tracee icon indicating copy to clipboard operation
tracee copied to clipboard

[RFE] execve: send empty argv instead of no argv at all

Open OriGlassman opened this issue 3 years ago • 0 comments

Prerequisites

  • [x] There isn't an issue describing the feature I need.
  • [x] I don't think opening a discussion thread first is relevant.
  • [x] I have a use case for the feature I would like to request.

Feature description

On some occasions, execve doesn't contain argv at all. tracee-rules expecting to get argv from execve, receiving exception when reading.

The feature: send empty argv instead of no argv at all

Context

My current environment, where I would like the feature to work, is:

  • Linux version:
  • Linux kernel version:
  • Tracee version (or commit id of your tree):
  • LLVM version:
  • Golang version:

Additional Information (feature drawings, files, logs, etc)

image

OriGlassman avatar Jul 14 '22 10:07 OriGlassman