Tracee Files

Docker Image

• docker pull docker.io/aquasec/tracee:0.23.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.23.0
• docker pull docker.io/aquasec/tracee:aarch64-0.23.0

What's Changed

• chore(ci): update release amis by @geyslan in https://github.com/aquasecurity/tracee/pull/4269
• fix(build): set GOTOOLCHAIN="auto" for alpine by @geyslan in https://github.com/aquasecurity/tracee/pull/4271
• fix: release snapshot target arch by @rscampos in https://github.com/aquasecurity/tracee/pull/4274
• Process execute failed by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4233
• update go.sum and go.mod with grpc change by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4280
• fix: process_execute_failed use correct lru by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4283
• Remove irrelevant context from uprobe based events by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4284
• chore: use 6.2.0-1018-aws kernel by @geyslan in https://github.com/aquasecurity/tracee/pull/4275
• update syscall table: lookup_dcookie is removed by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4286
• container enrichment fixes and improvements by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4276
• chore(k8s): prepare v0.22.1 release by @rscampos in https://github.com/aquasecurity/tracee/pull/4295
• chore!: rollback proctree to simple LRU by @geyslan in https://github.com/aquasecurity/tracee/pull/4299
• Fix timespec_t args not being submitted to userspace by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4301
• Events flags embedding by @geyslan in https://github.com/aquasecurity/tracee/pull/4191
• feat(time)!: epoch timestamps as standard by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4252
• sched_process_exec: don't drop event in capture exec by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4310
• chore: deactive performance gate by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4309
• chore(deps): bump github.com/open-policy-agent/opa from 0.64.1 to 0.68.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4315
• chore: sig helper clone metadata by @rscampos in https://github.com/aquasecurity/tracee/pull/4317
• fix(tests): possible goroutine leak by @geyslan in https://github.com/aquasecurity/tracee/pull/4306
• chore(tests): increase Tracee startup timeout by @geyslan in https://github.com/aquasecurity/tracee/pull/4318
• Documentation patch by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4303
• Revert "chore: sig helper clone metadata" by @rscampos in https://github.com/aquasecurity/tracee/pull/4319
• Revert "perf: benchmark improve sig GetMetadata" by @rscampos in https://github.com/aquasecurity/tracee/pull/4320
• Revert "chore(sig): define signature metadata statically" by @rscampos in https://github.com/aquasecurity/tracee/pull/4321
• chore(k8s): prepare v0.22.2 release by @rscampos in https://github.com/aquasecurity/tracee/pull/4322
• change argv to args by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4304
• chore: remove deprecated debug-shell by @geyslan in https://github.com/aquasecurity/tracee/pull/4308
• fix(proctree): possible sync.Once data race by @geyslan in https://github.com/aquasecurity/tracee/pull/4307
• fix(ebpf): set pipeline chan size from config by @geyslan in https://github.com/aquasecurity/tracee/pull/4329
• chore(ci): add possibility of ff merging via ui by @geyslan in https://github.com/aquasecurity/tracee/pull/4333
• chore(types): add Zero field to ArgMeta by @geyslan in https://github.com/aquasecurity/tracee/pull/4340
• Handle zero-value types for unavailable fields - ArgMeta by @geyslan in https://github.com/aquasecurity/tracee/pull/4336
• remove policy and capture form docs by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4343
• Signatures helpers improvement by @geyslan in https://github.com/aquasecurity/tracee/pull/4345
• feat: remove default usage of parse-arguments by @geyslan in https://github.com/aquasecurity/tracee/pull/4331
• feat(events): add chmod_common event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4339
• register normalizeTimeArg processor only when proctree is on by @geyslan in https://github.com/aquasecurity/tracee/pull/4332
• Fix arg zero parse types and core typo by @geyslan in https://github.com/aquasecurity/tracee/pull/4357
• fix: print err when parseArgument() fails by @geyslan in https://github.com/aquasecurity/tracee/pull/4355
• feat(ebpf): restrict set_fs_pwd to (f)chdir syscall by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4359
