tracee
tracee copied to clipboard
[RFE] execve: send empty argv instead of no argv at all
Prerequisites
- [x] There isn't an issue describing the feature I need.
- [x] I don't think opening a discussion thread first is relevant.
- [x] I have a use case for the feature I would like to request.
Feature description
On some occasions, execve doesn't contain argv at all. tracee-rules expecting to get argv from execve, receiving exception when reading.
The feature: send empty argv instead of no argv at all
Context
My current environment, where I would like the feature to work, is:
- Linux version:
- Linux kernel version:
- Tracee version (or commit id of your tree):
- LLVM version:
- Golang version:
Additional Information (feature drawings, files, logs, etc)
