Rafael David Tinoco

I agree this should be done. for a v6.5.x kernel, for example, this is the current situation with a complete set of events (from E2E tests): ``` $ sudo ./dist/tracee...

> I think all of our kubernetes fields would be useful for scope filtering so may as well generalize the issue, especially since they are all userspace filters. However, we...

> I think the trie would be how this is implemented, not sure how the data sources feature relate to this. I meant data structure =D (dyslexia won).

I'm assigning myself to the `Network` capturing item. Should others assign themselves to this issue altogether (so they can handle other items)?

This type of verifier error has been observed in some other projects as well: https://github.com/iovisor/bcc/issues/1260 and it is related to passing non fixed length to bpf helpers (support has been...

When trying to mitigate the issue: ```patch diff --git a/tracee-ebpf/tracee/tracee.bpf.c b/tracee-ebpf/tracee/tracee.bpf.c index b1e3ed1..67e6559 100644 --- a/tracee-ebpf/tracee/tracee.bpf.c +++ b/tracee-ebpf/tracee/tracee.bpf.c @@ -3047,12 +3047,15 @@ int BPF_KPROBE(trace_security_socket_connect) save_to_submit_buf(&data, (void *)address, sizeof(struct sockaddr_in6), 1);...

This is relevant but we've got a workaround in place. I didn't want to close this, but won't have my name assigned to it just now (as they are bigger...

> @rafaeldtinoco what's the status of this?  Still in place. Never revisited. Fix was done by commit 48654aa19, mitigated by commit a298a640f and stayed like that. I believe arm64...

> Keeping track of `inode -> multiple paths` and `path -> multiple inodes` is what I consider relevant. Totally agree with @geyslan here. And with what yaniv said earlier. Inode...

Hello @shani-gold, This isn't currently planned by us in the short term, but it wouldn't be complicated in being implemented. Is this something you're willing to work on ? If...