• feat(events): change log level in hooked_syscall by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4366
• fix(events): check if init finished in hidden kernel module by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4367
• /proc parsing refactor by @geyslan in https://github.com/aquasecurity/tracee/pull/4364
• changed process filter to scope filters by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4371
• fix(mount): reintroduce root path requirement by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4328
• chore(k8s): prepare v0.22.3 release by @rscampos in https://github.com/aquasecurity/tracee/pull/4374
• analyze: enable sigs consuming sigs by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4327
• fix(engine): restrict finding feedback by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4377
• fix(events): fix slice out of bounds in hidden_kernel_module by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4379
• chore(k8s): prepare v0.22.4 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4382
• Refactor filter matching by @yanivagman in https://github.com/aquasecurity/tracee/pull/4376
• fix(epbf): fix behavior of has_prefix() and add strncmp() by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4394
• perf: remove sys_enter/exit dependency from default event set by @yanivagman in https://github.com/aquasecurity/tracee/pull/4389
• feat(helpers): GetProtoHTTPRequestByName/GetProtoHTTPResponseByName by @rscampos in https://github.com/aquasecurity/tracee/pull/4392
• Refactor: Restructure event and rename context by @yanivagman in https://github.com/aquasecurity/tracee/pull/4390
• refactor: Rename event parameters to fields by @yanivagman in https://github.com/aquasecurity/tracee/pull/4398
• Add suspicious_syscall_source event by @oshaked1 in https://github.com/aquasecurity/tracee/pull/3953
• chore(api): bump grpc and protoc versions by @geyslan in https://github.com/aquasecurity/tracee/pull/4405
• chore(grpc): bump api to latest 715b629 by @geyslan in https://github.com/aquasecurity/tracee/pull/4407
• chore(api): add EventCounts to GetMetricsResponse by @geyslan in https://github.com/aquasecurity/tracee/pull/4408
• Perf event writes metric by @geyslan in https://github.com/aquasecurity/tracee/pull/4334
• fix(tests): possible out of range in integration by @geyslan in https://github.com/aquasecurity/tracee/pull/4305
• feat(test): e2e integration test for new helpers by @rscampos in https://github.com/aquasecurity/tracee/pull/4354
• Refactor policy by @yanivagman in https://github.com/aquasecurity/tracee/pull/4400
• Analyze legacy output by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4385
• fix(epbf): fix incorrect parsed syscall name by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4402
• fix(build): fix build checkers for goimports by @geyslan in https://github.com/aquasecurity/tracee/pull/4417
• fix hidden_kernel_module history scan for kernels >6.2 by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4378
• fix: Remove unnecessary check for syscall wrapper in sys_enter tracepoint by @yanivagman in https://github.com/aquasecurity/tracee/pull/4236
• chore(k8s): prepare v0.22.5 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4421
• Add security_path_notify test to PR workflow by @oshaked1 in https://github.com/aquasecurity/tracee/pull/3926
• chore(GH): pin ubuntu (22.04) version for gh runners by @rscampos in https://github.com/aquasecurity/tracee/pull/4428
• chore(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4429
• Data filter in kernel by @rscampos in https://github.com/aquasecurity/tracee/pull/4324
• fix: optimize proctree memory consumption by @geyslan in https://github.com/aquasecurity/tracee/pull/4384
• fix(ci): add runner type to release workflows by @geyslan in https://github.com/aquasecurity/tracee/pull/4436
• chore: add kernel 6.8 and 6.10 in matrix images by @rscampos in https://github.com/aquasecurity/tracee/pull/4434
• chore(ebpf): refactor reset_event_args_buf to mark entries as invalid by @rscampos in https://github.com/aquasecurity/tracee/pull/4437
• fix(ci): set 2XLARGE runner type to x86_64 by @geyslan in https://github.com/aquasecurity/tracee/pull/4438
• Refactor: Remove Rego signature support by @yanivagman in https://github.com/aquasecurity/tracee/pull/4426
• fix release tarball static binaries & make daily building faster by @geyslan in https://github.com/aquasecurity/tracee/pull/4444
• fix(ebpf): adjust inode struct to kernel v6.11 by @rscampos in https://github.com/aquasecurity/tracee/pull/4457
