Getting started developing Falco – DEV Community

Whats up, Falcoers!
Eager about Falco and need to contribute your concepts? Feeling caught as a result of you do not know the place to start out? No worries, we’re right here to assist!
Whether or not you need Falco to monitor a new system call, add a model new characteristic, or remedy an issue you bumped into, you need to create a growth atmosphere. This weblog publish will stroll you thru the method of organising a brand new one with the intention to really feel snug and able to contribute!
Now, let’s go step-by-step, exhibiting what’s required to get began hacking on Falco. We hope this desk of contents will facilitate using this publish as a future reference.

Establishing the atmosphere

A peculiarity of the Falco challenge is that you could be want to write down some kernel-level code. An necessary consideration to make, even earlier than beginning to code, is that the eBPF probe and the kernel module ought to present precisely the identical options.
Because of this, when creating one thing on the eBPF probe, it is best to implement the identical performance on the kernel module and vice versa, with the intent of preserving characteristic parity throughout the 2 drivers.
Writing code on the kernel-level isn’t a straightforward activity. Particularly, the kernel module requires further care as a result of your code will run with full kernel privileges. Any little mistake could lead to a kernel panic, crashing the system.
However, eBPF programs are a lot safer than the kernel module, however generally you might must combat towards the verifier on completely different kernel variations.
For these causes, a few of us discover utilizing Vagrant extraordinarily useful. Vagrant is a instrument that means that you can simply spawn digital machines, with the intention to take a look at your code towards a number of kernel variations and Linux distributions with out inflicting any hurt to your system.

Making a devoted VM

When you have by no means used Vagrant earlier than, you first must download and install Vagrant and a Vagrant VM provider. You might need to set up VirtualBox since Vagrant comes with out-of-the-box assist. You possibly can comply with the Vagrant quickstart to perform this.
As soon as you’ll be able to spawn VMs with Vagrant, select a box from Vagrant Cloud containing your favourite distribution for growth.
As an illustration, if you wish to launch a Ubuntu Focal Fossa machine, you’ll be able to subject the next instructions:

$ mkdir ubuntu-vm && cd ubuntu-vm
$ vagrant init ubuntu/focal64
$ vagrant up

Vagrant initializes digital machines with the intention to simply entry them by way of SSH. This helps in case you additionally need to check out remote development, as an example with Visual Studio Code. This manner, it is possible for you to to seamlessly code, construct, and take a look at on the Vagrant digital machine!
Any longer, the command vagrant ssh will log you into the VM and you would begin working instantly. Nevertheless, until you like writing code on older (however very highly effective) instruments like Vim, you might really feel the necessity to use an IDE, as if you happen to had been creating in your native machine.
To take action, we are going to present you easy methods to lengthen Visible Studio Code capabilities by downloading the Distant - SSH extension. This extension helps you to use any distant machine that enables SSH entry as your growth atmosphere. This contains the VM you simply spawned with Vagrant.
After putting in the extension, from contained in the Vagrant VM listing, retrieve the SSH configuration:

$ vagrant ssh-config
Host default
  HostName 127.0.0.1
  Person vagrant
  Port 2222
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile /Customers/lorenzo.susini/vagrant/official-ubuntu/.vagrant/machines/default/virtualbox/private_key
  IdentitiesOnly sure
  LogLevel FATAL

Copy the output of the final command and paste it into the .ssh/config file in your native house listing. Additionally, we advocate altering the Host default line with one thing that helps you do not forget that that is the VM you employ for creating Falco. One thing like Host falco-dev would work.
Then, return to Visible Studio Code. Press Management + P (or Command + P on MacOS) and sort > Distant-SSH: Hook up with Host. Press Enter and you will note the falco-dev entry within the UI to hook up with the VM.

Your growth atmosphere is now up and working. You possibly can open distant folders and initiatives, and use all of the functionalities of Visible Studio Code!

Discovering the Falco code

Now, it is time to have some enjoyable. Falco’s supply code lives within the Falco organization on GitHub. The 2 repositories it is best to check out are:

• falcosecurity/libs, containing each the kernel module and the eBPF probe, and in addition libscap and libsinsp.
• falcosecurity/falco, together with the rule engine, guidelines, and assist for any sort of output, comparable to commonplace output, file output, gRPC, and extra.
  In case you’re not but accustomed to the general Falco structure, you’ll be able to go into element by studying the previous blog post.

