deardaniel/secdata-raw huggingface dataset:
Falco Runtime Security: CMakeLists

# SPDX-License-Identifier: Apache-2.0
#
# Copyright (C) 2023 The Falco Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
# in compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
# or implied. See the License for the specific language governing permissions and limitations under
# the License.

add_library(
	falco_engine STATIC
	falco_common.cpp
	falco_engine.cpp
	falco_load_result.cpp
	falco_utils.cpp
	filter_ruleset.cpp
	evttype_index_ruleset.cpp
	formats.cpp
	field_formatter.cpp
	filter_details_resolver.cpp
	filter_macro_resolver.cpp
	filter_warning_resolver.cpp
	logger.cpp
	stats_manager.cpp
	rule_loader.cpp
	rule_loader_reader.cpp
	rule_loader_collector.cpp
	rule_loader_compiler.cpp
)

if(EMSCRIPTEN)
	target_compile_options(falco_engine PRIVATE "-sDISABLE_EXCEPTION_CATCHING=0")
endif()

set(ENGINE_LIBRARIES sinsp nlohmann_json::nlohmann_json yaml-cpp)

if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD)
	# Used by falco_utils.cpp
	add_dependencies(falco_engine openssl)
	list(APPEND ENGINE_LIBRARIES "${OPENSSL_LIBRARIES}")
endif()

target_include_directories(falco_engine PUBLIC ${CMAKE_CURRENT_SOURCE_DIR} ${TBB_INCLUDE_DIR})

target_link_libraries(falco_engine PUBLIC ${ENGINE_LIBRARIES})
Falco Runtime Security: CMakeLists

# SPDX-License-Identifier: Apache-2.0
#
# Copyright (C) 2023 The Falco Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
# in compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
# or implied. See the License for the specific language governing permissions and limitations under
# the License.
#

message(STATUS "Falco unit tests build enabled")

include(FetchContent)

FetchContent_Declare(
	googletest
	GIT_REPOSITORY https://github.com/google/googletest.git
	GIT_TAG v1.14.0
)

FetchContent_MakeAvailable(googletest)

# Create a libscap_test_var.h file with some variables used by our tests (e.g: the kmod path).
configure_file(
	${CMAKE_CURRENT_SOURCE_DIR}/falco_test_var.h.in ${CMAKE_CURRENT_BINARY_DIR}/falco_test_var.h
)

add_executable(
	falco_unit_tests
	test_falco_engine.cpp
	engine/test_add_source.cpp
	engine/test_alt_rule_loader.cpp
	engine/test_enable_rule.cpp
	engine/test_extra_output.cpp
	engine/test_falco_utils.cpp
	engine/test_filter_details_resolver.cpp
	engine/test_filter_macro_resolver.cpp
	engine/test_filter_warning_resolver.cpp
	engine/test_plugin_requirements.cpp
	engine/test_rule_loader.cpp
	engine/test_rulesets.cpp
	falco/test_capture.cpp
	falco/test_configuration.cpp
	falco/test_configuration_rule_selection.cpp
	falco/test_configuration_config_files.cpp
	falco/test_configuration_env_vars.cpp
	falco/test_configuration_output_options.cpp
	falco/test_configuration_schema.cpp
	falco/app/actions/test_select_event_sources.cpp
	falco/app/actions/test_load_config.cpp
)

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
	target_sources(
		falco_unit_tests
		PRIVATE falco/test_atomic_signal_handler.cpp
				falco/app/actions/test_configure_interesting_sets.cpp
				falco/app/actions/test_configure_syscall_buffer_num.cpp
	)
endif()

target_include_directories(
	falco_unit_tests
	PRIVATE ${CMAKE_SOURCE_DIR}/userspace
			${CMAKE_BINARY_DIR}/userspace/falco # we need it to include indirectly `config_falco.h`
			# file
			${CMAKE_SOURCE_DIR}/userspace/engine # we need it to include indirectly `falco_common.h`
			# file
			${CMAKE_CURRENT_BINARY_DIR} # we need it to include `falco_test_var.h`
)

get_target_property(FALCO_APPLICATION_LIBRARIES falco_application LINK_LIBRARIES)

