Skip to content

new!: support 0.25 API #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
poiana merged 7 commits into from
May 19, 2026
Merged

new!: support 0.25 API #82

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9249b11
fix(build): tell pkg-config to use static linking
gnosek May 18, 2026
25ac0d1
new: support API 0.23
gnosek May 6, 2026
3895bc7
new(schema): ignore PF_HEX for IPV*ADDR and PORT params
gnosek May 6, 2026
c6434f8
new(serde): support serializing IPV*ADDR fields
gnosek May 6, 2026
8afe570
new: support API 0.24
gnosek May 6, 2026
ab3572a
new(build): support local libs headers
gnosek May 6, 2026
6e8fe9c
new: support API 0.25
gnosek May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions falco_event/src/types/primitive/newtypes.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,21 @@ impl Debug for Fd {
}
}

newtype!(
/// File descriptor (32-bit)
Fd32(i32)
);

impl Debug for Fd32 {
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
if self.0 == -100 {
f.write_str("AT_FDCWD")
} else {
Debug::fmt(&self.0, f)
}
}
}

#[cfg(test)]
mod fd_tests {
use crate::types::Fd;
Expand All @@ -222,6 +237,12 @@ newtype!(
);
default_debug!(Pid);

newtype!(
/// Process or thread id (32-bit)
Pid32(i32)
);
default_debug!(Pid32);

newtype!(
/// User id
Uid(u32)
Expand Down Expand Up @@ -304,6 +325,23 @@ newtype!(
);
default_debug!(Port);

impl LowerHex for Port {
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
Debug::fmt(&self, f)
}
}

#[cfg(test)]
mod port_tests {
use crate::types::Port;

#[test]
fn test_port() {
assert_eq!(format!("{:?}", Port(12345)), "12345");
assert_eq!(format!("{:x}", Port(12345)), "12345");
}
}

newtype!(
/// Layer 4 protocol (tcp/udp)
///
Expand Down
2 changes: 1 addition & 1 deletion falco_event_schema/api/SCHEMA_VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
4.0.1
4.5.0
5 changes: 5 additions & 0 deletions falco_event_schema/api/dynamic_params_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,3 +27,8 @@ const struct ppm_param_info bpf_dynamic_param[PPM_BPF_IDX_MAX] = {
[PPM_BPF_IDX_FD] = {{0}, PT_FD, PF_DEC, 0, 0},
[PPM_BPF_IDX_RES] = {{0}, PT_ERRNO, PF_DEC, 0, 0},
};

