tracee

tracee copied to clipboard

partial fix to: #986

I've fixed those issues, but I should note that pretty-printed arg values (e.g O_WRONLY) will break. I think we need to communicate if it's raw or printed in the arg type

I've fixed those issues, but I should note that pretty-printed arg values (e.g O_WRONLY) will break. I think we need to communicate if it's raw or printed in the arg type

Here's another option - pass argMetas slice (from processEvents() func) as a pointer argument to prepareArgs() and change the argument type to the correct value when required

Here's another option - pass argMetas slice (from processEvents() func) as a pointer argument to prepareArgs() and change the argument type to the correct value when required

I opened #1029 to track this one

@itaysk what's left for #986 after merging this one?

I don't think we can merge this before #1029 right? I've talked with @grantseltzer about looking into #986 generally

I don't think we can merge this before #1029 right?

Why not? It resolves current bugs that we have. If #1029 will require changes, it is the responsibility of this future PR to fix it

it creates a regression AFAIU

pretty-printed arg values (e.g O_WRONLY) will break

@itaysk This PR depends on completing #1029 , right?

@itaysk can you please rebase your changes?

After we have protobuf implemented (and a protobuf wrapper from tracee event to protobuf, so go-cel can work, can be found at https://github.com/aquasecurity/tracee/pull/1766/files#diff-af1a3c488c6c0d521bd322a92cdb79b2eaaf758ee7245db25b5742bb3d8aa32aR95) we will start sorting all the types when marshaling / un-marshaling tracee events since those will be strongly typed.

Closing this due to inactivity.