Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: remove default usage of parse-arguments #4086

Closed

Conversation

NDStrahilevitz
Copy link
Collaborator

1. Explain what the PR does

The PR removes the default usage of parse-arguments. Data parsing will now be the default behavior only in the context of rego signatures. Go signatures have all been refactored to use raw data arguments. This should increase userspace pipeline performance in most use cases, and as such reduce the risk margin of event loss.

9c4cd8d feat(rego): parse event arguments in sig
bfd96e0 feat(cmd): disable arg parsing by default
a007d2d feat(sigs): refactor to use nonparsed arguments
6f0c1c9 chore(go.mod): update sig helpers
9c4cd8d feat(rego): parse event arguments in sig

Removing default argument parsing will break rego signatures, whose
implementation depends on parsed arguments. In order to keep the option
of readability in REGO signatures, events will be parsed by default in
the context of evaluating these kind of signatures.
This will also ensure that they will not be broken depending on the
selection of parse-arguments.

9d45a65 feat(helpers): robust int and uint arg helpers

Add a new uint argument helpers, which extracts a data argument from an
event by name and returns it if it was one of the uint types.
Additionally, add further checks for int64 and int types in the already
existing int argument helper.

e14baa0 feat(helpers): unparsed flag helpers

flag helpers previously took a string argument to test against possible
flag configurations. New implementation takes the integer form and
makes the test with the bit flag directly.

2. Explain how to test it

3. Other comments

Resolve #2177

flag helpers previously took a string argument to test against possible
flag configurations. New implementation takes the integer form and
makes the test with the bit flag directly.
Add a new uint argument helpers, which extracts a data argument from an
event by name and returns it if it was one of the uint types.
Additionally, add further checks for int64 and int types in the already
existing int argument helper.
Removing default argument parsing will break rego signatures, whose
implementation depends on parsed arguments. In order to keep the option
of readability in REGO signatures, events will be parsed by default in
the context of evaluating these kind of signatures.
This will also ensure that they will not be broken depending on the
selection of parse-arguments.
@NDStrahilevitz
Copy link
Collaborator Author

So this breaks compilation of tracee-rule. Maybe we can merge this after we remove those binaries.

1 similar comment
@NDStrahilevitz

This comment was marked as duplicate.

@@ -180,3 +180,5 @@ require (
gopkg.in/yaml.v3 v3.0.1 // indirect
kernel.org/pub/linux/libs/security/libcap/psx v1.2.68 // indirect
)

replace github.com/aquasecurity/tracee/signatures/helpers => ./signatures/helpers
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: split PR and remove this

@geyslan
Copy link
Member

geyslan commented Sep 26, 2024

Closing in favour of #4086.

@geyslan geyslan closed this Sep 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Remove need for parse-arguments
2 participants