tracee: fix args on signatures events #2713
Conversation
db0f07a to
5c30d6b
Compare
There was a problem hiding this comment.
This needs rebase.
@josedonizetti is this still valid ?
With the discussion at #2355 (comment) and the about to be merged (#2752) I wasn't sure (since the the Event type is being changed there to have metadata, as the discussion suggests).
|
@rafaeldtinoco yes, still valid. The Metadata PR will only reflect |
c614862 to
fd92e85
Compare
| return arguments | ||
| } | ||
|
|
||
| // TODO: we probably should have internal types instead of using kernel, or golang types |
| func (e *Event) IsASignatureEvent() bool { | ||
|
|
||
| for _, s := range e.Sets { | ||
| if s == "signatures" { | ||
| return true | ||
| } | ||
| } | ||
|
|
||
| return false | ||
| } |
There was a problem hiding this comment.
This isn't yet being used. Will it be checked in a hot path? If so, could it be a preset boolean flag?
There was a problem hiding this comment.
@geyslan This is used to avoid the argument name validation when booting tracee, for example, if you do -t security_open_file.args.pathname!=X, there is a validation to check if the pathaname is a paramenter declared on the event when tracee is starting.
As signature events the parameters are dynamic, we are skipping the validation so we don't fail the boot: https://github.com/aquasecurity/tracee/pull/2713/files#diff-a15ccb695c12a7219d07ca60dd20a3e26df991cb65d2313dcd593b5b5295a55cR104
| return "float" | ||
| case float64: | ||
| return "long double" | ||
| default: // TODO: how to implement int8, uint8, pointers, slices, and maps |
There was a problem hiding this comment.
I guess that's trivial by using our own internal types.
fd92e85 to
73d4f65
Compare
1. Explain what the PR does
This PR changes signature events to use
finding.Dataas arguments instead of the original event arguments.Also, it fix the filtering based on such arguments for signature events.
This PR is part of epic: #2355
2. Explain how to test it
The simplest way to test is to change an existing signature to include same output data, recompile tracee, and test out the feature, eg:
3. Other comments