aquasecurity / aquasecurity/tracee
Test_TraceeCapture fails on 6.12
Open
Nobody has claimed this yet.
kind/bug
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 508
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Description
Test_TraceeCapture test fails on kernel 6.12:
- Noble 6.12.62 ARM64: Regular file capture (vfs_write/vfs_writev) doesn't work
- Noble 6.12.62 x86_64: vfs_writev capture doesn't work (vfs_write works)
- Pipe and network capture work on both architectures
Output of tracee version:
main
Output of uname -a:
Noble 6.12.62 ARM64
Noble 6.12.62 x86_64
Additional details
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Test_TraceeCapture test and reproduce it on Noble kernel 6.12.62 on ARM64 and x86_64. Compare regular-file capture through vfs_write and vfs_writev with the passing pipe and network capture cases; done means the affected file-capture cases pass on both architectures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100