• chore(test): use cat cmd to trigger magic_write event by @rscampos in https://github.com/aquasecurity/tracee/pull/4454
• chore: pin ubuntu:latest for gh runners / trigger magic_write event by @rscampos in https://github.com/aquasecurity/tracee/pull/4455
• Revert "feat(helpers): unparsed flag helpers" by @yanivagman in https://github.com/aquasecurity/tracee/pull/4462
• Revert to using raw argument values in engine stage by @yanivagman in https://github.com/aquasecurity/tracee/pull/4461
• chore: add kernel 6.11 and 6.12 in matrix images by @rscampos in https://github.com/aquasecurity/tracee/pull/4441
• fix(ebpf): kernel data filter combine bitmap by @rscampos in https://github.com/aquasecurity/tracee/pull/4468
• chore(ci): add codeQL as workflow file by @rscampos in https://github.com/aquasecurity/tracee/pull/4458
• Bump controller-gen fixing panic on generation by @geyslan in https://github.com/aquasecurity/tracee/pull/4471
• chore(deps): bump golang.org/x/net from 0.28.0 to 0.33.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4479
• chore(deps): bump golang.org/x/net from 0.26.0 to 0.33.0 in /api by @dependabot in https://github.com/aquasecurity/tracee/pull/4480
• chore(go.mod) bump api to 4cdea40d by @geyslan in https://github.com/aquasecurity/tracee/pull/4483
• chore(ci): enable dependabot version updates by @geyslan in https://github.com/aquasecurity/tracee/pull/4475
• chore(performance): update tracee dashboard by @geyslan in https://github.com/aquasecurity/tracee/pull/4467
• chore(deps): bump docker/login-action from 3.1.0 to 3.3.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4496
• chore(deps): bump golang from 1.22.7 to 1.23.4 in /builder by @dependabot in https://github.com/aquasecurity/tracee/pull/4488
• fix empty arguments resolution by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4442
• feat(events): add stack_pivot event by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4403
• Update Contributing docs by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4424
• argument parsers improvements by @geyslan in https://github.com/aquasecurity/tracee/pull/4279
• chore(ci): trigger pr workflow on release branches by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4510
• chore(deps): bump actions/setup-python from 5.1.0 to 5.3.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4506
• chore(deps): bump sigstore/cosign-installer from 3.4.0 to 3.7.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4489
• chore(deps): bump squidfunk/mkdocs-material from 8.3.0 to 9.5.49 in /builder by @dependabot in https://github.com/aquasecurity/tracee/pull/4490
• chore(deps): bump helm/kind-action from 1.9.0 to 1.12.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4491
• chore(deps): bump tj-actions/changed-files from 44.0.0 to 45.0.6 by @dependabot in https://github.com/aquasecurity/tracee/pull/4493
• chore(deps): bump toshimaru/auto-author-assign from 2.1.0 to 2.1.1 by @dependabot in https://github.com/aquasecurity/tracee/pull/4494
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.1 to 3.3.1 by @dependabot in https://github.com/aquasecurity/tracee/pull/4495
• chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4497
• chore(deps): bump google.golang.org/grpc from 1.66.0 to 1.69.4 by @dependabot in https://github.com/aquasecurity/tracee/pull/4499
• chore(deps): bump github.com/containerd/containerd from 1.7.21 to 1.7.25 by @dependabot in https://github.com/aquasecurity/tracee/pull/4500
• chore(deps): bump google.golang.org/protobuf from 1.34.2 to 1.36.3 by @dependabot in https://github.com/aquasecurity/tracee/pull/4511
• chore(deps): bump google.golang.org/grpc from 1.64.1 to 1.69.4 in /api by @dependabot in https://github.com/aquasecurity/tracee/pull/4501
• chore(deps): bump google.golang.org/protobuf from 1.34.1 to 1.36.3 in /api by @dependabot in https://github.com/aquasecurity/tracee/pull/4512
• chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4517
• chore(deps): bump github.com/stretchr/testify from 1.7.0 to 1.10.0 in /types by @dependabot in https://github.com/aquasecurity/tracee/pull/4522
• chore(deps): bump actions/labeler from 4.3.0 to 5.0.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4524
• chore(deps): bump kernel.org/pub/linux/libs/security/libcap/cap from 1.2.70 to 1.2.73 by @dependabot in https://github.com/aquasecurity/tracee/pull/4518
• chore(deps): bump github.com/grafana/pyroscope-go from 1.1.1 to 1.2.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4519
