Released on 2020-24-09
| Official Stable Download 0.26.0 | |
|---|---|
| rpm | |
| deb | |
| binary |
Major Changes
- new: driver updated to 2aa88dcf6243982697811df4c1b484bcbe9488a2 [#1410]
- new(scripts/falco-driver-loader): detect and try to build the Falco kernel module driver using different GCC versions available in the current environment. [#1408]
- new: tgz (tarball) containing the statically-linked (musl) binary of Falco is now automatically built and published on bintray [#1377]
Minor Changes
- update: bump Falco engine version to 7 [#1381]
- update: the required_engine_version is now on by default [#1381]
- update: falcosecurity/falco-no-driver image now uses the statically-linked Falco [#1377]
- docs(proposals): artifacts storage [#1375]
- docs(proposals): artifacts cleanup [#1375]
Rule Changes
- rule: Address several sources of FPs, primarily from GKE environments. [#1372]
- rule(macro inbound_outbound): add brackets to disambiguate operator precedence [#1373]
- rule(macro redis_writing_conf): add brackets to disambiguate operator precedence [#1373]
- rule(macro run_by_foreman): add brackets to disambiguate operator precedence [#1373]
- rule(macro consider_packet_socket_communication): enable "Packet socket created in container" rule by default. [#1402]
- rule(Delete or rename shell history): skip docker overlay filesystems when considering bash history [#1393]
- rule(Disallowed K8s User): quote colons in user names [#1393]
- rule(macro falco_sensitive_mount_containers): Adds a trailing slash to avoid repo naming issues [#1394]
- rule: adds user.loginuid to the default Falco rules that also contain user.name [#1369]
This file documents all notable changes to Falco. The release numbering uses semantic versioning.
Statistics
| Merged PRs | Number |
|---|---|
| Not user-facing | 5 |
| Release note | 13 |
| Total | 18 |