search

aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF
https://aquasecurity.github.io/tracee/latest
Apache License 2.0
3.53k stars 411 forks source link

fatal error: concurrent map iteration and map write #4313

Open JoeyRedfield opened 2 days ago

JoeyRedfield commented 2 days ago

Description

I execute the command sudo docker run --name tracee -it --rm --pid=host --cgroupns=host --privileged -v /etc/os-release:/etc/os-release-host:ro -v /var/run:/var/run:ro -v /boot:/boot:ro -v /lib/modules:/lib/modules:ro aquasec/tracee:latest -o json, an error occurred after running for a period of time: 

fatal error: concurrent map iteration and map write

goroutine 37 [running]:
reflect.mapiternext(0xdc1669?)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/runtime/map.go:1392 +0x13
reflect.(*MapIter).Next(0xc0032cd328?)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/reflect/value.go:2005 +0x74
encoding/json.mapEncoder.encode({0x4?}, 0xc00317e200, {0x2222fa0?, 0xc0006d5b78?, 0x2155ee0?}, {0xd?, 0x0?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:745 +0x334
encoding/json.structEncoder.encode({{{0xc000174fc8, 0x4, 0x4}, 0xc000f128d0, 0xc000f12900}}, 0xc00317e200, {0x23a3dc0?, 0xc0006d5b40?, 0xc0022fe948?}, {0x0, ...})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:704 +0x21e
encoding/json.ptrEncoder.encode({0xc0022fe948?}, 0xc00317e200, {0x2102ca0?, 0xc0022fe948?, 0xc0022fe948?}, {0xb?, 0x0?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:876 +0x23c
encoding/json.structEncoder.encode({{{0xc000620008, 0x20, 0x23}, 0xc000f12990, 0xc000f129c0}}, 0xc00317e200, {0x24be340?, 0xc0022fe780?, 0xc0032cd7d0?}, {0x0, ...})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:704 +0x21e
encoding/json.(*encodeState).reflectValue(0xc00317e200, {0x24be340?, 0xc0022fe780?, 0xc0032cd890?}, {0x0?, 0x81?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:321 +0x73
encoding/json.(*encodeState).marshal(0xd144fb?, {0x24be340?, 0xc0022fe780?}, {0xaa?, 0x24?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:297 +0xc5
encoding/json.Marshal({0x24be340, 0xc0022fe780})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/encoding/json/encode.go:163 +0xd0
github.com/aquasecurity/tracee/pkg/cmd/printer.jsonEventPrinter.Print({{_, _}}, {0x17f69cd8e00ff485, 0x17f69592ef7ddddd, 0x2, 0x1bc4, 0x100000001, 0x1bc4, 0x1b60, 0x1bc4, ...})
    /tracee/pkg/cmd/printer/printer.go:398 +0x54
github.com/aquasecurity/tracee/pkg/cmd/printer.startPrinter(0xc001e0b060, 0xc001df1980, 0xc00079c960, {0x385f980, 0xc0000b9be0})
    /tracee/pkg/cmd/printer/broadcast.go:103 +0x7d
created by github.com/aquasecurity/tracee/pkg/cmd/printer.(*Broadcast).Init in goroutine 1
    /tracee/pkg/cmd/printer/broadcast.go:52 +0x26b

goroutine 1 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run(0xc000637508, {0x385a6c0, 0xc000396080})
    /tracee/pkg/ebpf/tracee.go:1545 +0x65a
github.com/aquasecurity/tracee/pkg/cmd.Runner.Run({{{0xc001eb1518, 0x1, 0x1}, 0xc000602070, 0xc0005e1e00, 0xc001ddf3b0, {0x0, 0x0}, {0x0, 0x8000, ...}, ...}, ...}, ...)
    /tracee/pkg/cmd/tracee.go:112 +0x585
github.com/aquasecurity/tracee/cmd/tracee/cmd.init.func16(0x462c0a0, {0xc0001101c0?, 0x2?, 0x2?})
    /tracee/cmd/tracee/cmd/root.go:64 +0x27a
github.com/spf13/cobra.(*Command).execute(0x462c0a0, {0xc0001101c0, 0x2, 0x2})
    /tracee/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:987 +0xab1
github.com/spf13/cobra.(*Command).ExecuteC(0x462c0a0)
    /tracee/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff
github.com/spf13/cobra.(*Command).Execute(...)
    /tracee/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1039
github.com/aquasecurity/tracee/cmd/tracee/cmd.Execute()
    /tracee/cmd/tracee/cmd/root.go:391 +0x2a
main.main()
    /tracee/cmd/tracee/main.go:11 +0x13