const struct ppm_param_info keyctl_dynamic_param[PPM_KEYCTL_IDX_MAX] = {
[PPM_KEYCTL_IDX_INT64] = {{0}, PT_INT64, PF_DEC, 0, 0},
[PPM_KEYCTL_IDX_CHARBUF] = {{0}, PT_CHARBUF, PF_NA, 0, 0},
};
168 changes: 162 additions & 6 deletions falco_event_schema/api/event_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ or GPL2.txt for full copies of the license.
* - `EC_TRACEPOINT
* - `EC_PLUGIN`
* - `EC_METAEVENT`
* - `EC_ITER`
*
* 2. The lowest bits represent the syscall category to which the specific event belongs.
*
Expand Down Expand Up @@ -177,11 +178,12 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SOCKET_SOCKET_X] = {"socket",
EC_NET | EC_SYSCALL,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED,
4,
5,
{{"fd", PT_FD, PF_DEC},
{"domain", PT_ENUMFLAGS32, PF_DEC, socket_families},
{"type", PT_UINT32, PF_DEC},
{"proto", PT_UINT32, PF_DEC}}},
{"proto", PT_UINT32, PF_DEC},
{"flags", PT_FLAGS32, PF_HEX, file_flags}}},
[PPME_SOCKET_BIND_E] = {"bind",
EC_NET | EC_SYSCALL,
EF_OLD_VERSION | EF_USES_FD | EF_MODIFIES_STATE |
Expand Down Expand Up @@ -966,10 +968,11 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SYSCALL_FCNTL_X] = {"fcntl",
EC_IO_OTHER | EC_SYSCALL,
EF_USES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED,
3,
4,
{{"res", PT_FD, PF_DEC},
{"fd", PT_FD, PF_DEC},
{"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands}}},
{"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands},
{"arg", PT_UINT64, PF_HEX}}},
[PPME_SCHEDSWITCH_6_E] =
{"switch",
EC_SCHEDULER | EC_TRACEPOINT,
Expand Down Expand Up @@ -1351,6 +1354,15 @@ const struct ppm_event_info g_event_info[] = {
{{"event_type", PT_UINT32, PF_DEC},
{"event_data", PT_UINT64, PF_DEC}}},
[PPME_SCAPEVENT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SYSCALL_CLOSE_RANGE_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SYSCALL_CLOSE_RANGE_X] = {"close_range",
EC_IO_OTHER | EC_SYSCALL,
EF_MODIFIES_STATE,
4,
{{"res", PT_ERRNO, PF_DEC},
{"first", PT_UINT32, PF_DEC},
{"last", PT_UINT32, PF_DEC},
{"flags", PT_FLAGS32, PF_HEX, close_range_flags}}},
[PPME_SYSCALL_SETUID_E] = {"setuid",
EC_USER | EC_SYSCALL,
EF_OLD_VERSION | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED,
Expand Down Expand Up @@ -1981,7 +1993,7 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SYSCALL_EXECVE_19_X] = {"execve",
EC_PROCESS | EC_SYSCALL,
EF_MODIFIES_STATE | EF_CONVERTER_MANAGED,
30,
31,
{{"res", PT_ERRNO, PF_DEC},
{"exe", PT_CHARBUF, PF_NA},
{"args", PT_BYTEBUF, PF_NA},
Expand Down Expand Up @@ -2011,7 +2023,8 @@ const struct ppm_event_info g_event_info[] = {
{"uid", PT_UID, PF_DEC},
{"trusted_exepath", PT_FSPATH, PF_NA},
{"pgid", PT_PID, PF_NA},
{"gid", PT_GID, PF_DEC}}},
{"gid", PT_GID, PF_DEC},
{"filename", PT_FSPATH, PF_NA}}},
[PPME_SYSCALL_SETPGID_E] = {"setpgid",
EC_PROCESS | EC_SYSCALL,
EF_OLD_VERSION | EF_CONVERTER_MANAGED,
Expand Down Expand Up @@ -2796,6 +2809,149 @@ const struct ppm_event_info g_event_info[] = {
{{"res", PT_ERRNO, PF_DEC},
{"rgid", PT_UID, PF_DEC},
{"egid", PT_UID, PF_DEC}}},
[PPME_ITER_TASK_E] = {"task",
EC_ITER | EC_PROCESS,
EF_MODIFIES_STATE,
32,
{{"ppid", PT_PID32, PF_DEC},
{"pgid", PT_PID32, PF_DEC},
{"vpgid", PT_PID32, PF_DEC},
{"sid", PT_PID32, PF_DEC},
{"comm", PT_CHARBUF, PF_NA},
{"argv", PT_CHARBUFARRAY, PF_NA},
{"exepath", PT_FSPATH, PF_NA},
{"flags", PT_FLAGS32, PF_HEX, execve_flags},
{"env", PT_CHARBUFARRAY, PF_NA},
{"cwd", PT_CHARBUF, PF_NA},
{"fdlimit", PT_UINT64, PF_DEC},
{"euid", PT_UID, PF_DEC},
{"egid", PT_GID, PF_DEC},
{"cap_permitted", PT_UINT64, PF_HEX},
{"cap_effective", PT_UINT64, PF_HEX},
{"cap_inheritable", PT_UINT64, PF_HEX},
{"exe_ino_num", PT_UINT64, PF_DEC},
{"exe_ino_ctime", PT_ABSTIME, PF_DEC},
{"exe_ino_mtime", PT_ABSTIME, PF_DEC},
{"vm_size", PT_UINT32, PF_DEC},
{"vm_rss", PT_UINT32, PF_DEC},
{"vm_swap", PT_UINT32, PF_DEC},
{"pgft_maj", PT_UINT64, PF_DEC},
{"pgft_min", PT_UINT64, PF_DEC},
{"vtgid", PT_PID32, PF_DEC},
{"vpid", PT_PID32, PF_DEC},
{"pidns_init_start_ts", PT_UINT64, PF_DEC},
{"cgroups", PT_CHARBUFARRAY, PF_NA},
{"root", PT_FSPATH, PF_NA},
{"start_time", PT_ABSTIME, PF_DEC},
{"tty", PT_UINT32, PF_DEC},
{"loginuid", PT_UID, PF_DEC}}},
[PPME_ITER_TASK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_PIPE_E] = {"task_file_pipe",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
3,
{{"fd", PT_FD32, PF_DEC},
{"path", PT_FSPATH, PF_NA},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_PIPE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_MEMFD_E] = {"task_file_memfd",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
3,
{{"fd", PT_FD32, PF_DEC},
{"path", PT_FSPATH, PF_NA},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_MEMFD_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_REGULAR_E] = {"task_file_regular",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
5,
{{"fd", PT_FD32, PF_DEC},
{"path", PT_FSPATH, PF_NA},
{"flags", PT_FLAGS32, PF_HEX, file_flags},
{"mnt_id", PT_UINT32, PF_DEC},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_REGULAR_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_DIRECTORY_E] = {"task_file_directory",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
3,
{{"fd", PT_FD32, PF_DEC},
{"path", PT_FSPATH, PF_NA},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_DIRECTORY_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},

