aquasecurity / aquasecurity/tracee
Avoid search for path in capture path filter if not filtered
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Currently the implementation of the path filter resolve the path of the file in the start of the function.
However, the path filter might not be used.
In that case, we resolve the path in vein, which is one of the most complicated logics we use in the eBPF code.
The relevant code:
```go
statfunc bool filter_file_path(void *ctx, void *filter_map, struct file *file)
{
path_buf_t *path_buf = get_path_str_cached(file);
if (path_buf == NULL) {
return false;
}
```
We can instead check for a filter before, and only if there is one then we will resolve the path.
Contributor guide
Research direction
Start at the filter_file_path entry point and inspect how path filters are represented before get_path_str_cached(file) is called. Confirm the existing path-filter behavior; done means path resolution is skipped when no path filter is configured while filtering still works when one is present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, performance, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100