ROX-33614: Update Falco to 0.23.1 by Stringy · Pull Request #2976 · stackrox/collector

Stringy · 2026-02-25T18:49:55Z

Description

Falco PR: stackrox/falcosecurity-libs#97

The changes in this PR relate to the uplift of Falco to the latest tagged version, 0.23.1. This is a significant upgrade, jumping from 0.18.1 up to this latest version and contains the following notable changes to Collector:

Added TOCTOU BPF programs to exclude list (we are not interested in these syscalls and they caused verifier issues)
Moved Container ID parsing into Collector
- Perhaps the most significant change in upstream Falco is the container plugin, which is a Go shared library that must be loaded at runtime and dynamically populates fields for each process. The complexity of such a plugin in terms of building, loading, and utilising it was deemed a little too much for the small amount of data we actually need from it. As a result, we don't use the plugin at all.
- One side effect of this is we don't have k8s namespaces automatically populated, which means in the future if/when we want namespace-level runtime configuration we may have to revisit these changes and either implement this in Collector or resign ourselves to using the container plugin.
The container filter has been changed from "container.id != 'host'" to "proc.pid != proc.vpid" - these are functionally identical but the former is not usable because we're not using the container plugin. Strictly speaking the new filter does not work on (very) old kernels e.g. RHEL 7, but we do not need to support them.
Numerous API changes to interact correctly with the new Falco version.

This work was performed primarily by Claude, with oversight from me. This was something of an experiment and so I got Claude to do as much of the work as possible, with my role being that of the driver; steering Claude when it got muddled or hyper focused on the wrong fix.

The update and rebase itself was relatively straight forward, resulting in new locally-built and locally-verified builds in just a couple of hours (i.e. builds that built and ran locally, passing the integration tests on my Fedora 42 x86 machine.) The bottle neck became the CI and getting that work fed back into Claude to perform the diagnostics and fixes.

As a result, I have added two Claude skills as part of this PR which allow Claude to (1) perform Falco updates in the future and (2) inspect the state of CI and investigate test failures or BPF verifiers issues.

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Built and tested locally, all unit & integration tests passing. CI handles the remainder of our test matrix.

codecov-commenter · 2026-02-26T23:36:11Z

Codecov Report

❌ Patch coverage is 10.76923% with 58 lines in your changes missing coverage. Please review.
✅ Project coverage is 27.37%. Comparing base (d461f49) to head (23c2967).
⚠️ Report is 6 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
collector/lib/system-inspector/Service.cpp	0.00%	2 Missing and 10 partials ⚠️
collector/lib/NetworkSignalHandler.cpp	0.00%	11 Missing ⚠️
collector/lib/ProcessSignalFormatter.cpp	15.38%	7 Missing and 4 partials ⚠️
collector/lib/Utility.cpp	35.71%	5 Missing and 4 partials ⚠️
collector/lib/ContainerMetadata.cpp	0.00%	5 Missing ⚠️
collector/lib/Process.cpp	0.00%	3 Missing ⚠️
collector/lib/system-inspector/EventExtractor.cpp	0.00%	2 Missing and 1 partial ⚠️
collector/lib/system-inspector/EventExtractor.h	0.00%	0 Missing and 2 partials ⚠️
collector/lib/CollectorService.cpp	0.00%	1 Missing ⚠️
collector/lib/ContainerInfoInspector.cpp	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2976      +/-   ##
==========================================
+ Coverage   27.34%   27.37%   +0.03%     
==========================================
  Files          95       94       -1     
  Lines        5420     5413       -7     
  Branches     2545     2547       +2     
==========================================
  Hits         1482     1482              
+ Misses       3211     3201      -10     
- Partials      727      730       +3

Flag	Coverage Δ
collector-unit-tests	`27.37% <10.76%> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

- Update falcosecurity-libs from 0.18.1 to 0.23.1 - Fix BPF verifier failures on older kernels (4.18) - Fix clang-format lint in Utility.cpp - Skip fd-based execs (/dev/fd/N) in exepath fallback - Disable TOCTOU 64-bit progs for missing syscalls - Remove container plugin, use built-in container ID lookups - Add analyze-ci Claude skill - Add update-falco-libs Claude skill Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-06-04T12:59:02Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: fd74638c-eb5b-435f-9855-d9be1d9958a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch giles/claude-update-falco-skill

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Molter73

I haven't gone through the changes under .claude or AGENTS.md, I think those probably should moved to their own PR.

Even without those there are plenty of comments, the falco side looks fine though.

Molter73 · 2026-06-15T10:36:41Z

Can we move the .claude/commands and AGENTS.md to a separate PR so we can focus the review efforts?

