aquasecurity / aquasecurity/tracee

Improve capture write option path syntax

Open
#875 1 comment 0 reactions 0 assignees View on GitHub
area/capture area/ebpf area/UX kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

The capture command write option supports an optional path, but the [current syntax expects the path ends with `*`](https://github.com/aquasecurity/tracee/blob/main/tracee-ebpf/main.go#L320). eg:

`tracee-ebpf --capture whome/user/test*`

This could be improved to keep the support for `*`, but allowing a simpler syntax for when capturing a specific directory, or a unique file. eg:

`tracee-ebpf --capture /home/user` instead of `tracee-ebpf --capture /home/user*`
`tracee-ebpf --capture /home/test.txt` instead of `tracee-ebpf --capture /home/test.txt*`

Contributor guide

Open the contributing guide

Research direction

Start at the capture write-option handling in tracee-ebpf/main.go around line 320 and inspect how the optional path is parsed. Preserve support for paths ending in `*`, while allowing a directory or unique file path without it. Done means the documented command forms work for both wildcard and non-wildcard paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
cli, operating-systems
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.