aquasecurity / aquasecurity/tracee

Uprobe completion as triggered events

Open
#2,055 1 comment 1 reaction 1 assignee Assigned to @NDStrahilevitz View on GitHub
area/ebpf area/uprobe kind/chore priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Prerequisites

Select one OR another:

- [x] I have discussed the refactoring idea with one (or another) maintainer.
- [x] I'll create a PR to implement this refactoring idea (assign to yourself).
- [ ] Someone else should implement this (describe it well).

## Refactoring description

This refactoring is about completing #2031 by changing the way we get certain arguments from maps and constants in the bpf code to uprobe arguments.

The refactoring is needed because there is a more efficient way now that we have uprobes.

- [ ] replace syscall table pointer in `hooked_syscalls` with a uprobe argument
- [x] replace syscalls to check in `hooked_syscalls` with a uprobe argument
- [ ] replace `NET_SEQ_OPS_SIZE` and `NET_SEQ_OPS_TYPES` with a uprobe argument
- [x] move triggering functions to a separate package - something like `triggeredEvents`
- [ ] add a `Name` field to `trace.HookedSymbolData` to specify the original name of the hooked function

## Additional Information (feature drawings, files, logs, etc)
The comments in #2031 by @yanivagman specify the needed changes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.