tracee
tracee copied to clipboard
[REFAC] Reduce file events arguments
Prerequisites
- [ ] This issue is an EPIC issue (add label: EPIC).
- [ ] This issue is an EPIC TASK (add issue to EPIC description).
Select one OR another:
- [ ] I'll create a PR to implement this feature (assign to yourself).
- [ ] Someone else should implement this (describe it well).
Feature description
Events that include files information in their arguments tend to have many arguments (sched_process_exec
is the extreme example for it).
To reduce the amount of arguments and make it more user friendly, I propose to create a FileInfo
struct to contain the data that is always passed by events on files - path, device, inode and ctime.
This change will probably break many rules for our users, but will improve the accessibility for new users.
WDYT?
I will open a PR to show what I want to do
In terms of style, I personally like this better.
Regarding the backwards compatibility issue, maybe for now we can only add the new arg and then deprecate the old args in a later version? We're not v1 yet so we can allow breaking changes, as we've done before, but this is a commonly used event in signatures as you noted. Either way, this does raise again the need to implement a versioning strategy for our types.