Constructing Falco from scratch

More often than not, the primary place to begin for creating one thing is constructing it from scratch. You possibly can fork falco and libs, and clone them into your growth machine. Forking the repositories first is beneficial if you wish to later push the adjustments and save your work.
Then, attempt to comply with the steps in our official Falco documentation. Among the most helpful CMake definitions you might need to use are:

• -DUSE_BUNDLED_DEPS=ON means that you can obtain and compile all of the wanted Falco dependencies. This additionally helps to construct Falco independently of the libraries put in in your system.
  The construct course of will run trouble-free utilizing this feature, though it will likely be just a little bit slower.
• -DFALCOSECURITY_LIBS_SOURCE_DIR=/path/to/native/libs means that you can compile Falco with a neighborhood model of libs. If not specified, CMake will obtain the libs repository straight from GitHub.
  This selection is extraordinarily helpful if you end up implementing one thing that requires modification to each falco and libs repositories with the intention to simply take a look at what you coded.
• -DBUILD_BPF=ON permits compilation of the eBPF probe, essential when creating one thing on the eBPF driver.
• -DCMAKE_BUILD_TYPE=Debug is useful while you need to debug one thing. Debug info is printed out and assertions are enabled.
  The whole sequence of instructions you might need to run is:

$ mkdir construct && cd construct
$ cmake -DUSE_BUNDLED_DEPS=ON 
        -DFALCOSECURITY_LIBS_SOURCE_DIR=/path/to/native/libs 
        -DBUILD_BPF=ON 
        -DCMAKE_BUILD_TYPE=Debug  ..
$ make

Additionally, observe that you need to use the -jxxx choice of make to spawn a number of parallel jobs, the place xxx is the variety of jobs.

Testing your construct

Now that you’ve efficiently compiled Falco, attempt to run it. The default driver is the kernel module. To make use of it, assuming that you’re within the construct listing, simply sort:

$ sudo insmod driver/falco.ko
$ sudo ./userspace/falco/falco -c ../falco.yaml 
       -r ../guidelines/falco_rules.yaml

To start out Falco with the eBPF driver as an alternative, you could set the FALCO_BPF_PROBE atmosphere variable, like this:

$ sudo FALCO_BPF_PROBE=driver/bpf/probe.o ./userspace/falco/falco 
       -c ../falco.yaml  -r ../guidelines/falco_rules.yaml

Falco Occasion-Generator

Now that you simply constructed Falco, you might marvel if the whole lot works as anticipated. A fast and soiled approach of testing Falco is utilizing the event-generator.
That is yet one more challenge from the Falcosecurity group, and it may be used to generate some suspicious actions on the system, subsequently, triggering some Falco guidelines.
All you could do is to start out two terminals. You’ll launch Falco from one among them and go away it working. From the second terminal, launch the occasion generator utilizing the next command:

docker run -it --rm falcosecurity/event-generator run syscall

If the whole lot works high-quality, within the first terminal you opened you will note Falco alerting of some malicious behaviors from the container we began in the second.

Falco Take a look at Suite

It’s also possible to take a look at Falco through the use of its personal test-suite. The Falco test-suite makes use of the Avocado Framework to launch checks.
All you need to do is the next:

$ cd falco/take a look at
$ ./run_regression_tests.sh -p -v
$ virtualenv venv
$ supply venv/bin/activate
$ pip set up -r necessities.txt
$ BUILD_DIR="../construct" avocado run --mux-yaml falco_traces.yaml 
  --job-results-dir /tmp/job-results -- falco_test.py
$ deactivate

The run_regression_tests.sh script downloads and prepares hint recordsdata wanted for testing. Falco can devour these recordsdata containing some recorded system exercise that should set off guidelines.
If you need, you may as well confer with the documentation to launch different kinds of checks, comparable to rule engine and k8s audit logs checks, simply to call a couple of.
You possibly can relaunch these checks everytime you add one thing to the codebase, simply to ensure nothing obtained damaged after you performed round with it.
You are actually able to put your arms on Falco!

Writing your individual take a look at guidelines

At this level, as an instance you’ve launched a brand new syscall. A doable option to successfully take a look at it’s to write down a customized rule. You possibly can dig deeper on easy methods to write guidelines by studying the related section in the official documentation.
Falco’s rule syntax could be very easy and it is possible for you to to write down guidelines down very quickly. A rule is manufactured from:

To provide you just a little style of writing guidelines, let’s assume you’ve adopted the aforementioned post where we added support for a new syscall. You want to throw an alert each time a course of executes it.
You may create a rule.yaml file having this as content material:

- rule: My take a look at rule
  desc: Detects any course of executing openat2 and prints its identify and pid
  situation: evt.sort = openat2
  output: openat2 executed by (course of identify: %proc.identify, pid: %proc.pid)
  precedence: NOTICE

Then, you need to use the -r choice to inform Falco to make use of this rule file. After all, you’ll be able to create way more complicated and significant guidelines utilizing many alternative fields and operators.

Conclusion

You will have discovered easy methods to arrange a growth atmosphere with the assistance of Vagrant and Visible Studio Code, and easy methods to construct and run checks on Falco. You are actually all set to dig into the supply code, hack round, and unleash your creativity! We won’t wait to see a few of your PRs and construct one thing nice collectively!
You’ll find us within the Falco community. Please be happy to succeed in out to us for any questions, solutions, or only a pleasant chat!
If you need to search out out extra about Falco: