Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(docs): rename args filter to data filter #4082

Merged
merged 1 commit into from
May 29, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/docs/events/builtin/extra/symbols_collision.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@ with other shared object already loaded to the process. This event can help in i
occasion that a shared object tries to override some symbol of another library.

### Configuring the event
The event is configured using arguments filtering.
The event is configured using data filtering.
#### symbols
Configure the watched symbols that upon collision will trigger the event.
Specify the full name of the symbol for each symbol.
Notice that only watched symbols will be outputed by the event, and the default is watching all symbols.
The use is only with the `=` or `!=` operators, and wildcards aren't supported.

## Arguments
## Data
* `loaded_path`:`const char*`[K] - the path of the file loaded.
* `collision_path`:`const char*`[K,TOCTOU] - the path of the file already loaded, which has collision with the new loaded one.
* `symbols`:`const char*const*`[U,TOCTOU] - list of symbols collided between the files.
Expand Down
6 changes: 3 additions & 3 deletions docs/docs/events/builtin/extra/symbols_loaded.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ usage in the system, or inform on the occasion that a shared object tries to ove
some symbol of another library.

### Configuring the event
The event is configured using arguments filtering.
For each argument, a filter can be used to configure the operation:
The event is configured using data filtering.
For each data, a filter can be used to configure the operation:
#### symbols
Configure the watched symbols by the event.
Specify the full name of the symbol for each symbol.
Expand All @@ -23,7 +23,7 @@ If only a name is given, then any shared object inside the known libraries direc
starts with the prefix will be whitelisted.
The use is only with the `!=` operator, and wildcards aren't supported.

## Arguments
## Data
* `library_path`:`const char*`[K] - the path of the shared object file loaded.
* `symbols`:`const char*const*`[U,TOCTOU] - the watched symbols exported by the shared object.

Expand Down
10 changes: 5 additions & 5 deletions docs/docs/policies/rules.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Below are several examples on configuring events in the Tracee Policy.

## Events

Every event that is specified within the `rules` section supports three types of filters: `scope`, `arguments` and `return value`.
Every event that is specified within the `rules` section supports three types of filters: `scope`, `data` and `return value`.

### Type of Events

Expand Down Expand Up @@ -239,17 +239,17 @@ filters:
```


## Argument filter
## Data filter

Events have arguments, which can be filtered.
Events contain data that can be filtered.

```yaml
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
name: sample-argument-filter
name: sample-data-filter
annotations:
description: sample argument filter
description: sample data filter
spec:
scope:
- global
Expand Down
2 changes: 1 addition & 1 deletion pkg/ebpf/events_pipeline.go
Original file line number Diff line number Diff line change
Expand Up @@ -341,7 +341,7 @@ func (t *Tracee) matchPolicies(event *trace.Event) uint64 {
continue
}

// 3. event arguments filters
// 3. event data filters
if !p.DataFilter.Filter(eventID, event.Args) {
utils.ClearBit(&bitmap, bitOffset)
continue
Expand Down
Loading