goroutine 24 [syscall]:
os/signal.signal_recv()
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/runtime/sigqueue.go:152 +0x29
os/signal.loop()
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/os/signal/signal_unix.go:23 +0x13
created by os/signal.Notify.func1.1 in goroutine 1
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/os/signal/signal.go:151 +0x1f

goroutine 66 [select]:
os/signal.NotifyContext.func1()
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/os/signal/signal.go:288 +0x66
created by os/signal.NotifyContext in goroutine 1
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/os/signal/signal.go:287 +0x156

goroutine 39 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc00321cea0, {0x385a5a8, 0xc0004fa640})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 40 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc00321ced0, {0x385a5a8, 0xc0004fa690})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 41 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc00321cf00, {0x385a5a8, 0xc0004fa6e0})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 68 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc0031915b0, {0x385a5a8, 0xc0001921e0})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 69 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc0031915e0, {0x385a5a8, 0xc000192230})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 27 [IO wait]:
internal/poll.runtime_pollWait(0x7f5158dfce70, 0x72)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/runtime/netpoll.go:345 +0x85
internal/poll.(*pollDesc).wait(0xc003296080?, 0xc0032aa000?, 0x0)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/internal/poll/fd_poll_runtime.go:84 +0x27
internal/poll.(*pollDesc).waitRead(...)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc003296080, {0xc0032aa000, 0x8000, 0x8000})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/internal/poll/fd_unix.go:164 +0x27a
net.(*netFD).Read(0xc003296080, {0xc0032aa000?, 0x1040100000000?, 0x0?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/net/fd_posix.go:55 +0x25
net.(*conn).Read(0xc0032a2008, {0xc0032aa000?, 0x10401?, 0xc000000000?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/net/net.go:179 +0x45
bufio.(*Reader).Read(0xc0032a40c0, {0xc0032ba040, 0x9, 0xc0021ef6e0?})
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/bufio/bufio.go:241 +0x197
io.ReadAtLeast({0x3844a40, 0xc0032a40c0}, {0xc0032ba040, 0x9, 0x9}, 0x9)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/io/io.go:335 +0x90
io.ReadFull(...)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/io/io.go:354
golang.org/x/net/http2.readFrameHeader({0xc0032ba040, 0x9, 0xc0021ef6e0?}, {0x3844a40?, 0xc0032a40c0?})
    /tracee/go/pkg/mod/golang.org/x/net@v0.26.0/http2/frame.go:237 +0x65
golang.org/x/net/http2.(*Framer).ReadFrame(0xc0032ba000)
    /tracee/go/pkg/mod/golang.org/x/net@v0.26.0/http2/frame.go:501 +0x85
google.golang.org/grpc/internal/transport.(*http2Client).reader(0xc0004e0008, 0xc0032a4120)
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/http2_client.go:1620 +0x22d
created by google.golang.org/grpc/internal/transport.newHTTP2Client in goroutine 42
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/http2_client.go:409 +0x1e99

goroutine 67 [select]:
google.golang.org/grpc/internal/transport.(*controlBuffer).get(0xc0000bea00, 0x1)
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/controlbuf.go:418 +0x113
google.golang.org/grpc/internal/transport.(*loopyWriter).run(0xc0003ec1c0)
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/controlbuf.go:552 +0x86
google.golang.org/grpc/internal/transport.newHTTP2Client.func6()
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/http2_client.go:467 +0xbb
created by google.golang.org/grpc/internal/transport.newHTTP2Client in goroutine 42
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/transport/http2_client.go:465 +0x2492

