8000 Feature/event context filter by NDStrahilevitz · Pull Request #2229 · aquasecurity/tracee · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Feature/event context filter #2229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Nov 22, 2022
Merged

Feature/event context filter #2229

merged 4 commits into from
Nov 22, 2022

Conversation

NDStrahilevitz
Copy link
Collaborator

Initial Checklist

  • There is an issue describing the need for this PR.
  • Git log contains summary of the change.
  • Git log contains motivation and context of the change.
  • If part of an EPIC, PR git log contains EPIC number.
  • If part of an EPIC, PR was added to EPIC description.

Description (git log)

commit 617c4f9

    shouldProcessEvent: merge context filter
    
    1. Move the function to the event pipeline.
    2. Merge the context filter into the logic, short circuiting it before
    argument filtering.

commit cbe4c3c (BREAKING CHANGE @yanivagman)

    filter: parse args filter with .args

commit 9b02477

    filters: add event context filter
    
    The context filter takes filter expressions based on trace.Event
    non argument values.
    
    For example one can trace only for openat events if they originate in a
    the ls process with `-t openat.context.processName=ls`.

Fixes: #1830

Type of change

  • Bug fix (non-breaking change fixing an issue, preferable).
  • Quick fix (minor non-breaking change requiring no issue, use with care)
  • Code refactor (code improvement and/or code removal)
  • New feature (non-breaking change adding functionality).
  • Breaking change (cause existing functionality not to work as expected).

How Has This Been Tested?

Currently manually, unit tests should be added soon
Run tracee-ebpf -t e=openat -t openat.context.processName=ls
then run ls
This should be equivalent to
tracee-ebpf -t e=openat -t comm=ls
Further confirmation can be done using the case presented in the issue.
Another interesting usecase is with -t eventname.context.container
For example -t security_file_open.context.container then start a running container and notice no security_file_open events beforehands should be displayed.

Final Checklist:

Pick "Bug Fix" or "Feature", delete the other and mark appropriate checks.

  • I have made corresponding changes to the documentation.
  • My code follows the style guidelines (C and Go) of this project.
  • I have performed a self-review of my own code.
  • I have commented all functions/methods created explaining what they do.
  • I have commented my code, particularly in hard-to-understand areas.
  • My changes generate no new warnings.
  • I have added tests that prove my fix, or feature, is effective.
  • New and existing unit tests pass locally with my changes.
  • Any dependent changes have been merged and published before.

Git Log Checklist:

My commits logs have:

  • Subject starts with "subsystem|file: description".
  • Do not end the subject line with a period.
  • Limit the subject line to 50 characters.
  • Separate subject from body with a blank line.
  • Use the imperative mood in the subject line.
  • Wrap the body at 72 characters.
  • Use the body to explain what and why instead of how.

@NDStrahilevitz NDStrahilevitz added this to the v0.9.0-rc1 milestone Oct 11, 2022
@NDStrahilevitz NDStrahilevitz force-pushed the feature/event_context_filter branch from 1768bb0 to b400a9c Compare October 11, 2022 16:23
@yanivagman yanivagman modified the milestones: v0.9.0-rc1, v.0.10.0 Oct 26, 2022
@NDStrahilevitz NDStrahilevitz force-pushed the feature/event_context_filter branch 3 times, most recently from 0c8c668 to 9c69eb3 Compare November 17, 2022 14:01
yanivagman
yanivagman reviewed Nov 19, 2022
View reviewed changes
Copy link
Collaborator
@yanivagman yanivagman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I love it!
Any info about how does it affects performance?

cmd/tracee-ebpf/flags/filter.go Outdated
Comment on lines 34 to 35
Event context fields can be accessed using 'event_name.context.field', this can be used to filter an event by its standard fields.
Refer to the json field values in github.com/aquasecurity/tracee/blob/main/types/trace/trace.go and the standard filter fields for valid context fields.
Copy link
Collaborator
@yanivagman yanivagman Nov 19, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not so clear what are the "standard fields".
I would also refer to the types/trace package instead of giving the full url (which might change) and be more specific about where to look - e.g. the Event struct.

Actually, refering (and updating) the docs would have been even better

Copy link
Collaborator Author
@NDStrahilevitz NDStrahilevitz Nov 20, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant existing fields in the examples (except the arguments), so maybe that's what I should write here.
And yes I'll refer to the package and struct instead I understand your point on the URL.

I included a docs update as part of this PR, but only an example, so I'll double check where I can also write more about the filter itself (though i'm not sure we have this for other filters).

@NDStrahilevitz
filters: add event context filter
1a97c55 
The context filter takes filter expressions based on trace.Event
non argument values.

For example one can trace only for openat events if they originate in a
the ls process with `-t openat.context.processName=ls`.
@NDStrahilevitz
filter: parse args filter with .args
9338d80
@NDStrahilevitz
shouldProcessEvent: merge context filter
cd38c60 
1. Move the function to the event pipeline.
2. Merge the context filter into the logic, short circuiting it before
argument filtering.
@NDStrahilevitz
docs: add section for context filter
2063aef
@NDStrahilevitz NDStrahilevitz force-pushed the feature/event_context_filter branch from 9c69eb3 to 2063aef Compare November 22, 2022 16:03
yanivagman
yanivagman approved these changes Nov 22, 2022
View reviewed changes
Copy link
Collaborator
@yanivagman yanivagman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@NDStrahilevitz NDStrahilevitz merged commit c9b25de into aquasecurity:main Nov 22, 2022
@NDStrahilevitz NDStrahilevitz deleted the feature/event_context_filter branch November 22, 2022 20:47
@yanivagman yanivagman removed this from the v0.10.0 milestone Jan 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yanivagman yanivagman yanivagman approved these changes

@rafaeldtinoco rafaeldtinoco Awaiting requested review from rafaeldtinoco

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[FEAT] Event Context Filter
2 participants
@NDStrahilevitz @yanivagman
0