{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":332041938,"defaultBranch":"main","name":"redcanary-ebpf-sensor","ownerLogin":"redcanaryco","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2021-01-22T19:23:43.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/6877001?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1720215449.0","currentOid":""},"activityList":{"items":[{"before":"645d9f99f2aa578dbda8823af22811cc99bc9778","after":null,"ref":"refs/heads/roman/le-1161-fix-magic","pushedAt":"2024-07-05T21:37:29.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"}},{"before":"3c3468f07f92c9cb8a6863bb401e3dc1bcdc0f2d","after":"c4c5850440fc3a2ceae901d18b03c75a8ddae8a2","ref":"refs/heads/main","pushedAt":"2024-07-05T21:37:27.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"LE-1161 Use SB magic, not disk magic (#109)","shortMessageHtmlLink":"LE-1161 Use SB magic, not disk magic (#109)"}},{"before":null,"after":"645d9f99f2aa578dbda8823af22811cc99bc9778","ref":"refs/heads/roman/le-1161-fix-magic","pushedAt":"2024-07-05T21:34:45.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"LE-1161 Use SB magic, not disk magic","shortMessageHtmlLink":"LE-1161 Use SB magic, not disk magic"}},{"before":"e78b98200199810fc04c6a20faf0c5a7d618d6a2","after":null,"ref":"refs/heads/roman/le-1161","pushedAt":"2024-07-05T20:45:08.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"}},{"before":"eda82597366843c39b25723fbe19e1165e71a054","after":"3c3468f07f92c9cb8a6863bb401e3dc1bcdc0f2d","ref":"refs/heads/main","pushedAt":"2024-07-05T20:45:06.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"Retrieve btrfs_root->anon_dev as applicable (#108)\n\n* LE-1161 Retrieve btrfs_root->anon_dev as applicable\r\n\r\n* Formatting - move BTRFS offset checksums above LINUX_KERNEL_VERSION\r\n\r\n* Flip branches","shortMessageHtmlLink":"Retrieve btrfs_root->anon_dev as applicable (#108)"}},{"before":"f049f284cb85f99b8ecf4800eeef842af9fd0528","after":"e78b98200199810fc04c6a20faf0c5a7d618d6a2","ref":"refs/heads/roman/le-1161","pushedAt":"2024-07-05T20:23:56.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"Flip branches","shortMessageHtmlLink":"Flip branches"}},{"before":"fbf2c7e203914e97115cc0175e096e313b0ac432","after":"f049f284cb85f99b8ecf4800eeef842af9fd0528","ref":"refs/heads/roman/le-1161","pushedAt":"2024-07-05T20:01:48.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"Formatting - move BTRFS offset checksums above LINUX_KERNEL_VERSION","shortMessageHtmlLink":"Formatting - move BTRFS offset checksums above LINUX_KERNEL_VERSION"}},{"before":null,"after":"fbf2c7e203914e97115cc0175e096e313b0ac432","ref":"refs/heads/roman/le-1161","pushedAt":"2024-06-26T23:52:08.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"RomanHargraveRC","name":"Roman Hargrave","path":"/RomanHargraveRC","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/109702436?s=80&v=4"},"commit":{"message":"LE-1161 Retrieve btrfs_root->anon_dev as applicable","shortMessageHtmlLink":"LE-1161 Retrieve btrfs_root->anon_dev as applicable"}},{"before":"8ae4c5e3bba7389d110f3bd7a840950cffb90f70","after":null,"ref":"refs/heads/fix-mismatch-for-renaming-symlinks","pushedAt":"2024-03-19T18:38:32.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"eb283d77a5854f176f04c8138f5f61b11d5168fe","after":"eda82597366843c39b25723fbe19e1165e71a054","ref":"refs/heads/main","pushedAt":"2024-03-19T18:38:31.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"do not emit warnings when renaming symlinks in overlayfs (#106)","shortMessageHtmlLink":"do not emit warnings when renaming symlinks in overlayfs (#106)"}},{"before":null,"after":"8ae4c5e3bba7389d110f3bd7a840950cffb90f70","ref":"refs/heads/fix-mismatch-for-renaming-symlinks","pushedAt":"2024-03-19T17:55:25.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"do not emit warnings when renaming symlinks in overlayfs","shortMessageHtmlLink":"do not emit warnings when renaming symlinks in overlayfs"}},{"before":"af20899bbd4862d0c9c1668343b14c8c973e4818","after":"eb283d77a5854f176f04c8138f5f61b11d5168fe","ref":"refs/heads/main","pushedAt":"2024-02-12T18:18:34.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"do not emit KIND_MISMATCH errors on the security probes (#105)\n\nthese probes can be called by more than just the syscalls that started\r\nthe incomplete event. For example, in overlayfs, a modification of a\r\nfile in the lower system can cause a new directory being created in\r\nthe upper system. This means that an event we saved through FM_MODIFY\r\nwill then be attempted to be loaded in a probe that expected FM_CREATE\r\nthus emit a warning and drop the valid event. We will now simply skip\r\nit if the kind isn't what we expected which matches more our old\r\ndesign of each \"kind\" being in its own map","shortMessageHtmlLink":"do not emit KIND_MISMATCH errors on the security probes (#105)"}},{"before":"fcb7d714f964b8a81e10e60d71b4a95ba02a0f59","after":null,"ref":"refs/heads/do-not-emit-mismatch-errors-on-security-probes","pushedAt":"2024-02-12T18:18:34.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"70b0aaf6e296483180f6b15654e4e5ed866a56e1","after":"fcb7d714f964b8a81e10e60d71b4a95ba02a0f59","ref":"refs/heads/do-not-emit-mismatch-errors-on-security-probes","pushedAt":"2024-02-12T17:49:54.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"do not emit KIND_MISMATCH errors on the security probes\n\nthese probes can be called by more than just the syscalls that started\nthe incomplete event. For example, in overlayfs, a modification of a\nfile in the lower system can cause a new directory being created in\nthe upper system. This means that an event we saved through FM_MODIFY\nwill then be attempted to be loaded in a probe that expected FM_CREATE\nthus emit a warning and drop the valid event. We will now simply skip\nit if the kind isn't what we expected which matches more our old\ndesign of each \"kind\" being in its own map","shortMessageHtmlLink":"do not emit KIND_MISMATCH errors on the security probes"}},{"before":null,"after":"70b0aaf6e296483180f6b15654e4e5ed866a56e1","ref":"refs/heads/do-not-emit-mismatch-errors-on-security-probes","pushedAt":"2024-02-12T17:48:23.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"do not emit KIND_MISMATCH errors on the security probes\n\nthese probes can be called by more than just the syscalls that started\nthe incomplete event. For example, in overlayfs, a modification of a\nfile in the lower system can cause a new directory being created in\nthe upper system. This means that an event we saved through FM_MODIFY\nwill then be attempted to be loaded in a probe that expected FM_CREATE\nthus emit a warning and drop the valid event. We will now simply skip\nit if the kind isn't what we expected which matches more our old\ndesign of each \"kind\" being in its own map","shortMessageHtmlLink":"do not emit KIND_MISMATCH errors on the security probes"}},{"before":"caa235f784e3e11a994c0142cb1896ff6fe9a0b0","after":null,"ref":"refs/heads/add-probe-id-to-file-warnings","pushedAt":"2024-02-08T20:43:40.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"7ad8e9ebe95402a496c8c0398d499d553b6f305e","after":"af20899bbd4862d0c9c1668343b14c8c973e4818","ref":"refs/heads/main","pushedAt":"2024-02-08T20:43:39.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"Add a `probe_id` to warning messages to easier debug issues (#104)\n\n`probe_id` is either a syscall number if the probe is a tracepoint; or\r\na custom enum that starts at 0xFFFF with the different kinds of\r\nnon-tracepoint probes we have for filemod\r\n\r\nAdditionally, I found a bug in set_current_file_mnt which is used by\r\nfchmod where we emit an incorrect warning because we forgot to add a\r\nreturn statement","shortMessageHtmlLink":"Add a probe_id to warning messages to easier debug issues (#104)"}},{"before":null,"after":"caa235f784e3e11a994c0142cb1896ff6fe9a0b0","ref":"refs/heads/add-probe-id-to-file-warnings","pushedAt":"2024-02-07T01:13:42.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"Add a `probe_id` to warning messages to easier debug issues\n\n`probe_id` is either a syscall number if the probe is a tracepoint; or\na custom enum that starts at 0xFFFF with the different kinds of\nnon-tracepoint probes we have for filemod\n\nAdditionally, I found a bug in set_current_file_mnt which is used by\nfchmod where we emit an incorrect warning because we forgot to add a\nreturn statement","shortMessageHtmlLink":"Add a probe_id to warning messages to easier debug issues"}},{"before":"024e78a731879dfd37283cd35f3bc10750762b45","after":null,"ref":"refs/heads/undo-some-tracepoints","pushedAt":"2023-11-30T02:05:52.