Cut Falco 0.32.1 Release

[LucaGuerra]

Type

This is a patch release.

Date

July 11th, 2022

Release Version

https://github.com/falcosecurity/falco/releases/tag/0.32.1

libs: https://github.com/falcosecurity/libs/tree/0.7.0
drivers: https://github.com/falcosecurity/libs/releases/tag/2.0.0%2Bdriver

Release Steps

Read the release process for a detailed explanation.

Release Blocking PRs

This list will be updated as more issues are addressed.

• new(libscap): add /proc scan vtable functions, wire them to gvisor implementation libs#404
• new(libscap): gVisor sandboxes trace session set up with runsc  libs#393
• Better support for dup syscall family libs#385
• new: support driverkit multiarch driver builds test-infra#734
• fix(ci): sign arm64 rpm packages. #2069
• new(falco): add gVisor support #2078
• fix(gvisor): initialize missing variables libs#420
• chore(drivers): add a warning for not officially supported archs libs#421
• Support execve exit events and clone child exit events on ARM64 libs#416
• update(libsinsp): add a way to generate gVisor trace session config file libs#425
• fix(scap_engine_bpf): enable _64BIT_ARGS_SINGLE_REGISTER on ARM64 libs#418
• new(gvisor): get socket from configuration file, fix tests libs#429
• update(gvisor): implement parsing for procfs regular files libs#430
• new(gvisor): add new syscalls (update to gvisor 45b06bbb) libs#438
• fix(docker): fixed deb tester sub image. #2100
• fix(libscap): bump minimum schema version to 2.0.0 libs#445
• chore(cmake): bump plugins versions #2102
• fix(gvisor): fix epoll use-after-free libs#458

Nice to Have

• refactor(userspace/engine): drop macro source field in rules and rule loader #2094 (cleanup)
• docs(readme): added arm64 mention + packages + badge. #2101 (can be done post release but documentation needs to be added!)
• new(circleci): enable integration tests for arm64. #2099
• update(userspace/falco): support libs logging #2093
• update(gvisor): implement get_stats for gVisor libs#463

Action Items

• Pre-Release
  • Prebuilt drivers publish (including ARM)
  • Update milestones for closed issues to 0.32.1
  • Changelog
  • Update and tag plugins
  • Bump plugins in Falco
• Release
  • Tag
  • GitHub Release
• Website
  • Bump Falco version to 0.32.1
  • Update syscall and supported fields
• Announcements
• Post-Rlease
  • Helm Charts

Test checklist

The following items are useful for anyone that wishes to test this release when RC's are out depending on the environment they have available. Help is appreciated as always.

Installation types

• Kubernetes Helm Chart
• Container only (without kubernetes)
• eBPF probe installation
• Local DEB package
• Local RPM package
• Local binary
• Local binary (musl-static)

0.32.1 specific checklist

• fix(driver): drop EF_USES_FD and EF_MODIFIES_STATE flags for enter events generated by uring syscalls libs#395
  • See description in the PR: "When Falco is running with -A option enabled and receives events generated by io_uring_enter and io_uring_register syscalls it crashes"
• Falco-driver-loader recent modifications
  • update(falco_scripts): Change Flatcar dynlinker path #2066

/assign @LucaGuerra
/kind documentation

[jasondellaluce]

Thanks @LucaGuerra! I created a 0.32.1 milestone and moved there all currently closed PRs.

[leogr]

Hey @LucaGuerra

Thank you! Could you also add PR #2069 please?

[Andreagit97]

Hey @LucaGuerra

could you please add PR falcosecurity/libs#418 ?

[jasondellaluce]

@LucaGuerra PTAL at these two and see if they could be useful. I think they be good nice-to-haves:

• update(userspace/falco): make webserver threadiness configurable #2090
• update(userspace/falco): support libs logging #2093

[jasondellaluce]

@LucaGuerra The Plugin SDK Go and the Falcosecurity plugins have been tagged released to new versions (also available for ARM64)!

• https://github.com/falcosecurity/plugin-sdk-go/releases/tag/v0.5.0
• https://github.com/falcosecurity/plugins/releases

[jasondellaluce]

Another nice-to-have: #2094

[FedeDP]

I think falcosecurity/test-infra#745 and falcosecurity/test-infra#746 need to be added (very quick fixes, the former is already in, the latter needs a review!)

[FedeDP]

@LucaGuerra can you add #2099 + #2101 as nice-to-have, and #2100 as mandatory (to fix integration tests :/ )

[wdoekes]

That libs version change in this patch bump between 0.32.0 and 0.32.1 was quite unexpected. It's not a problem, but I will call it a strange choice.

https://git.osso.nl/pub/docker/falco-ebpf-build/-/commit/76ca2dfff8d2c4835094a346768533cde1172629

[jasondellaluce]

@wdoekes if you're interested in the rationale, this is the result of the driver and libs versioning proposals 👇🏼

• https://github.com/falcosecurity/libs/blob/master/proposals/20210818-driver-semver.md
• https://github.com/falcosecurity/libs/blob/master/proposals/20220203-versioning-schema-amendment.md
• https://github.com/falcosecurity/libs/blob/master/proposals/20210524-versioning-and-release-of-the-libs-artifacts.md

[leogr]

Hey @LucaGuerra

The Falco Helm Chart 2.0 is out 👇
https://github.com/falcosecurity/charts/releases/tag/falco-2.0.0

PS I think we can close this issue now :)

[LucaGuerra]

Yes, that's what I was waiting for :) Thanks everyone!