[RFC] ansible role for falco

[juju4]

/~https://github.com/juju4/ansible-falco/

If I can have feedback to on my rules work in progress, would be great too
/~https://github.com/juju4/ansible-falco/blob/master/templates/falco_rules_w_exceptions.yaml.j2

Thanks

[mstemm]

I haven't used ansible much, but that looks very useful and I'd be happy to make any necessary changes to support this work.

Wrt the rule changes, I'd suggest rebasing against dev so you pick up all the changes since 0.2.0. When comparing to the ruleset in 0.2.0, here are some suggestions:

• I like the ability to make a bunch of rules container-sensitive or not depending on falco_dontwatch_containers. I'd suggest putting that in a self-contained macro, though, so you don't have to sprinkle it amongst the other rules. Something like

macro: consider_containers
{% if falco_dontwatch_containers %}
condition: not container
{% else %>
condition: evt.num>0
{% end %}
...
rule: XXX
condition: consider_containers and ...

• Some of the exceptions you have related to pathnames with /etc in the middle should be unnecessary now that Add startswith as a string comparison operator. draios/sysdig#623 and Rule perf updates #95 are fixed.
• The other additions of innocuous programs are all welcome. If you'd like to submit a PR with those additions I'd be happy to fold them in.

Glad to see falco is useful for you!

[juju4]

Thanks, I'm doing rebasing and testing before a pull request.
In the few additions, I'm including, there is python usage like apt/rpm (ansible usage), kitchen-test and lxd/lxcfs containers.

[mstemm]

Hi, not sure if you got around to rebasing or not, but we'd like to send some end-of-year gifts to everyone who contributed to falco this year. If you'd like some schwag, could you send me your email address? I didn't see it on your profile. You can send it to mark.stemm@sysdig.com. Thanks!

[mstemm]

By the way, I tested the ansible role you created and it worked great. If you want to deploy a new version to ansible galaxy that's compatible with 0.9.0, please do! I've added a reference to your role to our wiki. I'll close this issue as the role is working.