falcosecurity / libs

libsinsp, libscap, the kernel module driver, and the eBPF driver sources

https://falcosecurity.github.io/libs/

falcosecurity/libs Issues

Serious eBPF driver regression starting with 0.16.x libs
Updated 11 days ago5
[BUG] Broken plugins metrics support
Updated 11 days ago
[DECISION/VOTE]: Clarify acceptability of a BPF probe-centric approach for custom driver management
Updated 12 days ago16
Add Fortify strings check to CI
Updated 13 days ago1
Legacy bpf probe verifier issue in `find_new_reaper_pid`
Updated 14 days ago6
[TRACKING] Improve container engine state handling
Updated 15 days ago3
[Feature] Supporting field transformers in filtering language
Closed 15 days ago9
Container Engine Refactor (CRI)
Updated 21 days ago4
[TRACKING] End-to-End Test Contribution Proposal
Updated 21 days ago4
modern-bpf fails to load on RHEL 8.6 ppc64le (unsupported opcode)
Closed 25 days ago5
[FEATURE/BUG] Bpf module test failed on loongarch
Updated a month ago5
Kubernetes pod labels are sometimes missing
Updated a month ago3
[LIBS PLUGINS] Accessors to libs state tables fields
Closed a month ago9
Cache Kernel sources for e2e tests
Closed a month ago7
[DISCUSSION] [PLUGIN API] Notes from the Rust world
Updated a month ago6
[-DBUILD_SHARED_LIBS=ON] "error: driver/syscall_compat_x86_64.h: No such file or directory" at build time
Updated a month ago4
libsinsp.pc references build tree instead of install prefix
Updated a month ago1
Last stable release (0.14.3) fails to build kernel module with Linux 6.8.
Closed a month ago6
pack_addr supports parsing AF_NETLINK protocol
Updated a month ago5
Under the arm architecture，function perf_event_mmap error happened
Closed 2 months ago5
modern-bpf probe loading fails on ppc64le RHEL 8.6
Closed 2 months ago13
[BUG] Compile modern_bpf error
Updated 2 months ago34
[BUG]: file related `dev` field extraction is dependent on the Filesystem type
Updated 2 months ago1
[BUG]: Possible errors in initializing assignment structures
Closed 2 months ago5
Introduce conditional kernel-side event filtering
Updated 2 months ago23
[Proposal] Chisels removal from libs
Closed 2 months ago6
Report coverage for tests
Updated 2 months ago
Coverage build is broken for plugin tests
Closed 2 months ago2
[BUG]: wrong relative paths resolution in `PPME_SYSCALL_LINKAT_2_X`
Updated 2 months ago4
sinsp_suppress m_cache optimization is not working
Closed 3 months ago17
The tracking of orphan processes is lost.
Updated 3 months ago5
CI asan jobs failures
Closed 3 months ago4
Add args for `sendmmsg` events
Updated 3 months ago6
[tracking] Improve code documentation
Updated 3 months ago1
Trying to compile `libinsp` on Alpine 3.19 results in error: 'int64_t' has not been declared
Closed 3 months ago3
[LIBS PLUGINS] Expose libs syscalls `PPME_` events enum over a new plugin API
Updated 3 months ago3
Expose `thread_table_absolute_max_size` as config
Closed 3 months ago3
scap dkms in zen-kernel 6.6.4 + causing deadlocks
Closed 4 months ago9
sys_procexit_e has more then 1M instruction on GKE (COS)
Closed 5 months ago3
[TRACKING] Libs Release (`0.14.1`)
Closed 5 months ago1
Enhancement Request: Introduce SQL Query Support for Falco Syscall Events
Closed 5 months ago3
Build fails when USE_BUNDLED_MODERN_BPF=OFF
Closed 5 months ago
gVisor engine crashes with non-hex container IDs
Closed 5 months ago1
Missing child clone call on arm64
Closed 6 months ago1
Cannot compile sysdig/libscap bpf driver in 6.6.4-zen kernel
Closed 5 months ago7
[TRACKING] Libs Release (`0.14.0`)
Closed 6 months ago4
`k8s.*` fields must be populated only if event originate from within a Kubernetes environment
Closed 6 months ago1
Place environment variables in an array
Closed 6 months ago3
Improve `k8s.` fields retrieved from container runtime socket robustness + expose full container id and pod ids
Closed 6 months ago7
cmake error：install TARGETS given target "scap" which does not exist in this directory.
Closed 6 months ago12