Skip to content

Commit

Permalink
fix: derived event not triggering if base filtered (#3287)
Browse files Browse the repository at this point in the history
commit: 00f71ab (main), cherry-pick
  • Loading branch information
josedonizetti authored Jun 28, 2023
1 parent 4b32dac commit 2b7382e
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions pkg/ebpf/events_pipeline.go
Original file line number Diff line number Diff line change
Expand Up @@ -510,16 +510,16 @@ func (t *Tracee) deriveEvents(ctx context.Context, in <-chan *trace.Event) (
t.handleError(err)
}

for i, derivative := range derivatives {
for i := range derivatives {
// Skip events that dont work with filtering due to missing types being handled.
// https://github.com/aquasecurity/tracee/issues/2486
switch events.ID(derivative.EventID) {
switch events.ID(derivatives[i].EventID) {
case events.SymbolsLoaded:
case events.SharedObjectLoaded:
case events.PrintMemDump:
default:
// Derived events might need filtering as well
if t.matchPolicies(&derivative) == 0 {
if t.matchPolicies(&derivatives[i]) == 0 {
_ = t.stats.EventsFiltered.Increment()
continue
}
Expand Down

0 comments on commit 2b7382e

Please sign in to comment.