Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: falcosecurity/libs
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: falcosecurity/libs
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: release/0.22.x
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 12 commits
  • 14 files changed
  • 3 contributors

Commits on Oct 14, 2025

  1. chore(userspace/libpman): make TOCTOU progs attachment fail msg clear 

    Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    bbec5b0 View commit details
    Browse the repository at this point in the history

  2. fix(userspace/libpman): close only attached TOCTOU mitigation programs 

    Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    7891239 View commit details
    Browse the repository at this point in the history

  3. fix(userspace/libscap): return correct fd location for some exit evts 

    Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    c0937a5 View commit details
    Browse the repository at this point in the history

  4. fix(driver/event_table): drop wrong EF_USES_FD flag from FSTAT64_X 

    Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    f60e75b View commit details
    Browse the repository at this point in the history

  5. test(libscap): assert ability to obtain fd loc from non-old exit evts 

    Assert ability to retrieve a valid fd location from non old exit
events.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    c7885c6 View commit details
    Browse the repository at this point in the history

  6. fix(userspace/libsinsp): avoid setting evt fdinfo in getsockopt parser 

    Setting the event's fdinfo by leveraging the event's fd parameter is
already done in `sinsp_parser::reset()` and can be avoided the
`getsockopt` exit event parser.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    65e6e5c View commit details
    Browse the repository at this point in the history

  7. refactor(userspace/libsinsp): clean parse_getsockopt_exit() impl 

    Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    75c3069 View commit details
    Browse the repository at this point in the history

  8. fix(userspace/libsinsp): avoid setting evt fdinfo in fch* parsers 

    Setting the event's fdinfo by leveraging the event's fd parameter is
already done in `sinsp_parser::reset()` and can be avoided the
`fchmod/fchown` exit event parsers. This means completely remove this
parsers.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
    @ekoops @poiana
    ekoops authored and poiana committed Oct 14, 2025
    Configuration menu
    Copy the full SHA
    f8a31dd View commit details
    Browse the repository at this point in the history

Commits on Oct 16, 2025

  1. chore(cmake/modules): bump container plugin to v0.4.0 

    Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
    @leogr @poiana
    leogr authored and poiana committed Oct 16, 2025
    Configuration menu
    Copy the full SHA
    5666ef4 View commit details
    Browse the repository at this point in the history

Commits on Oct 20, 2025

  1. chore(userspace/plugin): drop RTLD_DEEPBIND but keep `RTLD_LOCAL | RT… 

    …LD_NOW` for loading plugins

Partially revert 657e1d7

Co-authored-by: Iacopo Rozzo <iacopo@sysdig.com>
Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
    @leogr @irozzo-1A
    @ekoops @poiana
    3 people authored and poiana committed Oct 20, 2025
    Configuration menu
    Copy the full SHA
    1a8b912 View commit details
    Browse the repository at this point in the history

Commits on Oct 31, 2025

  1. fix(userspace/libsinsp): correct fallback for arg-less proc.* fields 

    Parsing of ARG_ALLOWED fields in output formatting (e.g., `proc_args=%proc.args`) was broken because the `val ==` check always returned false. This fix drops the unnecessary checks so that `argid = -1` is set /, `argname` is cleared where appropriate, and correctly sets field-name length using `std::size(...)-1`.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
    @leogr @poiana
    leogr authored and poiana committed Oct 31, 2025
    Configuration menu
    Copy the full SHA
    b63182f View commit details
    Browse the repository at this point in the history

Commits on Nov 3, 2025

  1. chore(cmake/modules): bump container plugin to v0.4.1 

    Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
    @leogr @poiana
    leogr authored and poiana committed Nov 3, 2025
    Configuration menu
    Copy the full SHA
    16c0267 View commit details
    Browse the repository at this point in the history
Loading