[PPME_ITER_TASK_FILE_SOCKET_INET_E] = {"task_file_socket_inet",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
8,
{{"fd", PT_FD32, PF_DEC},
{"sk_type", PT_UINT16, PF_DEC},
{"sk_proto", PT_UINT16, PF_DEC},
{"local_ip", PT_IPV4ADDR, PF_HEX},
{"local_port", PT_PORT, PF_HEX},
{"remote_ip", PT_IPV4ADDR, PF_HEX},
{"remote_port", PT_PORT, PF_HEX},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_SOCKET_INET_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},

[PPME_ITER_TASK_FILE_SOCKET_INET6_E] = {"task_file_socket_inet6",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
8,
{{"fd", PT_FD32, PF_DEC},
{"sk_type", PT_UINT16, PF_DEC},
{"sk_proto", PT_UINT16, PF_DEC},
{"local_ip", PT_IPV6ADDR, PF_HEX},
{"local_port", PT_PORT, PF_HEX},
{"remote_ip", PT_IPV6ADDR, PF_HEX},
{"remote_port", PT_PORT, PF_HEX},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_SOCKET_INET6_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_SOCKET_UNIX_E] = {"task_file_socket_unix",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
6,
{{"fd", PT_FD32, PF_DEC},
{"sk_type", PT_UINT16, PF_DEC},
{"sk_proto", PT_UINT16, PF_DEC},
{"sk_pointer", PT_UINT64, PF_NA},
{"sun_path", PT_FSPATH, PF_NA},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_SOCKET_UNIX_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_SOCKET_NETLINK_E] = {"task_file_socket_netlink",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
4,
{{"fd", PT_FD32, PF_DEC},
{"sk_type", PT_UINT16, PF_DEC},
{"sk_proto", PT_UINT16, PF_DEC},
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_SOCKET_NETLINK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_ITER_TASK_FILE_ANON_INODE_E] =
{"task_file_anon_inode",
EC_ITER | EC_FILE,
EF_MODIFIES_STATE,
4,
{{"fd", PT_FD32, PF_DEC},
{"fd_type", PT_FLAGS8, PF_DEC, anon_inode_fd_types},
{"path",
PT_FSPATH,
PF_NA}, // filled only if `fd_type == ANON_INODE_FD_TYPE_UNKNOWN`
{"ino_num", PT_UINT64, PF_DEC}}},
[PPME_ITER_TASK_FILE_ANON_INODE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SYSCALL_KEYCTL_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SYSCALL_KEYCTL_X] =
{"keyctl",
EC_OTHER | EC_SYSCALL,
EF_NONE,
6,
{{"res", PT_ERRNO, PF_DEC},
{"operation", PT_ENUMFLAGS32, PF_DEC, keyctl_operations},
{"arg2", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX},
{"arg3", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX},
{"arg4", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX},
{"arg5", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}}},
};
#pragma GCC diagnostic pop

Expand Down
5 changes: 4 additions & 1 deletion falco_event_schema/api/flag_types
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,4 +49,7 @@ type fsconfig_cmds: PT_ENUMFLAGS32;
type prctl_options: PT_ENUMFLAGS32;
type pidfd_open_flags: PT_FLAGS32;
type finit_module_flags: PT_FLAGS32;
type creat_flags: PT_FLAGS16;
type creat_flags: PT_FLAGS16;
type anon_inode_fd_types: PT_FLAGS8;
type close_range_flags: PT_FLAGS32;
type keyctl_operations: PT_ENUMFLAGS32;
62 changes: 62 additions & 0 deletions falco_event_schema/api/flags_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,7 @@ const struct ppm_name_value clone_flags[] = {
{"CLONE_STOPPED", PPM_CL_CLONE_STOPPED},
{"CLONE_VFORK", PPM_CL_CLONE_VFORK},
{"CLONE_NEWCGROUP", PPM_CL_CLONE_NEWCGROUP},
{"CLONE_CHILD_IN_PIDNS", PPM_CL_CHILD_IN_PIDNS},
{0, 0},
};

Expand Down Expand Up @@ -692,6 +693,43 @@ const struct ppm_name_value prctl_options[] = {
{0, 0},
};

const struct ppm_name_value keyctl_operations[] = {
{"KEYCTL_GET_KEYRING_ID", PPM_KEYCTL_GET_KEYRING_ID},
{"KEYCTL_JOIN_SESSION_KEYRING", PPM_KEYCTL_JOIN_SESSION_KEYRING},
{"KEYCTL_UPDATE", PPM_KEYCTL_UPDATE},
{"KEYCTL_REVOKE", PPM_KEYCTL_REVOKE},
{"KEYCTL_CHOWN", PPM_KEYCTL_CHOWN},
{"KEYCTL_SETPERM", PPM_KEYCTL_SETPERM},
{"KEYCTL_DESCRIBE", PPM_KEYCTL_DESCRIBE},
{"KEYCTL_CLEAR", PPM_KEYCTL_CLEAR},
{"KEYCTL_LINK", PPM_KEYCTL_LINK},
{"KEYCTL_UNLINK", PPM_KEYCTL_UNLINK},
{"KEYCTL_SEARCH", PPM_KEYCTL_SEARCH},
{"KEYCTL_READ", PPM_KEYCTL_READ},
{"KEYCTL_INSTANTIATE", PPM_KEYCTL_INSTANTIATE},
{"KEYCTL_NEGATE", PPM_KEYCTL_NEGATE},
{"KEYCTL_SET_REQKEY_KEYRING", PPM_KEYCTL_SET_REQKEY_KEYRING},
{"KEYCTL_SET_TIMEOUT", PPM_KEYCTL_SET_TIMEOUT},
{"KEYCTL_ASSUME_AUTHORITY", PPM_KEYCTL_ASSUME_AUTHORITY},
{"KEYCTL_GET_SECURITY", PPM_KEYCTL_GET_SECURITY},
{"KEYCTL_SESSION_TO_PARENT", PPM_KEYCTL_SESSION_TO_PARENT},
{"KEYCTL_REJECT", PPM_KEYCTL_REJECT},
{"KEYCTL_INSTANTIATE_IOV", PPM_KEYCTL_INSTANTIATE_IOV},
{"KEYCTL_INVALIDATE", PPM_KEYCTL_INVALIDATE},
{"KEYCTL_GET_PERSISTENT", PPM_KEYCTL_GET_PERSISTENT},
{"KEYCTL_DH_COMPUTE", PPM_KEYCTL_DH_COMPUTE},
{"KEYCTL_PKEY_QUERY", PPM_KEYCTL_PKEY_QUERY},
{"KEYCTL_PKEY_ENCRYPT", PPM_KEYCTL_PKEY_ENCRYPT},
{"KEYCTL_PKEY_DECRYPT", PPM_KEYCTL_PKEY_DECRYPT},
{"KEYCTL_PKEY_SIGN", PPM_KEYCTL_PKEY_SIGN},
{"KEYCTL_PKEY_VERIFY", PPM_KEYCTL_PKEY_VERIFY},
{"KEYCTL_RESTRICT_KEYRING", PPM_KEYCTL_RESTRICT_KEYRING},
{"KEYCTL_MOVE", PPM_KEYCTL_MOVE},
{"KEYCTL_CAPABILITIES", PPM_KEYCTL_CAPABILITIES},
{"KEYCTL_WATCH_KEY", PPM_KEYCTL_WATCH_KEY},
{0, 0},
};