• chore(deps): bump github.com/urfave/cli/v2 from 2.27.2 to 2.27.5 by @dependabot in https://github.com/aquasecurity/tracee/pull/4521
• chore(deps): bump azure/setup-helm from 4.1.0 to 4.2.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4523
• chore(deps): bump golang from 1.23.4 to 1.23.5 in /builder by @dependabot in https://github.com/aquasecurity/tracee/pull/4525
• chore: api/types bump by @geyslan in https://github.com/aquasecurity/tracee/pull/4515
• fix(man): missing rebuild by @geyslan in https://github.com/aquasecurity/tracee/pull/4516
• fix(ci): change labeler format to v5 by @geyslan in https://github.com/aquasecurity/tracee/pull/4526
• Update codeql.yaml by @geyslan in https://github.com/aquasecurity/tracee/pull/4527
• fix: clock time detection by @rscampos in https://github.com/aquasecurity/tracee/pull/4513
• chore(deps): bump helm/chart-testing-action from 2.6.1 to 2.7.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4531
• chore(deps): bump squidfunk/mkdocs-material from 9.5.49 to 9.5.50 in /builder by @dependabot in https://github.com/aquasecurity/tracee/pull/4537
• chore: bump 3rdparty/libbpf to v1.5.0 by @geyslan in https://github.com/aquasecurity/tracee/pull/4530
• fix(filters): int conversion without check by @geyslan in https://github.com/aquasecurity/tracee/pull/4482
• legacy mode: align event field name in output by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4543
• feat(ksymbols): reimplement ksymbols by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4464
• feat(helpers): reapply: unparsed flag helpers by @geyslan in https://github.com/aquasecurity/tracee/pull/4545
• feat: reapply: remove default usage of parse-arguments by @geyslan in https://github.com/aquasecurity/tracee/pull/4544
• fix(ebpf): fix insufficiently accurate detection of golang heaps by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4550
• chore: improve e2e and pipeline for debuggability by @geyslan in https://github.com/aquasecurity/tracee/pull/4552
• fix(events): fix incorrect handling of event parameters by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4548
• fix(ci): remove runners collision by @geyslan in https://github.com/aquasecurity/tracee/pull/4559
• chore(deps): bump actions/setup-python from 5.3.0 to 5.4.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/4561
• Improve cpu/memory (proctree wise) by @geyslan in https://github.com/aquasecurity/tracee/pull/4503
• fix(e2e): treat corner cases in ds_writer.go by @geyslan in https://github.com/aquasecurity/tracee/pull/4554
• fix(epbf): fix handling of compat tasks in syscall checkers by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4562
• fix(ebpf): treat sched_process_exit corner case by @geyslan in https://github.com/aquasecurity/tracee/pull/4557
• feat(events): convert syscall arg to name at processing stage by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4563
• fix(ebpf): correct value of exit and signal code for sched_process_exit by @rscampos in https://github.com/aquasecurity/tracee/pull/4564
• fix(ebpf): revise thread stack identification logic by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4578
• fix(pipeline): fix stack-addresses not working by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4579
• Fix: net_tcp_connect event by @rscampos in https://github.com/aquasecurity/tracee/pull/4573
• Procfs improvements by @geyslan in https://github.com/aquasecurity/tracee/pull/4540
• Proctree improvements (cont) by @geyslan in https://github.com/aquasecurity/tracee/pull/4572
• Add missing prctl options to parser by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4586
• Fix clang format by @geyslan in https://github.com/aquasecurity/tracee/pull/4585
• chore(k8s): prepare v0.22.6 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4594
• fix(metrics): ignore bpf submit stats & gracefully stop tracee by @geyslan in https://github.com/aquasecurity/tracee/pull/4592
• fix(build): libbpf output by @geyslan in https://github.com/aquasecurity/tracee/pull/4589
• fix(build): update Makefile.release by @geyslan in https://github.com/aquasecurity/tracee/pull/4600
• Fix ProcessTree rogue entries by @geyslan in https://github.com/aquasecurity/tracee/pull/4582
• chore(k8s): prepare v0.23.0 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4603

New Contributors

• @ShohamBit made their first contribution in https://github.com/aquasecurity/tracee/pull/4303

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.22.0...v0.23.0