Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WIP: Stack traces #4347

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

WIP: Stack traces #4347

wants to merge 4 commits into from

Conversation

oshaked1
Copy link
Contributor

No description provided.

@oshaked1
Remove stack addresses logic
e79c970 
The stack addresses feature will be removed in the future with the introduction of full stack traces.
@oshaked1
Find process in mount NS if none are found in the cache
df0c42a 
The PIDs in mount NS cache is updated from `sched_process_exec` events, but the PIDs from the events cannot be used for procfs access if Tracee is not running in the root PID namespace (for example on WSL).
To work around this limitation, if no PID in the cache exists for the requested mount NS, we search through procfs to find any PID in the requested mount NS and add it to the cache.
@oshaked1
Add event filter handling to Tracee init
f51d1c3 
This mechanism allows specific events to perform eBPF related operations based on their argument filters.
Currently there is no user for this mechanism, but stack traces which will be implemented soon will use it.
@oshaked1
security_bprm_check: remove reliance on sys_enter
d8ec2d4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@oshaked1 oshaked1

Labels
area/ebpf area/events
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@oshaked1