aquasecurity / aquasecurity/tracee
Improve capture write option path syntax
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
The capture command write option supports an optional path, but the [current syntax expects the path ends with `*`](https://github.com/aquasecurity/tracee/blob/main/tracee-ebpf/main.go#L320). eg:
`tracee-ebpf --capture whome/user/test*`
This could be improved to keep the support for `*`, but allowing a simpler syntax for when capturing a specific directory, or a unique file. eg:
`tracee-ebpf --capture /home/user` instead of `tracee-ebpf --capture /home/user*`
`tracee-ebpf --capture /home/test.txt` instead of `tracee-ebpf --capture /home/test.txt*`
Contributor guide
Research direction
Start at the capture write-option handling in tracee-ebpf/main.go around line 320 and inspect how the optional path is parsed. Preserve support for paths ending in `*`, while allowing a directory or unique file path without it. Done means the documented command forms work for both wildcard and non-wildcard paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- cli, operating-systems
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100