Added rule to detect LKM module injects using insmod used by rootkits for kernel hooking#1401

Closed

josehelps wants to merge 18 commits intofalcosecurity:masterfrom josehelps:add_lkm_inject_rule

+197-52

Commits on Sep 14, 2020

detect insmod trying to inject LKM modules
josehelps
committed

Commits on Oct 26, 2020

update(userspace/falco): move gRPC queue to proper namespace

leogr
authored and
poiana
committed
chore(userspace/falco): remove leftover from outputs

leogr
authored and
poiana
committed
chore: update copyright year to 2020

leogr
authored and
poiana
committed
chore(userspace/falco): remove unused dep from falco_outputs

leogr
authored and
poiana
committed
chore(userspace/falco): output class does not need to inherit from falco_common

leogr
authored and
poiana
committed
update(falco/rules): re-use spawned_process macro inside container_started macro

leodido
authored and
poiana
committed
fix(userspace/falco): use given priority for msg

leogr
authored and
poiana
committed
update(proposals): proposal for moving the drivers to S3

fntlnz
authored and
poiana
committed

Commits on Oct 27, 2020

fix(userspace/engine): free formatters, if any

leogr
authored and
poiana
committed
update(userspace/engine): handle formatters with smart pointer

authored and
poiana
committed

Commits on Oct 28, 2020

rule(Full K8s... Access): fix users list

mstemm
authored and
poiana
committed
docs(proposals): new drivers storage obsolate part of existing artifacts storage proposals

authored and
poiana
committed
update: new DRIVERS_REPO default

authored and
poiana
committed

Commits on Oct 30, 2020

rule(list falco_privileged_images): add calico/node without registry prefix

Christian Zunker
authored and
poiana
committed

Commits on Nov 3, 2020