goroutine 70 [select]:
google.golang.org/grpc/internal/grpcsync.(*CallbackSerializer).run(0xc003191610, {0x385a5a8, 0xc000192280})
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:76 +0x115
created by google.golang.org/grpc/internal/grpcsync.NewCallbackSerializer in goroutine 1
    /tracee/go/pkg/mod/google.golang.org/grpc@v1.64.1/internal/grpcsync/callback_serializer.go:52 +0x11a

goroutine 5 [select]:
github.com/aquasecurity/tracee/pkg/cmd.Runner.Run.func4()
    /tracee/pkg/cmd/tracee.go:102 +0x13c
created by github.com/aquasecurity/tracee/pkg/cmd.Runner.Run in goroutine 1
    /tracee/pkg/cmd/tracee.go:100 +0x565

goroutine 6 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).hookedSyscallTableRoutine(0xc000637508, {0x385a6c0, 0xc000396080})
    /tracee/pkg/ebpf/hooked_syscall_table.go:65 +0x297
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1499 +0x9f

goroutine 8 [syscall]:
github.com/aquasecurity/libbpfgo._Cfunc_perf_buffer__poll(0x7f519fa709c0, 0x12c)
    _cgo_gotypes.go:3118 +0x4b
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll.func1(0x0?, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x4c
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll(0xc00344ecd0, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x89
created by github.com/aquasecurity/libbpfgo.(*PerfBuffer).Poll in goroutine 1
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:35 +0xa5

goroutine 9 [select]:
github.com/aquasecurity/tracee/pkg/ebpf/controlplane.(*Controller).Run(0xc0031a8d20, {0x385a6c0?, 0xc000396080?})
    /tracee/pkg/ebpf/controlplane/controller.go:74 +0x116
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1511 +0x2e5

goroutine 10 [runnable]:
github.com/aquasecurity/libbpfgo._Cfunc_perf_buffer__poll(0x7f519fa70960, 0x12c)
    _cgo_gotypes.go:3118 +0x4b
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll.func1(0x0?, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x4c
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll(0xc00344ed20, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x89
created by github.com/aquasecurity/libbpfgo.(*PerfBuffer).Poll in goroutine 1
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:35 +0xa5

goroutine 11 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).processLostEvents(0xc000637508)
    /tracee/pkg/ebpf/processor.go:50 +0x105
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1518 +0x35b

goroutine 12 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).WaitForPipeline(0xc000637508, {0xc001014680?, 0xc000396080?, 0xc0032a53e0?})
    /tracee/pkg/ebpf/events_pipeline.go:680 +0x5c
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).handleEvents(0xc000637508, {0x385a6c0, 0xc000396080}, 0xc001d50600)
    /tracee/pkg/ebpf/events_pipeline.go:87 +0x674
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1519 +0x3d9

goroutine 13 [syscall]:
github.com/aquasecurity/libbpfgo._Cfunc_perf_buffer__poll(0x7f5157198410, 0x12c)
    _cgo_gotypes.go:3118 +0x4b
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll.func1(0x0?, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x4c
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll(0xc00344ed70, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x89
created by github.com/aquasecurity/libbpfgo.(*PerfBuffer).Poll in goroutine 1
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:35 +0xa5

goroutine 14 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).handleFileCaptures(0xc000637508, {0x385a6c0, 0xc000396080})
    /tracee/pkg/ebpf/capture.go:34 +0x14e
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1525 +0x45f

goroutine 15 [syscall]:
github.com/aquasecurity/libbpfgo._Cfunc_perf_buffer__poll(0x7f51571984d0, 0x12c)
    _cgo_gotypes.go:3118 +0x4b
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll.func1(0x0?, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x4c
github.com/aquasecurity/libbpfgo.(*PerfBuffer).poll(0xc00344edc0, 0x12c)
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:101 +0x89
created by github.com/aquasecurity/libbpfgo.(*PerfBuffer).Poll in goroutine 1
    /tracee/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.7.0-libbpf-1.4.0.20240729111821-61d531acf4ca/buf-perf.go:35 +0xa5

