diff --git a/falco.yaml b/falco.yaml index c66d943d8ee..97b940387c3 100644 --- a/falco.yaml +++ b/falco.yaml @@ -179,7 +179,8 @@ rules_file: # - `modern_ebpf`: Modern eBPF (CO-RE eBPF probe) # - `gvisor`: gVisor (gVisor sandbox) # - `replay`: Replay a scap trace file -# - `none`: No event producer loaded, useful to run with plugins. +# - `nodriver`: No driver is injected into the system. +# This is useful to debug and to run plugins with 'syscall' source. # # Only one engine can be specified in the `kind` key. # Moreover, for each engine multiple options might be available, diff --git a/userspace/falco/app/actions/load_config.cpp b/userspace/falco/app/actions/load_config.cpp index 2433edcb10e..8dac82f5bd2 100644 --- a/userspace/falco/app/actions/load_config.cpp +++ b/userspace/falco/app/actions/load_config.cpp @@ -125,8 +125,8 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s) } if (s.options.nodriver) { - falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--nodriver' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: none' instead in falco.yaml\n"); - s.config->m_engine_mode = engine_kind_t::NONE; + falco_logger::log(falco_logger::level::WARNING, "DEPRECATION NOTICE: the '--nodriver' command line option is deprecated and will be removed in Falco 0.38! Set 'engine.kind: nodriver' instead in falco.yaml\n"); + s.config->m_engine_mode = engine_kind_t::NODRIVER; } if (!s.options.capture_file.empty()) { diff --git a/userspace/falco/app/state.h b/userspace/falco/app/state.h index 660f58b1450..ec4934db9f5 100644 --- a/userspace/falco/app/state.h +++ b/userspace/falco/app/state.h @@ -168,7 +168,7 @@ struct state inline bool is_nodriver() const { - return config->m_engine_mode == engine_kind_t::NONE; + return config->m_engine_mode == engine_kind_t::NODRIVER; } inline bool is_source_enabled(const std::string& src) const diff --git a/userspace/falco/configuration.cpp b/userspace/falco/configuration.cpp index 4ffc1ebdce1..f3455b31359 100644 --- a/userspace/falco/configuration.cpp +++ b/userspace/falco/configuration.cpp @@ -109,7 +109,7 @@ void falco_configuration::load_engine_config(const std::string& config_name, con {"modern_ebpf",engine_kind_t::MODERN_EBPF}, {"replay",engine_kind_t::REPLAY}, {"gvisor",engine_kind_t::GVISOR}, - {"none",engine_kind_t::NONE}, + {"nodriver",engine_kind_t::NODRIVER}, }; auto driver_mode_str = config.get_scalar("engine.kind", "kmod"); @@ -172,7 +172,7 @@ void falco_configuration::load_engine_config(const std::string& config_name, con } m_gvisor.m_root = config.get_scalar("engine.gvisor.root", ""); break; - case engine_kind_t::NONE: + case engine_kind_t::NODRIVER: default: break; } diff --git a/userspace/falco/configuration.h b/userspace/falco/configuration.h index d767d11762c..d463d2ae166 100644 --- a/userspace/falco/configuration.h +++ b/userspace/falco/configuration.h @@ -49,7 +49,7 @@ enum class engine_kind_t : uint8_t MODERN_EBPF, REPLAY, GVISOR, - NONE + NODRIVER }; class falco_configuration