rename scopes related to policies #2845
Conversation
|
Making this change also requires changes in userspace, i.e Context of bufferdecoder and Event matchedScopes |
I was leaving the user land changes to one single PR, since we'll have to bump types and so. Let me check it again. 👍🏻 |
ae4950a to
bd5206e
Compare
4d79a1c to
659b515
Compare
|
The checks will fail as we have a change in types pkg. After this is merged, we need to bump the go.mod. |
|
Please rebase to HEAD before trying tests again. The rate limit issue with docker hub has been fixed. |
659b515 to
25965e3
Compare
| -f 42:event=sched_process_exec -f 42:binary=/usr/bin/ls | trace in scope 42 sched_process_exec event from /usr/bin/ls binary | ||
| -f 42:event=sched_process_exec -f 42:binary=/usr/bin/ls | trace in policy 42 sched_process_exec event from /usr/bin/ls binary | ||
|
|
||
| -f 3:event=openat -f 3:comm=id -f 9:event=close -f 9:comm=ls - trace in scope 3 only openat event from id command | ||
| -f 3:event=openat -f 3:comm=id -f 9:event=close -f 9:comm=ls - trace in policy 3 only openat event from id command | ||
| | and | ||
| - trace in scope 9 only close event from ls command | ||
| - trace in policy 9 only close event from ls command | ||
|
|
||
| -f 6:event=openat -f 6:comm=id -f 7:event=close -f 7:comm=id - trace in scope 6 only openat event from id command | ||
| -f 6:event=openat -f 6:comm=id -f 7:event=close -f 7:comm=id - trace in policy 6 only openat event from id command | ||
| | and | ||
| _ trace in scope 7 only close event from id command | ||
| _ trace in policy 7 only close event from id command | ||
|
|
||
| -f 3:event=openat -f 3:comm=id -f 9:event=close - trace in scope 3 only openat event from id command | ||
| -f 3:event=openat -f 3:comm=id -f 9:event=close - trace in policy 3 only openat event from id command | ||
| | and | ||
| - trace in scope 9 only close event from all | ||
| - trace in policy 9 only close event from all |
There was a problem hiding this comment.
We're going to remove all of that from the CLI soon, right?
There was a problem hiding this comment.
Definitely. Just renaming it accordingly. Once we receive the policies being loaded, this CLI will be removed, as that part of documentation.
| @@ -121,31 +121,31 @@ type filterFlag struct { | |||
| full string | |||
| filterName string | |||
| operatorAndValues string | |||
| scopeIdx int | |||
| policyIdx int | |||
There was a problem hiding this comment.
and this will be removed as well (and all following changes to filterFlag)?
There was a problem hiding this comment.
We need to think since it's part of the infrastructure and not exposed. It should be the part or not of the policy name mapping. We'll see.
There was a problem hiding this comment.
@yanivagman why should we remove the index?
There was a problem hiding this comment.
@yanivagman why should we remove the index?
Since this struct is the parsed filter flag, and we are going to remove multiscopes from CLI
There was a problem hiding this comment.
But we are using it for policies. Policies are parsed and generate an []filterFlag
There was a problem hiding this comment.
So at least we better rename this struct and not call it filterFlag.
There was a problem hiding this comment.
Sure. Can this struct rename take place in the next PR (policies)? So this can enter to unlock the next ones.
There was a problem hiding this comment.
Sure. This should probably be part of the removal of multiscopes from the CLI
25965e3 to
d72bbb9
Compare
types/trace/trace.go
Outdated
| @@ -37,7 +37,7 @@ type Event struct { | |||
| PodSandbox bool `json:"podSandbox"` | |||
| EventID int `json:"eventId,string"` | |||
| EventName string `json:"eventName"` | |||
| MatchedScopes uint64 `json:"matchedScopes"` | |||
| MatchedPolicies uint64 `json:"matchedPolicies"` | |||
There was a problem hiding this comment.
@yanivagman a question for a next PR:
Does it make sense to expose in Event type a field like MatchedPoliciesNames []string?
There was a problem hiding this comment.
Yes.
Actually, the bitmap won't make sense anymore if we remove multiscopes and only leave policies.
In that case, we can have MatchedPolicies []string
There was a problem hiding this comment.
Right. After this merge, I'm going to tackle the ID<=>Name on top of #2873.
event_context_t, net_task_context_t: matched_scopes -> matched_policies This also renames other parts that are related to policies.
This continues the renaming of scope to policy, in user land.
e71c43d to
a0fdbb6
Compare
|
[ERROR] |
|
[ERROR] |
1. Explain what the PR does
commit a0fdbb6
commit c774757
commit b3611d7
2. Explain how to test it
3. Other comments
This is part of: