Rafael David Tinoco

@krol3 can you rebase this and address comments ? I need to either merge or close this! Thanks!

Closing this PR as it is pretty much dead right now. Please open a new one if really needed.

I liked this approach a lot!

I don't like the idea of relying in a specific userland tool output (even if we embed it into tracee binary and/or tracee container). I think we should approach this...

@AlonZivony I believe https://github.com/aquasecurity/tracee/pull/2033 should be merged first and then you rebase (as that one is simpler) and then once this one is good we merge this one.

NOTE: We're waiting 0.8.1 release first before merging this one.

@mtcherni95 and @NDStrahilevitz.. we've been discussing multiple things and ideas about fixing userland filtering (first by bringing the values from tracee-rules signatures to the current filtering mechanisms we have, and...

> This seems like a logical step for the future of Tracee, however, as we already have such a support implemented, I think we should wait for a while with...

> As long as non-core environments are still common, I don't think BTFhub is enough. I don't think they're common, that is the point. And we can't guarantee supportability in...

I would like to style the C code before major changes. I'm going to enforce styling no C files and headers @yanivagman and @grantseltzer. I haven't done that because it...