Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] feat: extend string data filtering for other events #4470

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[WIP] feat: extend string data filtering for other events #4470

wants to merge 1 commit into from

Conversation

rscampos
Copy link
Collaborator

@rscampos rscampos commented Jan 7, 2025 •
edited
Loading

1. Explain what the PR does

d939aa8 feat: extend string data filtering for other events

2. Explain how to test it

3. Other comments

fix: #4432

Add support for Tracee events which uses string filter and the field name is pathname:

lsm_hooks:

  • security_bprm_check
  • security_inode_unlink
  • security_kernel_read_file
  • security_kernel_post_read_file
  • security_file_mprotect
  • security_path_notify

others:

  • do_mmap
  • module_load
  • inotify_watch
  • do_truncate
  • vfs_utimes
  • load_elf_phdrs
  • call_usermodehelper
  • chmod_common
  • vfs_write
  • vfs_writev
  • vfs_read
  • vfs_readv
  • __kernel_write
  • mem_prot_alert
  • sched_process_exec

This PR is WIP that need to add support for events which uses string filter.

@rscampos rscampos self-assigned this Jan 7, 2025
@rscampos rscampos force-pushed the data_filter_in_kernel_phase2 branch 2 times, most recently from 34956a5 to 890848a Compare January 8, 2025 20:47
@rscampos rscampos force-pushed the data_filter_in_kernel_phase2 branch from 890848a to d939aa8 Compare January 8, 2025 22:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@rscampos rscampos

Labels
area/ebpf area/filtering
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Extend In-Kernel Data Filtering for other events
1 participant
@rscampos