tracee

tracee copied to clipboard

Prerequisites

• [x] This affects latest released version.
• [x] This affects current development tree (origin/HEAD).
• [x] There isn't an issue describing the bug.

Select one OR another:

• [ ] I'm going to create a PR to solve this (assign to yourself).
• [x] Someone else should solve this.

Bug description

the ProcInfo feature using the config to pass the information about if to initialize or not the member. However, this is not a value which the user should config, so it should not be passed by the config. The initialization of the config value in the getOptionsConfig is also problematic, because it is a getter function.

@roikol take a look at it (because it is part of the net events flow)

I believe the issues #1782 #1783 #1784 are all related and should be a single issue, no ?

The idea is that we have to make sure that the events that serve Tracee for "internal data" (like procinfo), what Ive been calling "janitor/service events", should be always enabled but without eventConfig.emit set (so sinkEvents, created by @NDStrahilevitz iirc, don't send those events to userland unless they were requested, but yet they're processed before in the pipeline).

The eventConfig submit and emit flags were created by @yanivagman as the first step in refactoring events, exactly because of that reason.

#1782 and #1783 are different in purpose: #1782 is about the fact that the features don't work properly. #1783 is about the fact that we should not use the config to pass internal information, only information from the user. So I don't think they should be 1 issue.

About #1784, I already agreed with you and closed it.

procinfo was recently removed, and will be reintroduced in the future (#2586).