

    Pass the travis branch to run_regression_tests.sh. When downloading
trace files, first look for a file traces-XXX-$BRANCH and if found
download it. This allows testing out a set of changes with a trace file
specifically for that branch, that can be moved to the normal file once
the PR is merged.

Also increase the timeout for the spawned falco process from 1 to 3
minutes. In debug mode, the kubernetes demo was taking slightly over 1
minute.
    @mstemm
    mstemm committed Jul 12, 2016
    Configuration menu
    Copy the full SHA
    8ffb553 View commit details
    Browse the repository at this point in the history