Rafael David Tinoco

vma05.sh - false positives for vDSO bug detection

2

We are getting false positives with vma05.sh tests: Bug: https://bugs.linaro.org/show_bug.cgi?id=4256#c2 Original commit for vma05 test, has stated that: " Second part of the test checks regression of vdso permissions bug...

Tracee docker container wrapper for simple usage

1

- [x] I'll create a PR to implement this feature (assign to yourself). ## Feature description Currently, in order for an end user to use tracee as a docker container...

tracee-ebpf filtering can't filter comm= values with "."

2

## Prerequisites - [x] This affects latest released version. - [x] This affects current development tree (origin/HEAD). - [x] There isn't an issue describing the bug. ## Bug description During...

[FEAT] network events should also be enriched

5

## Bug description Enrichment works with:  But fails to work when picking "net_packet" only event:  ## Context Relevant information about my setup: * Linux version: any * Linux...

[BUG] Entire clsact qdisc is purged when tc hook is destroyed

3

When refactoring network probes from https://github.com/aquasecurity/tracee/pull/1820 I have realized that we should better document clsact qdisc issue on tc probe destruction. I have documented the behavior observed in the current...

TRC-11 triggered from runc process

2

 and related discussion: 

## Bug description After https://github.com/aquasecurity/tracee/pull/1808, we have to start enforcing the DocPath existence and the file format every time an event is added to tracee. https://github.com/aquasecurity/tracee/pull/1808#issuecomment-1161755558 https://github.com/aquasecurity/tracee/pull/1808#issuecomment-1161843244

CoreOS environment support

3

To check why CoreOS environment supports 0.6.0 but not 0.6.5. To check if adjustments are needed in order to get the next released supported in that environment.

## Prerequisites - [x] Is this an EPIC issue describing other issues ? (add label: EPIC) ## Feature description - Load the Program - Block something - Alert through tracee-rules...

## Prerequisites - [x] This affects latest released version. - [x] This affects current development tree (origin/HEAD). - [x] There isn't an issue describing the bug. Select one OR another:...