goroutine 16 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).processBPFLogs(0xc000637508, {0x385a6c0, 0xc000396080})
    /tracee/pkg/ebpf/bpf_log.go:176 +0x146
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
    /tracee/pkg/ebpf/tracee.go:1538 +0x605

goroutine 82 [runnable]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).decodeEvents.func1()
    /tracee/pkg/ebpf/events_pipeline.go:165 +0x117
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).decodeEvents in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:162 +0x10a

goroutine 83 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).processEvents.func1()
    /tracee/pkg/ebpf/events_pipeline.go:447 +0xe5
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).processEvents in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:443 +0xf5

goroutine 84 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents.func1()
    /tracee/pkg/ebpf/events_enrich.go:89 +0x18d
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents in goroutine 12
    /tracee/pkg/ebpf/events_enrich.go:85 +0x1b9

goroutine 85 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents.func2()
    /tracee/pkg/ebpf/events_enrich.go:157 +0xdb
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents in goroutine 12
    /tracee/pkg/ebpf/events_enrich.go:155 +0x26d

goroutine 86 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents.func3()
    /tracee/pkg/ebpf/events_enrich.go:205 +0xe5
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).enrichContainerEvents in goroutine 12
    /tracee/pkg/ebpf/events_enrich.go:203 +0x31e

goroutine 87 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).deriveEvents.func1()
    /tracee/pkg/ebpf/events_pipeline.go:520 +0x165
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).deriveEvents in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:515 +0xe6

goroutine 88 [runnable]:
github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).consumeSources(0xc0000c9ad0, {0x385a6c0, 0xc000396080})
    /tracee/pkg/signatures/engine/engine.go:215 +0xec
github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start(0xc0000c9ad0, {0x385a6c0, 0xc000396080})
    /tracee/pkg/signatures/engine/engine.go:131 +0x1d0
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).engineEvents in goroutine 12
    /tracee/pkg/ebpf/signature_engine.go:54 +0x797

goroutine 89 [select]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).engineEvents.func3()
    /tracee/pkg/ebpf/signature_engine.go:96 +0x1d8
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).engineEvents in goroutine 12
    /tracee/pkg/ebpf/signature_engine.go:89 +0x905

goroutine 90 [runnable]:
github.com/aquasecurity/tracee/pkg/events.(*DefinitionGroup).getDefinitionIDByName(...)
    /tracee/pkg/events/definition_group.go:72
github.com/aquasecurity/tracee/pkg/events.(*DefinitionGroup).GetDefinitionIDByName(0x17f69cd8e0111e9b?, {0x7f5158559176, 0x14})
    /tracee/pkg/events/definition_group.go:63 +0xf8
github.com/aquasecurity/tracee/pkg/ebpf.FindingToEvent(0xc000212ee0)
    /tracee/pkg/ebpf/finding.go:19 +0xce
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).engineEvents.func4()
    /tracee/pkg/ebpf/signature_engine.go:118 +0xeb
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).engineEvents in goroutine 12
    /tracee/pkg/ebpf/signature_engine.go:107 +0x99b

goroutine 91 [runnable]:
github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).sinkEvents.func1()
    /tracee/pkg/ebpf/events_pipeline.go:587 +0xbe
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).sinkEvents in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:584 +0xb7

goroutine 92 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc0032a50e0)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 93 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc0032a51a0)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 94 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc0032a5260)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 95 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc0032a5380)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 96 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc0032a5440)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 97 [chan receive]:
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func1(0xc00012f3e0)
    /tracee/pkg/ebpf/events_pipeline.go:695 +0x65
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:702 +0xaf

