[v0.22.2] Revert static sig metadata

deploy/helm/tracee/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: tracee
 description: Linux Runtime Security and Forensics using eBPF
-home: https://aquasecurity.github.io/tracee/v0.22.1/
+home: https://aquasecurity.github.io/tracee/v0.22.2/
 sources:
   - https://github.com/aquasecurity/tracee
 
@@ -18,10 +18,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "0.22.1"
+version: "0.22.2"
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.22.1"
+appVersion: "0.22.2"

deploy/kubernetes/tracee/tracee.yaml

@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: tracee
   labels:
-    helm.sh/chart: tracee-0.22.1
+    helm.sh/chart: tracee-0.22.2
     app.kubernetes.io/name: tracee
     app.kubernetes.io/instance: tracee
-    app.kubernetes.io/version: "0.22.1"
+    app.kubernetes.io/version: "0.22.2"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: tracee/templates/serviceaccount.yaml
@@ -17,10 +17,10 @@ kind: ServiceAccount
 metadata:
   name: tracee-operator
   labels:
-    helm.sh/chart: tracee-0.22.1
+    helm.sh/chart: tracee-0.22.2
     app.kubernetes.io/name: tracee
     app.kubernetes.io/instance: tracee
-    app.kubernetes.io/version: "0.22.1"
+    app.kubernetes.io/version: "0.22.2"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: tracee/templates/tracee-config.yaml
@@ -29,10 +29,10 @@ kind: ConfigMap
 metadata:
   name: tracee-config
   labels:
-    helm.sh/chart: tracee-0.22.1
+    helm.sh/chart: tracee-0.22.2
     app.kubernetes.io/name: tracee
     app.kubernetes.io/instance: tracee
-    app.kubernetes.io/version: "0.22.1"
+    app.kubernetes.io/version: "0.22.2"
     app.kubernetes.io/managed-by: Helm
 data:
   config.yaml: |-
@@ -118,10 +118,10 @@ kind: DaemonSet
 metadata:
   name: tracee
   labels:
-    helm.sh/chart: tracee-0.22.1
+    helm.sh/chart: tracee-0.22.2
     app.kubernetes.io/name: tracee
     app.kubernetes.io/instance: tracee
-    app.kubernetes.io/version: "0.22.1"
+    app.kubernetes.io/version: "0.22.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   selector:
@@ -140,7 +140,7 @@ spec:
         {}
       containers:
         - name: tracee
-          image: "docker.io/aquasec/tracee:0.22.1"
+          image: "docker.io/aquasec/tracee:0.22.2"
           imagePullPolicy: IfNotPresent
           command:
             - /tracee/tracee
@@ -218,10 +218,10 @@ kind: Deployment
 metadata:
   name: tracee-operator
   labels:
-    helm.sh/chart: tracee-0.22.1
+    helm.sh/chart: tracee-0.22.2
     app.kubernetes.io/name: tracee
     app.kubernetes.io/instance: tracee
-    app.kubernetes.io/version: "0.22.1"
+    app.kubernetes.io/version: "0.22.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -238,7 +238,7 @@ spec:
         {}
       containers:
       - name: tracee-operator
-        image: "docker.io/aquasec/tracee:0.22.1"
+        image: "docker.io/aquasec/tracee:0.22.2"
         imagePullPolicy: IfNotPresent
         command:
           - /tracee/tracee-operator

pkg/signatures/benchmark/benchmark_test.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/aquasecurity/tracee/pkg/events"
 	"github.com/aquasecurity/tracee/pkg/signatures/benchmark/signature/golang"
 	"github.com/aquasecurity/tracee/pkg/signatures/benchmark/signature/rego"
 	"github.com/aquasecurity/tracee/pkg/signatures/engine"
@@ -231,58 +230,6 @@ func BenchmarkEngineWithNSignatures(b *testing.B) {
 	}
 }
 