Molter73 · 2026-06-15T10:40:08Z

+    bool is_send_recv = (strncmp(evt_name, "send", 4) == 0 ||
+                         strncmp(evt_name, "recv", 4) == 0);
+    if (!is_send_recv) {


I'm fairly certain directly doing the checks is faster than doing these string checks. If we don't want to do this check for process information, I'm fairly certain we can check the syscall number instead and that will also be faster. Is there some other reason this check would be here I'm not seeing?

Molter73 · 2026-06-15T10:42:05Z

+    if (!check) {
+      CLOG(WARNING) << "Filter check not available for field: " << wrapper->event_name;
+      continue;
+    }


Fairly certain this check should just be an assert.

Molter73 · 2026-06-15T12:58:10Z

-    if (!buf) return nullptr;                                                                              \
+    if (!filter_check_##id##_.filter_check) return nullptr;                                                \
+    std::vector<extract_value_t> vals_##id;                                                                \
+    if (!filter_check_##id##_->extract(event, vals_##id)) return nullptr;                                  \


Why are we using extract when the falco PR still has the definition of extract_single?

Molter73 · 2026-06-15T12:59:47Z

-    uint32_t len;                                                                                          \
-    auto buf = filter_check_##id##_->extract_single(event, &len);                                          \
-    if (!buf) return nullptr;                                                                              \
+    if (!filter_check_##id##_.filter_check) return nullptr;                                                \


Should this be an assert?

Molter73 · 2026-06-15T13:05:02Z

+    CLOG(WARNING) << "Could not set container filter: " << e.what()
+                  << ". Container filtering will not be active.";


Since ACS has no idea what to do with processes outside of a container, it might be better to just let the exception bubble up and kill collector, rather than flood sensor with events it will not process.

Molter73 · 2026-06-15T13:07:40Z

+    for (const auto& [subsys, cgroup_path] : system_inspector_threadinfo_->cgroups()) {
+      if (auto id = ExtractContainerIDFromCgroup(cgroup_path)) {
+        return std::string(*id);
+      }
+    }


Why can't we use GetContainerID here?

Molter73 · 2026-06-15T13:08:54Z


  CLOG(DEBUG) << "Process (" << signal->container_id() << ": " << signal->pid() << "): "
-              << signal->name() << "[" << container_metadata_.GetNamespace(event) << "] "
+              << signal->name()


Suggested change

<< signal->name()

<< signal->name() << "[" << container_id << "] "

Molter73 · 2026-06-15T13:13:05Z

 std::ostream& operator<<(std::ostream& os, const sinsp_threadinfo* t) {
  if (t) {
-    os << "Container: \"" << t->m_container_id << "\", Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;
+    os << "Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;


Fairly certain you can do something like this:

Suggested change

os << "Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;

os << "Container: \"" << (t == nullptr ? "null" : GetContainerID(*t)) << "\", Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;

Or just create an overloaded version of GetContainerID that takes a pointer, checks it, then calls the version with the reference.

Molter73 · 2026-06-15T13:46:24Z

Why do the timeouts in this test need to be bumped from 5 to 30 seconds?

Stringy added the run-multiarch-builds Run steps for non-x86 archs. label Feb 26, 2026

Stringy force-pushed the giles/claude-update-falco-skill branch 5 times, most recently from c2385e2 to e647cac Compare March 16, 2026 08:20

Stringy changed the title ~~Adds Claude skill for updatig the falco fork~~ ROX-29474: Update Falco to 0.23.1 Mar 16, 2026

Stringy marked this pull request as ready for review March 16, 2026 08:53

Stringy requested a review from a team as a code owner March 16, 2026 08:53

ovalenti changed the title ~~ROX-29474: Update Falco to 0.23.1~~ ROX-33614: Update Falco to 0.23.1 Mar 16, 2026

Stringy added 2 commits June 4, 2026 13:58

Updates claude skills

cd3770b

Stringy force-pushed the giles/claude-update-falco-skill branch from 70ea6aa to cd3770b Compare June 4, 2026 12:58

ROX-33614: bump falco commit

23c2967

Stringy force-pushed the giles/claude-update-falco-skill branch from 544901c to 23c2967 Compare June 5, 2026 08:53

Molter73 reviewed Jun 15, 2026

View reviewed changes

		CLOG(WARNING) << "Could not set container filter: " << e.what()
		<< ". Container filtering will not be active.";

	<< signal->name()
	<< signal->name() << "[" << container_id << "] "

	os << "Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;
	os << "Container: \"" << (t == nullptr ? "null" : GetContainerID(*t)) << "\", Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;

Conversation

Stringy commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Testing Performed

Uh oh!

codecov-commenter commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Molter73 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Stringy commented Feb 25, 2026 •

edited

Loading

codecov-commenter commented Feb 26, 2026 •

edited

Loading

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading