aquasecurity / aquasecurity/tracee
Uprobe completion as triggered events
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Prerequisites
Select one OR another:
- [x] I have discussed the refactoring idea with one (or another) maintainer.
- [x] I'll create a PR to implement this refactoring idea (assign to yourself).
- [ ] Someone else should implement this (describe it well).
## Refactoring description
This refactoring is about completing #2031 by changing the way we get certain arguments from maps and constants in the bpf code to uprobe arguments.
The refactoring is needed because there is a more efficient way now that we have uprobes.
- [ ] replace syscall table pointer in `hooked_syscalls` with a uprobe argument
- [x] replace syscalls to check in `hooked_syscalls` with a uprobe argument
- [ ] replace `NET_SEQ_OPS_SIZE` and `NET_SEQ_OPS_TYPES` with a uprobe argument
- [x] move triggering functions to a separate package - something like `triggeredEvents`
- [ ] add a `Name` field to `trace.HookedSymbolData` to specify the original name of the hooked function
## Additional Information (feature drawings, files, logs, etc)
The comments in #2031 by @yanivagman specify the needed changes
Contributor guide
Assessment
This issue has not been assessed yet.