aquasecurity / aquasecurity/tracee

Avoid search for path in capture path filter if not filtered

Open
#3,365 0 comments 1 reaction 0 assignees View on GitHub
area/capture area/ebpf area/performance kind/feature
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Currently the implementation of the path filter resolve the path of the file in the start of the function.
However, the path filter might not be used.
In that case, we resolve the path in vein, which is one of the most complicated logics we use in the eBPF code.
The relevant code:
```go
statfunc bool filter_file_path(void *ctx, void *filter_map, struct file *file)
{
path_buf_t *path_buf = get_path_str_cached(file);
if (path_buf == NULL) {
return false;
}
```
We can instead check for a filter before, and only if there is one then we will resolve the path.

Contributor guide

Open the contributing guide

Research direction

Start at the filter_file_path entry point and inspect how path filters are represented before get_path_str_cached(file) is called. Confirm the existing path-filter behavior; done means path resolution is skipped when no path filter is configured while filtering still works when one is present.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, performance, security
Issue type
Refactor
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.