falcosecurity · poiana · Jan 31, 2024 · Nov 14, 2023
diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake
@@ -67,12 +67,10 @@ set(SCAP_HOST_ROOT_ENV_VAR_NAME "HOST_ROOT")
 set(SCAP_HOSTNAME_ENV_VAR "FALCO_HOSTNAME")
 set(SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR "FALCO_CGROUP_MEM_PATH")
 
-if(NOT LIBSCAP_DIR)
-  set(LIBSCAP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
+if(NOT LIBS_DIR)
+  set(LIBS_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
 endif()
 
-set(LIBSINSP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
-
 # configure gVisor support
 set(BUILD_LIBSCAP_GVISOR ${BUILD_FALCO_GVISOR} CACHE BOOL "")
 

diff --git a/userspace/engine/CMakeLists.txt b/userspace/engine/CMakeLists.txt
@@ -37,8 +37,7 @@ add_dependencies(falco_engine yamlcpp njson)
 
 target_include_directories(falco_engine
 PUBLIC
-    ${LIBSCAP_INCLUDE_DIRS}
-    ${LIBSINSP_INCLUDE_DIRS}
+    ${LIBS_DIR}/userspace
     ${PROJECT_BINARY_DIR}/userspace/engine
     ${nlohmann_json_INCLUDE_DIRS}
     ${TBB_INCLUDE_DIR}

diff --git a/userspace/engine/evttype_index_ruleset.h b/userspace/engine/evttype_index_ruleset.h
@@ -24,11 +24,10 @@ limitations under the License.
 #include <map>
 
 #include "filter_ruleset.h"
-#include "sinsp.h"
-#include "filter.h"
-#include "event.h"
-
-#include "gen_filter.h"
+#include <libsinsp/sinsp.h>
+#include <libsinsp/filter.h>
+#include <libsinsp/event.h>
+#include <libsinsp/gen_filter.h>
 
 /*!
 	\brief A filter_ruleset that indexes enabled rules by event type,

diff --git a/userspace/engine/falco_common.h b/userspace/engine/falco_common.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <string>
 #include <exception>
 #include <mutex>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 //
 // equivalent to an "unbounded queue" in TBB terms or largest long value

diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp
@@ -33,16 +33,16 @@ limitations under the License.
 
 #include <nlohmann/json.hpp>
 
-#include <sinsp.h>
-#include <plugin.h>
+#include <libsinsp/sinsp.h>
+#include <libsinsp/plugin.h>
+#include <libsinsp/utils.h>
 
 #include "falco_engine.h"
 #include "falco_utils.h"
 #include "falco_engine_version.h"
 
 #include "formats.h"
 
-#include "utils.h"
 #include "evttype_index_ruleset.h"
 
 const std::string falco_engine::s_default_ruleset = "falco-default-ruleset";

diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h
@@ -30,7 +30,7 @@ limitations under the License.
 
 #include <nlohmann/json.hpp>
 
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include "filter_ruleset.h"
 #include "rule_loader.h"
 #include "rule_loader_reader.h"

diff --git a/userspace/engine/falco_rule.h b/userspace/engine/falco_rule.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <string>
 #include "falco_common.h"
 
-#include <filter/ast.h>
+#include <libsinsp/filter/ast.h>
 
 /*!
 	\brief Represents a list in the Falco Engine.

diff --git a/userspace/engine/falco_utils.cpp b/userspace/engine/falco_utils.cpp
@@ -21,7 +21,7 @@ limitations under the License.
 #include <iomanip>
 
 #include "falco_utils.h"
-#include "utils.h"
+#include <libsinsp/utils.h>
 
 #include <re2/re2.h>
 

diff --git a/userspace/engine/filter_details_resolver.h b/userspace/engine/filter_details_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <unordered_set>
 #include <unordered_map>

diff --git a/userspace/engine/filter_macro_resolver.h b/userspace/engine/filter_macro_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <unordered_set>
 #include <unordered_map>

diff --git a/userspace/engine/filter_ruleset.h b/userspace/engine/filter_ruleset.h
@@ -19,12 +19,11 @@ limitations under the License.
 
 #include "falco_rule.h"
 #include "rule_loader_compile_output.h"
-#include <filter/ast.h>
-#include <filter.h>
-#include <functional>
-#include <event.h>
-#include <gen_filter.h>
-#include <events/sinsp_events.h>
+#include <libsinsp/filter/ast.h>
+#include <libsinsp/filter.h>
+#include <libsinsp/event.h>
+#include <libsinsp/gen_filter.h>
+#include <libsinsp/events/sinsp_events.h>
 
 /*!
 	\brief Manages a set of rulesets. A ruleset is a set of

diff --git a/userspace/engine/filter_warning_resolver.cpp b/userspace/engine/filter_warning_resolver.cpp
@@ -15,7 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include "filter_warning_resolver.h"
 
 using namespace falco;

diff --git a/userspace/engine/filter_warning_resolver.h b/userspace/engine/filter_warning_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <set>
 #include <memory>

diff --git a/userspace/engine/formats.h b/userspace/engine/formats.h
@@ -19,7 +19,7 @@ limitations under the License.
 