target_link_libraries(
	falco_unit_tests falco_application GTest::gtest GTest::gtest_main
	${FALCO_APPLICATION_LIBRARIES}
)

if(EMSCRIPTEN)
	target_compile_options(falco_unit_tests PRIVATE "-sDISABLE_EXCEPTION_CATCHING=0")
	target_link_options(falco_unit_tests PRIVATE "-sDISABLE_EXCEPTION_CATCHING=0")
	target_link_options(falco_unit_tests PRIVATE "-sALLOW_MEMORY_GROWTH=1")
	target_link_options(falco_unit_tests PRIVATE "-sEXPORTED_FUNCTIONS=['_main','_htons','_ntohs']")
endif()
Falco Runtime Security: README

# Falco unit tests

## Intro

Under `unit_tests/engine` and `unit_tests/falco` directories, we have different test suites that could be a single file or an entire directory according to the number and the complexity of tests.

## Build and Run

```bash
cmake -DMINIMAL_BUILD=On -DBUILD_DRIVER=Off -DBUILD_FALCO_UNIT_TESTS=On ..
make falco_unit_tests
sudo ./unit_tests/falco_unit_tests
```
Falco Runtime Security: CMakeLists

# SPDX-License-Identifier: Apache-2.0
#
# Copyright (C) 2023 The Falco Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
# in compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
# or implied. See the License for the specific language governing permissions and limitations under
# the License.
#
cmake_minimum_required(VERSION 3.5.1)

project(driver-repo NONE)

include(ExternalProject)
message(STATUS "Driver repository: ${DRIVER_REPO}")
message(STATUS "Driver version: ${DRIVER_VERSION}")

ExternalProject_Add(
	driver
	URL "https://github.com/${DRIVER_REPO}/archive/${DRIVER_VERSION}.tar.gz"
	URL_HASH "${DRIVER_CHECKSUM}"
	CONFIGURE_COMMAND ""
	BUILD_COMMAND ""
	INSTALL_COMMAND ""
	TEST_COMMAND ""
	PATCH_COMMAND sh -c "mv ./driver ../driver.tmp && rm -rf ./* && mv ../driver.tmp/* ."
)
Falco Runtime Security: CMakeLists

# SPDX-License-Identifier: Apache-2.0
#
# Copyright (C) 2023 The Falco Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
# in compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
# or implied. See the License for the specific language governing permissions and limitations under
# the License.
#
cmake_minimum_required(VERSION 3.5.1)

project(falcosecurity-libs-repo NONE)

include(ExternalProject)
message(STATUS "Libs repository: ${FALCOSECURITY_LIBS_REPO}")
message(STATUS "Libs version: ${FALCOSECURITY_LIBS_VERSION}")

ExternalProject_Add(
	falcosecurity-libs
	URL "https://github.com/${FALCOSECURITY_LIBS_REPO}/archive/${FALCOSECURITY_LIBS_VERSION}.tar.gz"
	URL_HASH "${FALCOSECURITY_LIBS_CHECKSUM}"
	CONFIGURE_COMMAND ""
	BUILD_COMMAND ""
	INSTALL_COMMAND ""
	TEST_COMMAND ""
)
Falco Runtime Security: 20191217 rules naming convention

# Falco rule naming convention

<!-- toc -->

- [Summary](#summary)
- [Motivation](#motivation)
  * [Goals](#goals)
  * [Non-Goals](#non-goals)
- [Proposal](#proposal)
  * [Use cases](#use-cases)
  * [Diagrams](#diagrams)
  * [Design Details](#design-details)
    + [Rule](#rule)
    + [Macro](#macro)
    + [List](#list)

<!-- tocstop -->

## Summary

Propose some basic naming conventions when new lists, macros, rules are introduced. 

## Motivation

We want to help people from the community to contribute to falco rules. It will help improving the security content provided by Falco out of the box. Since people have different preference of naming things, it's necessary to set forth some basic naming convention for people to follow when creating new rules, macros and lists.

### Goals

People will have to follow the naming conventions rules when introducing new Falco rules, macros and lists.

### Non-Goals

There will be no intention to cover Falco rule syntax in this proposal.