const struct ppm_name_value memfd_create_flags[] = {
{"MFD_CLOEXEC", PPM_MFD_CLOEXEC},
{"MFD_ALLOW_SEALING", PPM_MFD_ALLOW_SEALING},
Expand Down Expand Up @@ -772,9 +810,33 @@ const struct ppm_name_value delete_module_flags[] = {
{0, 0},
};

const struct ppm_name_value close_range_flags[] = {
{"CLOSE_RANGE_UNSHARE", PPM_CLOSE_RANGE_UNSHARE},
{"CLOSE_RANGE_CLOEXEC", PPM_CLOSE_RANGE_CLOEXEC},
{0, 0},
};

const struct ppm_name_value finit_module_flags[] = {
{"MODULE_INIT_IGNORE_MODVERSIONS", PPM_MODULE_INIT_IGNORE_MODVERSIONS},
{"MODULE_INIT_IGNORE_VERMAGIC", PPM_MODULE_INIT_IGNORE_VERMAGIC},
{"MODULE_INIT_COMPRESSED_FILE", PPM_MODULE_INIT_COMPRESSED_FILE},
{0, 0},
};

const struct ppm_name_value anon_inode_fd_types[] = {
{"ANON_INODE_FD_TYPE_UNKNOWN", ANON_INODE_FD_TYPE_UNKNOWN},
{"ANON_INODE_FD_TYPE_EVENTFD", ANON_INODE_FD_TYPE_EVENTFD},
{"ANON_INODE_FD_TYPE_EVENTPOLL", ANON_INODE_FD_TYPE_EVENTPOLL},
{"ANON_INODE_FD_TYPE_INOTIFY", ANON_INODE_FD_TYPE_INOTIFY},
{"ANON_INODE_FD_TYPE_SIGNALFD", ANON_INODE_FD_TYPE_SIGNALFD},
{"ANON_INODE_FD_TYPE_TIMERFD", ANON_INODE_FD_TYPE_TIMERFD},
{"ANON_INODE_FD_TYPE_IO_URING", ANON_INODE_FD_TYPE_IO_URING},
{"ANON_INODE_FD_TYPE_USERFAULTFD", ANON_INODE_FD_TYPE_USERFAULTFD},
{"ANON_INODE_FD_TYPE_PIDFD", ANON_INODE_FD_TYPE_PIDFD},
{"ANON_INODE_FD_TYPE_BPF_MAP", ANON_INODE_FD_TYPE_BPF_MAP},
{"ANON_INODE_FD_TYPE_BPF_PROG", ANON_INODE_FD_TYPE_BPF_PROG},
{"ANON_INODE_FD_TYPE_BPF_LINK", ANON_INODE_FD_TYPE_BPF_LINK},
{"ANON_INODE_FD_TYPE_BPF_ITER", ANON_INODE_FD_TYPE_BPF_ITER},
{"ANON_INODE_FD_TYPE_PERF_EVENT", ANON_INODE_FD_TYPE_PERF_EVENT},
{0, 0},
};
Loading
Loading