tracee icon indicating copy to clipboard operation
tracee copied to clipboard

[REFAC] Reduce file events arguments

Open AlonZivony opened this issue 2 years ago • 2 comments

Prerequisites

  • [ ] This issue is an EPIC issue (add label: EPIC).
  • [ ] This issue is an EPIC TASK (add issue to EPIC description).

Select one OR another:

  • [ ] I'll create a PR to implement this feature (assign to yourself).
  • [ ] Someone else should implement this (describe it well).

Feature description

Events that include files information in their arguments tend to have many arguments (sched_process_exec is the extreme example for it). To reduce the amount of arguments and make it more user friendly, I propose to create a FileInfo struct to contain the data that is always passed by events on files - path, device, inode and ctime. This change will probably break many rules for our users, but will improve the accessibility for new users. WDYT?

AlonZivony avatar Jul 18 '22 08:07 AlonZivony

I will open a PR to show what I want to do

AlonZivony avatar Jul 18 '22 08:07 AlonZivony

In terms of style, I personally like this better.

Regarding the backwards compatibility issue, maybe for now we can only add the new arg and then deprecate the old args in a later version? We're not v1 yet so we can allow breaking changes, as we've done before, but this is a commonly used event in signatures as you noted. Either way, this does raise again the need to implement a versioning strategy for our types.

NDStrahilevitz avatar Jul 18 '22 11:07 NDStrahilevitz