Skip to content

Commit

Permalink
probes: add required dependency field
Browse files Browse the repository at this point in the history
This is done through the following steps:
1. Split the probes into a separate module
2. Probes are handled implicitly through handles
3. Events have probe dependencies which includes
a handle and a required field
4. Attaching failure is handled according to the required field
  • Loading branch information
NDStrahilevitz committed Jun 7, 2022
1 parent 6b0cad4 commit 5129ed2
Show file tree
Hide file tree
Showing 4 changed files with 412 additions and 216 deletions.
5 changes: 3 additions & 2 deletions cmd/tracee-ebpf/capabilities.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package main

import (
"fmt"

"github.com/aquasecurity/tracee/pkg/capabilities"
tracee "github.com/aquasecurity/tracee/pkg/ebpf"
"github.com/syndtr/gocapability/capability"
Expand Down Expand Up @@ -54,10 +55,10 @@ func generateTraceeEbpfRequiredCapabilities(OSInfo IKernelVersionInfo, cfg *trac

func getCapabilitiesRequiredByTraceeEvents(cfg *tracee.Config) []capability.Cap {
usedEvents := cfg.Filter.EventsToTrace
for eventID := range tracee.CreateEssentialEventsList(cfg) {
for eventID := range tracee.GetEssentialEventsList(cfg) {
usedEvents = append(usedEvents, eventID)
}
for eventID := range tracee.GetCaptureEventsConfig(cfg) {
for eventID := range tracee.GetCaptureEventsList(cfg) {
usedEvents = append(usedEvents, eventID)
}
caps := tracee.GetCapabilitiesRequiredByEvents(usedEvents)
Expand Down
Loading

0 comments on commit 5129ed2

Please sign in to comment.