From 5662d5891512278f8c65053c36ad40459684c800 Mon Sep 17 00:00:00 2001 From: Raphael Campos Date: Tue, 28 May 2024 17:05:33 -0500 Subject: [PATCH] chore(docs): rename args filter to data filter --- docs/docs/events/builtin/extra/symbols_collision.md | 4 ++-- docs/docs/events/builtin/extra/symbols_loaded.md | 6 +++--- docs/docs/policies/rules.md | 10 +++++----- pkg/ebpf/events_pipeline.go | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/docs/events/builtin/extra/symbols_collision.md b/docs/docs/events/builtin/extra/symbols_collision.md index d192bd6244bd..7f995dc39e80 100644 --- a/docs/docs/events/builtin/extra/symbols_collision.md +++ b/docs/docs/events/builtin/extra/symbols_collision.md @@ -9,14 +9,14 @@ with other shared object already loaded to the process. This event can help in i occasion that a shared object tries to override some symbol of another library. ### Configuring the event -The event is configured using arguments filtering. +The event is configured using data filtering. #### symbols Configure the watched symbols that upon collision will trigger the event. Specify the full name of the symbol for each symbol. Notice that only watched symbols will be outputed by the event, and the default is watching all symbols. The use is only with the `=` or `!=` operators, and wildcards aren't supported. -## Arguments +## Data * `loaded_path`:`const char*`[K] - the path of the file loaded. * `collision_path`:`const char*`[K,TOCTOU] - the path of the file already loaded, which has collision with the new loaded one. * `symbols`:`const char*const*`[U,TOCTOU] - list of symbols collided between the files. diff --git a/docs/docs/events/builtin/extra/symbols_loaded.md b/docs/docs/events/builtin/extra/symbols_loaded.md index dfb87c7e97e0..703ac247ca46 100644 --- a/docs/docs/events/builtin/extra/symbols_loaded.md +++ b/docs/docs/events/builtin/extra/symbols_loaded.md @@ -10,8 +10,8 @@ usage in the system, or inform on the occasion that a shared object tries to ove some symbol of another library. ### Configuring the event -The event is configured using arguments filtering. -For each argument, a filter can be used to configure the operation: +The event is configured using data filtering. +For each data, a filter can be used to configure the operation: #### symbols Configure the watched symbols by the event. Specify the full name of the symbol for each symbol. @@ -23,7 +23,7 @@ If only a name is given, then any shared object inside the known libraries direc starts with the prefix will be whitelisted. The use is only with the `!=` operator, and wildcards aren't supported. -## Arguments +## Data * `library_path`:`const char*`[K] - the path of the shared object file loaded. * `symbols`:`const char*const*`[U,TOCTOU] - the watched symbols exported by the shared object. diff --git a/docs/docs/policies/rules.md b/docs/docs/policies/rules.md index 57677a351bad..2df8622f2839 100644 --- a/docs/docs/policies/rules.md +++ b/docs/docs/policies/rules.md @@ -6,7 +6,7 @@ Below are several examples on configuring events in the Tracee Policy. ## Events -Every event that is specified within the `rules` section supports three types of filters: `scope`, `arguments` and `return value`. +Every event that is specified within the `rules` section supports three types of filters: `scope`, `data` and `return value`. ### Type of Events @@ -239,17 +239,17 @@ filters: ``` -## Argument filter +## Data filter -Events have arguments, which can be filtered. +Events contain data that can be filtered. ```yaml apiVersion: tracee.aquasec.com/v1beta1 kind: Policy metadata: - name: sample-argument-filter + name: sample-data-filter annotations: - description: sample argument filter + description: sample data filter spec: scope: - global diff --git a/pkg/ebpf/events_pipeline.go b/pkg/ebpf/events_pipeline.go index cfad4f6e5a31..583f6060d37d 100644 --- a/pkg/ebpf/events_pipeline.go +++ b/pkg/ebpf/events_pipeline.go @@ -341,7 +341,7 @@ func (t *Tracee) matchPolicies(event *trace.Event) uint64 { continue } - // 3. event arguments filters + // 3. event data filters if !p.DataFilter.Filter(eventID, event.Args) { utils.ClearBit(&bitmap, bitOffset) continue