search

aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF
https://aquasecurity.github.io/tracee/latest
Apache License 2.0
3.64k stars 420 forks source link

Create a triggerEvents package and cleanup tracee.go #2973

Open rafaeldtinoco opened 1 year ago

rafaeldtinoco commented 1 year ago

Description

The uprobe triggering logic added to tracee.go should go into its own package and tracee.go should be refactored/cleaned.

Output of tracee -v:

v0.13.0
rafaeldtinoco commented 1 year ago

@AsafEitani assigned you since this was a request back then when those functions were added (just read the TODO in the code and issue was missing).

NDStrahilevitz commented 1 year ago

The package already exists, but currently it only holds the trigger context object and not the event triggering mechanism itself. As a start, we could move the mostly empty go:noinline annotated methods from the tracee object to an exported method in the package. From that point I believe we'd find more stuff that should be moved alongside. Similar to the move we did in the derive package, any dependencies from tracee that were required for the trigger can be carried along with the trigger function using dependency inversion.