 #include <string>
 #include <map>
-#include <gen_filter.h>
+#include <libsinsp/gen_filter.h>
 #include "falco_engine.h"
 
 class falco_formats

diff --git a/userspace/engine/rule_loader.h b/userspace/engine/rule_loader.h
@@ -25,7 +25,7 @@ limitations under the License.
 #include "falco_source.h"
 #include "falco_load_result.h"
 #include "indexed_vector.h"
-#include "version.h"
+#include <libsinsp/version.h>
 
 namespace rule_loader
 {

diff --git a/userspace/engine/rule_loader_collector.cpp b/userspace/engine/rule_loader_collector.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include <string>
-#include <version.h>
+#include <libsinsp/version.h>
 
 #include "falco_engine.h"
 #include "rule_loader_collector.h"

diff --git a/userspace/engine/rule_loader_reader.cpp b/userspace/engine/rule_loader_reader.cpp
@@ -23,6 +23,7 @@ limitations under the License.
 #include "rule_loader_reader.h"
 #include "falco_engine_version.h"
 #include "rule_loading_messages.h"
+#include <libsinsp/logger.h>
 
 #define THROW(cond, err, ctx)    { if ((cond)) { throw rule_loader::rule_load_exception(falco::load_result::LOAD_ERR_YAML_VALIDATE, (err), (ctx)); } }
 

diff --git a/userspace/engine/rule_loader_reader.h b/userspace/engine/rule_loader_reader.h
@@ -19,8 +19,8 @@ limitations under the License.
 
 #include "rule_loader.h"
 #include "rule_loader_collector.h"
-#include "logger.h"
-#include "version.h"
+#include <libsinsp/logger.h>
+#include <libsinsp/version.h>
 #include "falco_engine_version.h"
 
 namespace rule_loader

diff --git a/userspace/falco/app/actions/helpers_generic.cpp b/userspace/falco/app/actions/helpers_generic.cpp
@@ -17,7 +17,7 @@ limitations under the License.
 
 #include "helpers.h"
 #include "falco_utils.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 #include <unordered_set>
 

diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp
@@ -19,7 +19,7 @@ limitations under the License.
 #include <sys/stat.h>
 #include <fcntl.h>
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 #include <configuration.h>
 
 #include "helpers.h"

diff --git a/userspace/falco/app/actions/init_falco_engine.cpp b/userspace/falco/app/actions/init_falco_engine.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include "actions.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/actions/init_inspectors.cpp b/userspace/falco/app/actions/init_inspectors.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 
 #include <unordered_set>
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/actions/list_plugins.cpp b/userspace/falco/app/actions/list_plugins.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/actions/load_plugins.cpp b/userspace/falco/app/actions/load_plugins.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include "actions.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/actions/load_rules_files.cpp b/userspace/falco/app/actions/load_rules_files.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 #include <unordered_set>
 

diff --git a/userspace/falco/app/actions/print_plugin_info.cpp b/userspace/falco/app/actions/print_plugin_info.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/actions/process_events.cpp b/userspace/falco/app/actions/process_events.cpp
@@ -35,7 +35,7 @@ limitations under the License.
 #include "../../falco_outputs.h"
 #include "../../event_drops.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;

diff --git a/userspace/falco/app/options.h b/userspace/falco/app/options.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <event.h>
+#include <libsinsp/event.h>
 
 #include <string>
 #include <vector>

diff --git a/userspace/falco/app/state.h b/userspace/falco/app/state.h
@@ -28,7 +28,7 @@ limitations under the License.
 #include "../webserver.h"
 #endif
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 #include <string>
 #include <memory>

diff --git a/userspace/falco/event_drops.h b/userspace/falco/event_drops.h
@@ -19,8 +19,8 @@ limitations under the License.
 #include <memory>
 #include <unordered_set>
 
-#include <sinsp.h>
-#include <token_bucket.h>
+#include <libsinsp/sinsp.h>
+#include <libsinsp/token_bucket.h>
 
 #include "logger.h"
 #include "falco_outputs.h"

diff --git a/userspace/falco/falco_outputs.h b/userspace/falco/falco_outputs.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <memory>
 #include <map>
 
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include "falco_common.h"
 #include "falco_engine.h"
 #include "outputs.h"

diff --git a/userspace/falco/logger.h b/userspace/falco/logger.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include "sinsp.h"
+#include <libsinsp/sinsp.h>
 #ifndef _WIN32
 #include <syslog.h>
 #endif

diff --git a/userspace/falco/outputs.h b/userspace/falco/outputs.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <map>
 
 #include "falco_common.h"
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include <nlohmann/json.hpp>
 
 namespace falco

diff --git a/userspace/falco/stats_writer.cpp b/userspace/falco/stats_writer.cpp
@@ -28,7 +28,8 @@ limitations under the License.
 #include "stats_writer.h"
 #include "logger.h"
 #include "config_falco.h"
-#include "strl.h"
+#include <libscap/strl.h>
+#include <libscap/scap_vtable.h>
 
 // note: ticker_t is an uint16_t, which is enough because we don't care about
 // overflows here. Threads calling stats_writer::handle() will just

diff --git a/userspace/falco/stats_writer.h b/userspace/falco/stats_writer.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <string>
 #include <unordered_map>
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 #ifndef __EMSCRIPTEN__
 #include "tbb/concurrent_queue.h"

diff --git a/userspace/falco/versions_info.cpp b/userspace/falco/versions_info.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 #include "config_falco.h"
 #include "falco_engine_version.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 // todo: move string conversion to scap
 static std::string get_driver_api_version(const std::shared_ptr<sinsp>& s)

diff --git a/userspace/falco/versions_info.h b/userspace/falco/versions_info.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <memory>
 #include <string>
 #include <unordered_map>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include <nlohmann/json.hpp>
 
 namespace falco

diff --git a/userspace/falco/webserver.h b/userspace/falco/webserver.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <httplib.h>
 #include <thread>
 #include <memory>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include "configuration.h"
 
 class falco_webserver