tracee
tracee copied to clipboard
[FEAT] Change user to non-root
Prerequisites
- [ ] This issue is an EPIC issue (add label: EPIC).
- [ ] This issue is an EPIC TASK (add issue to EPIC description).
Select one OR another:
- [ ] I'll create a PR to implement this feature (assign to yourself).
- [ ] Someone else should implement this (describe it well).
Feature description
Using a root user to run tracee is unnecessary as long as we have the minimal required capabilties (PR #1202 dropped unrequired capabilities). Change user to a non-root one to reduce attack surface.
Additional Information (feature drawings, files, logs, etc)
Not beeing a privileged user might require to lower the perf_event_paranoid threshold applied in PR #2033 . I can work on this issue if you want.