goroutine 98 [semacquire]:
sync.runtime_Semacquire(0x0?)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/runtime/sema.go:62 +0x25
sync.(*WaitGroup).Wait(0x0?)
    /tracee/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.4.linux-amd64/src/sync/waitgroup.go:116 +0x48
github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors.func2()
    /tracee/pkg/ebpf/events_pipeline.go:706 +0x25
created by github.com/aquasecurity/tracee/pkg/ebpf.MergeErrors in goroutine 12
    /tracee/pkg/ebpf/events_pipeline.go:705 +0x16a

goroutine 114 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cbc8, 0x7f5158850290}, 0xc0032a5860, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 115 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cd78, 0x7f51588508c0}, 0xc0032a5b60, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 116 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d2d0, 0x7f515884fc28}, 0xc00012f380, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 117 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d120, 0x7f515884fc08}, 0xc00012f080, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 118 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cca0, 0x7f51588502b0}, 0xc0032a5980, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 119 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d048, 0x7f515884fc00}, 0xc00012ee40, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 120 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d090, 0x7f5158850370}, 0xc00012ef60, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 121 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d1b0, 0x7f515884fc10}, 0xc00012f1a0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 122 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d1f8, 0x7f5158850ca0}, 0xc00012f260, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 123 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d288, 0x7f515884fc20}, 0xc00012f320, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 124 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cf28, 0x7f5158850900}, 0xc0032a5e00, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 125 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cf70, 0x7f5158850330}, 0xc0032a5e60, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 126 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d168, 0x7f5158850e20}, 0xc00012f0e0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 127 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cee0, 0x7f5158850310}, 0xc0032a5da0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 128 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865caf0, 0x7f5158850010}, 0xc0032a56e0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 129 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cc10, 0x7f5158850fc0}, 0xc0032a58c0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 130 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cd30, 0x7f5158850de0}, 0xc0032a5b00, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 131 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cce8, 0x7f51588508a0}, 0xc0032a5a40, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 132 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cdc0, 0x7f51588508e0}, 0xc0032a5bc0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 133 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d000, 0x7f5158850ae0}, 0xc0032a5f20, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 134 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cfb8, 0x7f5158850350}, 0xc0032a5ec0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 135 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cc58, 0x7f5158850c60}, 0xc0032a5920, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 136 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865ce08, 0x7f51588502d0}, 0xc0032a5c80, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 137 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865ce98, 0x7f51588502f0}, 0xc0032a5d40, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 138 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cb38, 0x7f5158850270}, 0xc0032a5740, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 139 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865cb80, 0x7f5158850880}, 0xc0032a57a0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 140 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d240, 0x7f515884fc18}, 0xc00012f2c0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 141 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865caa8, 0x7f5158850860}, 0xc0032a5620, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 142 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865ce50, 0x7f5158850f60}, 0xc0032a5ce0, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8

goroutine 143 [chan receive]:
github.com/aquasecurity/tracee/pkg/signatures/engine.signatureStart({0x7f515865d0d8, 0x7f5158850390}, 0xc00012f020, 0xc0000c9b08)
    /tracee/pkg/signatures/engine/engine.go:89 +0x85
created by github.com/aquasecurity/tracee/pkg/signatures/engine.(*Engine).Start in goroutine 88
    /tracee/pkg/signatures/engine/engine.go:128 +0xd8
INFO:
INFO: It seems that your environment isn't supported by Tracee.
INFO: If you think this is an error, please open an issue at:
INFO:
INFO: https://github.com/aquasecurity/tracee/
INFO:

Output of tracee version:

(paste your output here)
(base) gzhu2024@gzhu2024:~$ sudo docker run --name tracee -it --rm   --pid=host --cgroupns=host --privileged   -v /etc/os-release:/etc/os-release-host:ro   -v /var/run:/var/run:ro   -v /boot:/boot:ro   -v /lib/modules:/lib/modules:ro   aquasec/tracee:latest version
Tracee version: v0.22.1

Output of uname -a:

(paste your output here)
(base) gzhu2024@gzhu2024:~$ uname -a
Linux gzhu2024 5.4.0-150-generic #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Additional details

geyslan commented 2 days ago

Tks @JoeyRedfield. It seems related to https://github.com/aquasecurity/tracee/issues/4298.