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"7238bbd798e0e0fa4271404155bf3110ccb16224","after":"7ad8e9ebe95402a496c8c0398d499d553b6f305e","ref":"refs/heads/main","pushedAt":"2023-11-30T02:05:51.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"Make `clone`, `fork`, and `execve(at)` syscall be k(ret)probes again (#103)\n\nRHEL 7, Centos 7, and Oracle 7 do not expose these as tracepoints and\r\nthey are still not EOL","shortMessageHtmlLink":"Make clone, fork, and execve(at) syscall be k(ret)probes again (#…"}},{"before":null,"after":"024e78a731879dfd37283cd35f3bc10750762b45","ref":"refs/heads/undo-some-tracepoints","pushedAt":"2023-11-29T21:55:04.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"Make `clone`, `fork`, and `execve(at)` syscall be k(ret)probes again\n\nRHEL 7, Centos 7, and Oracle 7 do not expose these as tracepoints and\nthey are still not EOL","shortMessageHtmlLink":"Make clone, fork, and execve(at) syscall be k(ret)probes again"}},{"before":"58429c6fb27321e432ea42677eed4657bb28a70d","after":null,"ref":"refs/heads/filemod-no-config-security-path","pushedAt":"2023-11-27T19:30:15.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"3729dd3f3cb9822ad5bbf6729806ade7eceae0ee","after":"7238bbd798e0e0fa4271404155bf3110ccb16224","ref":"refs/heads/main","pushedAt":"2023-11-27T19:30:14.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"Support filemod events for systems without `CONFIG_SECURITY_PATH` (#102)","shortMessageHtmlLink":"Support filemod events for systems without CONFIG_SECURITY_PATH (#102)"}},{"before":"89c3a2bc601fc1cbfa1cb604c23b8441c9422168","after":"58429c6fb27321e432ea42677eed4657bb28a70d","ref":"refs/heads/filemod-no-config-security-path","pushedAt":"2023-11-14T01:28:08.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH","shortMessageHtmlLink":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH"}},{"before":"c1580ffd3a8fca992107525844bd1e33a77018c3","after":"89c3a2bc601fc1cbfa1cb604c23b8441c9422168","ref":"refs/heads/filemod-no-config-security-path","pushedAt":"2023-11-14T01:24:27.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH","shortMessageHtmlLink":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH"}},{"before":null,"after":"c1580ffd3a8fca992107525844bd1e33a77018c3","ref":"refs/heads/filemod-no-config-security-path","pushedAt":"2023-11-14T01:23:41.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH","shortMessageHtmlLink":"emit FM_MODIFY on systems without CONFIG_SECURITY_PATH"}},{"before":"83a3f01eef693fcbef5827dd44cfef8aa03fe688","after":null,"ref":"refs/heads/fix-file-events-minor-bugs","pushedAt":"2023-11-13T22:36:24.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"}},{"before":"3293af3008fbcc05f76eb5934d18f18597d73ef6","after":"3729dd3f3cb9822ad5bbf6729806ade7eceae0ee","ref":"refs/heads/main","pushedAt":"2023-11-13T22:36:22.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"File events minor bugs (#101)\n\n* set `LINK_NONE` when creating a file\r\n\r\n* prevent mismatch errors in the case of forgetting to pop file events\r\n\r\n* use BPF_NOEXIST when insert data into incomplete_file_messages","shortMessageHtmlLink":"File events minor bugs (#101)"}},{"before":"13b1f21340152091bf82359ecb454aad1535546c","after":"83a3f01eef693fcbef5827dd44cfef8aa03fe688","ref":"refs/heads/fix-file-events-minor-bugs","pushedAt":"2023-11-09T22:57:32.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"use BPF_NOEXIST when insert data into incomplete_file_messages","shortMessageHtmlLink":"use BPF_NOEXIST when insert data into incomplete_file_messages"}},{"before":null,"after":"13b1f21340152091bf82359ecb454aad1535546c","ref":"refs/heads/fix-file-events-minor-bugs","pushedAt":"2023-11-09T22:23:12.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rc-andres","name":"Andrés","path":"/rc-andres","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/84341363?s=80&v=4"},"commit":{"message":"use BPF_NOEXIST when insert data into incomplete_file_messages","shortMessageHtmlLink":"use BPF_NOEXIST when insert data into incomplete_file_messages"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAEeCCagwA","startCursor":null,"endCursor":null}},"title":"Activity · redcanaryco/redcanary-ebpf-sensor"}