## Proposal

### Use cases

When new PRs are created in the area of rules, reviewers need to examine whether there are new rules, macros or lists are introduced. If yes, check whether follow the naming convention.

### Diagrams

N/A

### Design Details

#### Rule
- Rule Name: Use phrases with capitalizing every word except preposition (e.g. `Search Private Keys or Passwords`)
- Description: Use sentence always starting with "Detect" and ending with period. (e.g. `Detect grep private keys or passwords activity.`)
- Output: Use sentence. Must at least include output fields (user=%user.name command=%proc.cmdline container_id=%container.id)
- Tags: Use at least one of the following: [network, process, filesystem]. Also encourage to use mitre_* tags if applicable

#### Macro
- Macro Name: Use lowercase_separated_by_underscores (e.g. `parent_java_running_zookeeper`)

#### List
- List Name: Use lowercase_separated_by_underscores (e.g. `protected_shell_spawning_binaries`)
Falco Runtime Security: README

<p align="center"><img src="primary-logo.png" width="360"></p>
<p align="center"><b>Cloud Native Runtime Security.</b></p>

# Falco Branding Guidelines

Falco is an open source security project whose brand and identity are governed by the [Cloud Native Computing Foundation](https://www.linuxfoundation.org/legal/trademark-usage).

This document describes the official branding guidelines of The Falco Project. Please see the [Falco Branding](https://falco.org/community/falco-brand/) page on our website for further details.

### Logo

There are 3 logos available for use in this directory. Use the primary logo unless required otherwise due to background issues or printing.

The Falco logo is Apache 2 licensed and free to use in media and publication for the CNCF Falco project.

### Colors

| Name      | PMS  | RGB         |
|-----------|------|-------------|
| Teal      | 3125 |   0 174 199 |
| Cool Gray |   11 |  83  86  90 |
| Black     |      |   0   0   0 |
| Blue-Gray | 7700 |  22 92 125  |
| Gold      | 1375 | 255 158  27 |
| Orange    |  171 | 255  92  57 |
| Emerald   | 3278 |   0 155 119 |
| Green     |  360 | 108 194  74 |

The primary colors are those in the first two rows.

### Slogan

> Cloud Native Runtime Security

### Writing about Falco

##### Yes

Notice the capitalization of the following terms.

 - The Falco Project
 - Falco

##### No

 - falco
 - the falco project
 - the Falco project

---

# Glossary

This section contains key terms specifically used within the context of The Falco Project. For a more comprehensive list of Falco-related terminology, we invite you to visit the [Glossary](https://falco.org/docs/reference/glossary/) page on our official website.

#### Modern eBPF Probe

Robust eBPF probe, which brings the CO-RE paradigm, better performances, and maintainability. 
The modern eBPF probe is not shipped as a separate artifact but bundled into the Falco binary itself.
This is one option used to pass kernel events up to userspace for Falco to consume.

#### Kernel Module

Used to describe the `.ko` object that would be loaded into the kernel as a potentially risky kernel module.
This is one option used to pass kernel events up to userspace for Falco to consume.

#### Driver 

The global term for the software that sends events from the kernel. Such as the [Modern eBPF probe](#modern-ebpf-probe), or the [Kernel Module](#kernel-module).

#### Plugin

Used to describe a dynamic shared library (`.so` files in Unix, `.dll` files in Windows) that conforms to a documented API and allows to extend Falco's capabilities.

#### Falco

The name of the project and also the name of [the main engine](https://github.com/falcosecurity/falco) that the rest of the project is built on.
Falco Runtime Security: README

# Warning

This environment is provided for demonstration purposes only and does not represent a production ready deployment of Falco.

# Components
The components that this docker-compose file spins up are [Falco](https://falco.org/), [falcosidekick](https://github.com/falcosecurity/falcosidekick), [falcosidekick-ui](https://github.com/falcosecurity/falcosidekick-ui) and a [redis](https://redis.io/) database.

# Running
To start this environment run `docker-compose up`.
Note: You may need to use sudo for Falco to start correctly.

# Cleaning up

To clean up run `docker-compose rm`.

