Federico Di Pierro

/remove-lifecycle stale

We need to gather more feedback about how to fix this up... @leogr @Andreagit97 @Molter73 @LucaGuerra

`ppm_event_info` is used by the event_table and describes our events: https://github.com/falcosecurity/libs/blob/master/driver/event_table.c#L12 In an old comment, i noticed that we would lose scap files backward compatibility by touching these structs; but...

@geraldcombs shouldn't `ppm_param_info` be already packed? ``` struct ppm_param_info { char name[PPM_MAX_NAME_LEN]; /**< Parameter name, e.g. 'size'. */ enum ppm_param_type type; /**< Parameter type, e.g. 'uint16', 'string'... */ enum ppm_print_format...

Hi @geraldcombs ! In the end, what about completely dropping the `packed` from these structs? I mean, there is no real gain for packed here, afaik. Do you agree that...

I think it was just used to save some runtime memory actually, so it should not impact scap files :)

Hi! Just a question: why won't you use cmake instead? Just like described here: https://github.com/falcosecurity/libs/blob/master/userspace/libscap/examples/01-open/README.md#build-%EF%B8%8F

I agree with both Andrea and Mauro here. @liorzemah can you help us understand what's the difference between invoking `make scap-open` and using your makefile? I see no point in...

Nothing it's useless :) but we'd like to understand the use cases before eventually accepting it! Do you think using make scap-open would solve your issue?

I think it makes sense! We might add an optional param to `sinsp::open()` to retain backward compatibility; then add a new field to `scap_open_args`. Would you be open to contribute?...