From c186fbad4aa9d1a25e9c2e8cf724f107e1cfd43f Mon Sep 17 00:00:00 2001 From: Spencer Krum Date: Tue, 2 Apr 2019 17:55:49 -0500 Subject: [PATCH] Add containerd related flags Signed-off-by: Spencer Krum sysdig-CLA-1.0-contributing-entity: International Business Machines sysdig-CLA-1.0-signed-off-by: Spencer Krum --- userspace/falco/falco.cpp | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index fdee94d78b3..31f32e718ca 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -84,6 +84,8 @@ static void usage() " -A Monitor all events, including those with EF_DROP_FALCO flag.\n" " -b, --print-base64 Print data buffers in base64. This is useful for encoding\n" " binary data that needs to be used over media designed to\n" + " --cri Path to CRI socket for container meatadata\n" + " Use the specified socket to fetch data from a CRI-compatible runtime\n" " -d, --daemon Run as a daemon\n" " -D Disable any rules matching the regex . Can be specified multiple times.\n" " Can not be specified with -t.\n" @@ -425,6 +427,7 @@ int falco_init(int argc, char **argv) bool list_flds = false; string list_flds_source = ""; bool print_support = false; + string cri_socket_path; // Used for writing trace files int duration_seconds = 0; @@ -604,6 +607,10 @@ int falco_init(int argc, char **argv) printf("falco version %s\n", FALCO_VERSION); return EXIT_SUCCESS; } + else if (string(long_options[long_index].name) == "cri") + { + cri_socket_path = optarg; + } else if (string(long_options[long_index].name) == "list") { list_flds = true; @@ -631,6 +638,12 @@ int falco_init(int argc, char **argv) inspector = new sinsp(); inspector->set_buffer_format(event_buffer_format); + // If required, set the CRI path + if(!cri_socket_path.empty()) + { + inspector->set_cri_socket_path(cri_socket_path); + } + // // If required, set the snaplen //