# Generating events
If you'd like to generate events that will trigger rules and show up in the UI you can run `docker run -it --rm falcosecurity/event-generator run syscall --loop`
Kubernetes CIS Benchmark Checks: asff

# Integrating kube-bench with AWS Security Hub

You can configure kube-bench with the `--asff` to send findings to AWS Security Hub. There are some additional steps required so that kube-bench has information and permissions to send these findings.

## Enable the AWS Security Hub integration

* You will need AWS Security Hub to be enabled in your account
* In the Security Hub console, under Integrations, search for kube-bench

<p align="center">
  <img src="./images/kube-bench-security-hub.png">
</p>

* Click on `Accept findings`. This gives information about the IAM permissions required to send findings to your Security Hub account. kube-bench runs within a pod on your EKS cluster, and will need to be associated with a Role that has these permissions.

## Configure permissions in an IAM Role

* Grant these permissions to the IAM Role that the kube-bench pod will be associated with. There are two options:
  * You can run the kube-bench pod under a specific [service account associated with an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) that has these permissions to write Security Hub findings.
  * Alternatively the pod can be granted permissions specified by the Role that your [EKS node group uses](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html).
  
Here is an example IAM Policy that you can attach to your EKS node group's IAM Role: 

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "securityhub:BatchImportFindings",
            "Resource": [
                "arn:aws:securityhub:us-east-1::product/aqua-security/kube-bench"
            ]
        }
    ]
}
```

### Modify the job configuration

* Modify the kube-bench Configmap in `job-eks-asff.yaml` to specify the AWS account, AWS region, and the EKS Cluster ARN.
* In the same file, modify the image specifed in the Job to use the kube-bench image pushed to your ECR
* [Optional] - If you have created a dedicated IAM role to be used with kube-bench as described above in [Configure permissions in an IAM Role](#configure-permissions-in-an-iam-role), you will need to add the IAM role arn to the kube-bench ServiceAccount in `job-eks-asff.yaml`.
* Make sure that `job-eks-asff.yaml` specifies the container image you just pushed to your ECR registry.

You can now run kube-bench as a pod in your cluster: `kubectl apply -f job-eks-asff.yaml`

Findings will be generated for any kube-bench test that generates a `[FAIL]` or `[WARN]` output. If all tests pass, no findings will be generated. However, it's recommended that you consult the pod log output to check whether any findings were generated but could not be written to Security Hub.

<p align="center">
  <img src="./images/asff-example-finding.png">
</p>

[eks-instructions]: ../README.md#running-in-an-EKS-cluster
Kubernetes CIS Benchmark Checks: index

[download]: https://img.shields.io/github/downloads/aquasecurity/kube-bench/total?logo=github
[release-img]: https://img.shields.io/github/release/aquasecurity/kube-bench.svg?logo=github
[release]: https://github.com/aquasecurity/kube-bench/releases
[docker-pull]: https://img.shields.io/docker/pulls/aquasec/kube-bench?logo=docker&label=docker%20pulls%20%2F%20kube-bench
[docker]: https://hub.docker.com/r/aquasec/kube-bench
[cov-img]: https://codecov.io/github/aquasecurity/kube-bench/branch/main/graph/badge.svg
[cov]: https://codecov.io/github/aquasecurity/kube-bench
[report-card-img]: https://goreportcard.com/badge/github.com/aquasecurity/kube-bench
[report-card]: https://goreportcard.com/report/github.com/aquasecurity/kube-bench

![Kube-bench Logo](images/kube-bench.jpg)
[![GitHub Release][release-img]][release]
[![Downloads][download]][release]
[![Docker Pulls][docker-pull]][docker]
[![Go Report Card][report-card-img]][report-card]
[![Build Status](https://github.com/aquasecurity/kube-bench/workflows/Build/badge.svg?branch=main)](https://github.com/aquasecurity/kube-bench/actions)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/aquasecurity/kube-bench/blob/main/LICENSE)
[![Coverage Status][cov-img]][cov]


# Kube-bench 

kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).

Tests are configured with YAML files, making this tool easy to update as test specifications evolve.


1. kube-bench implements the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https://cisecurity.org).

1. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark.

1. It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS, AKS and ACK, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.

For help and more information go to our [github discussions q&a](https://github.com/aquasecurity/kube-bench/discussions/categories/q-a)
WiFi Security Testing — aircrack-ng: SECURITY

# Security Policy

Although we do our best to prevent vulnerabilities, and have tools to help
catch most of them, we are humans after all, and there will be inevitably
issues slipping through the cracks.

They can fall into two categories, either in any of the tools in the
Aircrack-ng suite, or in our presence online (website, forum, emails,
DNS, etc.).

Depending on which category they fall into, different information is needed. We
do believe in coordinated disclosure, so in order to address them, and
coordinate disclosure with you (and properly credit you for the discovery),
report them to us. Do not open bug reports or pull requests.

Our contact email for security issues is security@aircrack-ng.org

If you are unsure how to proceed, need clarifications or have questions or
remarks about this policy, feel free to email us to inquire.

## Aircrack-ng suite vulnerabilities

### Supported versions

We only support the latest stable present on https://aircrack-ng.org

For security issues present in our GitHub repository (master or any recently
active branch), open a pull request or bug report.

For any security issue affecting older versions of Aircrack-ng still present
in currently supported Linux or BSD distributions, file a report with them,
and email us a short description of the vulnerability along with a link to
the bug report.

### Reporting

There is no particular template to report the vulnerabilities. Keep in mind
that a vulnerability is essentially a bug, so please provide us detailed
information on how to reproduce it, such as:

- Which Aircrack-ng tools are affected? And how? Any proof of concept to
demonstrate it?
- Operating systems involved, kernel versions (`uname -a` and
`lsb_release -a` for example).
- CPU architecture (`aircrack-ng -u` output is useful); a vulnerability on a
x86 32 bit may not be exploitable on ARM 64 bit. A bug may also only be present
when Aircrack-ng is compiled a certain way.
- All the commands needed to trigger the issue.
- Did you compile it yourself or did you get it from a package?
- What equipment did you use? A packet capture may be useful; different
equipment behaves differently, they have different Wi-Fi stacks, drivers, and
firmwares.
- A patch to fix the issue, if available.
- If CVE numbers have been assigned, please provide them as well.

### Public disclosure

Although it is essentially a bug, do not submit a bug report or a pull request,
but email us the data first, so we can coordinate fixing the issue and assist
you in filing the bug reports, and if you provided a patch, the pull request; a
patch may need to be broken down in multiple commits for clarity, for example.

## Online presence

For any security issue affecting us specifically (any aircrack-ng.org
subdomain) such as misconfiguration of our hosting, DNS, email, servers,
or misconfiguration of the software we are using, email us with all the
details regarding your findings.

Anything else should be reported to the author or provider of the software,
hardware, or hosting.
WiFi Security Testing — aircrack-ng: Apple.sample

#direct string lookup
#strings were grep'd from the oui Txt file
Apple Computer
Apple Computer Inc
Apple Computer Inc.
Apple Computer, Inc.
Apple Inc
Apple, Inc
Apple, Inc.
APPLE COMPUTER
APPLE COMPUTER INC.
APPLE COMPUTER, INC.
APPLE, INC
#regex lookup
apple 
#this will return the same ouis as the strings above
WiFi Security Testing — aircrack-ng: CMakeLists

cmake_minimum_required(VERSION 2.6)
project(radiotap)

add_definitions("-D_BSD_SOURCE -DRADIOTAP_SUPPORT_OVERRIDES")

add_library(radiotap SHARED radiotap.c)
set_target_properties(radiotap PROPERTIES
		      COMPILE_FLAGS "-Wall -Wextra")

install(TARGETS radiotap DESTINATION lib)
install(FILES radiotap.h radiotap_iter.h DESTINATION include)

add_executable(parse parse.c)
set_target_properties(parse PROPERTIES
		      COMPILE_FLAGS "-Wall -Wextra")
target_link_libraries(parse radiotap)


add_custom_target(radiotap_check ALL
		  COMMAND ${CMAKE_SOURCE_DIR}/check/check.sh ${CMAKE_BINARY_DIR}
		  DEPENDS ${CMAKE_SOURCE_DIR}/check/*
		  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/check/
		  COMMENT "Check examples")
add_dependencies(radiotap_check parse)