-func BenchmarkEngineMultipleMethodsGetMetadata(b *testing.B) {
-	benches := []struct {
-		name     string
-		sigFuncs []func() (detect.Signature, error)
-		Enabled  bool
-	}{
-		{
-			name:     "Performance sig GetMetadata() - static",
-			sigFuncs: []func() (detect.Signature, error){golang.NewPerformanceStatic},
-		},
-	}
-
-	for _, bc := range benches {
-		b.Run(bc.name, func(b *testing.B) {
-			var sigs []detect.Signature
-			for _, sig := range bc.sigFuncs {
-				s, _ := sig()
-				sigs = append(sigs, s)
-			}
-
-			for i := 0; i < b.N; i++ {
-				// Produce events without timing it
-				b.StopTimer()
-				inputs := ProduceEventsInMemory(inputEventsCount)
-				output := make(chan *detect.Finding, inputEventsCount*len(sigs))
-
-				config := engine.Config{
-					Signatures:          sigs,
-					Enabled:             true,
-					SigNameToEventID:    allocateEventIdsForSigs(events.StartSignatureID, sigs),
-					ShouldDispatchEvent: func(int32) bool { return true },
-				}
-
-				e, err := engine.NewEngine(config, inputs, output)
-				require.NoError(b, err, "constructing engine")
-
-				err = e.Init()
-				require.NoError(b, err, "initializing engine")
-				b.StartTimer()
-
-				// Start signatures engine and wait until all events are processed
-				e.Start(waitForEventsProcessed(inputs.Tracee))
-
-				b.StopTimer()
-
-				// Set engine to nil to help with garbage collection
-				e = nil
-				runtime.GC()
-			}
-		})
-	}
-}
 func waitForEventsProcessed(eventsCh chan protocol.Event) context.Context {
 	ctx, cancel := context.WithCancel(context.Background())
 	go func() {

pkg/signatures/benchmark/helpers_test.go

@@ -4,10 +4,7 @@ import (
 	_ "embed"
 	"math/rand"
 
-	"github.com/aquasecurity/tracee/pkg/events"
-	"github.com/aquasecurity/tracee/pkg/logger"
 	"github.com/aquasecurity/tracee/pkg/signatures/engine"
-	"github.com/aquasecurity/tracee/types/detect"
 	"github.com/aquasecurity/tracee/types/protocol"
 	"github.com/aquasecurity/tracee/types/trace"
 )
@@ -174,20 +171,3 @@ func ProduceEventsInMemoryRandom(n int, seed ...trace.Event) engine.EventSources
 		Tracee: eventsCh,
 	}
 }
-
-func allocateEventIdsForSigs(startId events.ID, sigs []detect.Signature) map[string]int32 {
-	namesToIds := make(map[string]int32)
-	newEventDefID := startId
-	// First allocate event IDs to all signatures
-	for _, s := range sigs {
-		m, err := s.GetMetadata()
-		if err != nil {
-			logger.Warnw("Failed to allocate id for signature", "error", err)
-			continue
-		}
-
-		namesToIds[m.EventName] = int32(newEventDefID)
-		newEventDefID++
-	}
-	return namesToIds
-}

signatures/golang/anti_debugging_ptraceme.go

@@ -14,30 +14,28 @@ type AntiDebuggingPtraceme struct {
 	ptraceTraceMe string
 }
 
-var antiDebuggingPtracemeMetada = detect.SignatureMetadata{
-	ID:          "TRC-102",
-	Version:     "1",
-	Name:        "Anti-Debugging detected",
-	EventName:   "anti_debugging",
-	Description: "A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.",
-	Properties: map[string]interface{}{
-		"Severity":             1,
-		"Category":             "defense-evasion",
-		"Technique":            "Debugger Evasion",
-		"Kubernetes_Technique": "",
-		"id":                   "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391",
-		"external_id":          "T1622",
-	},
-}
-
 func (sig *AntiDebuggingPtraceme) Init(ctx detect.SignatureContext) error {
 	sig.cb = ctx.Callback
 	sig.ptraceTraceMe = "PTRACE_TRACEME"
 	return nil
 }
 
 func (sig *AntiDebuggingPtraceme) GetMetadata() (detect.SignatureMetadata, error) {
-	return antiDebuggingPtracemeMetada, nil
+	return detect.SignatureMetadata{
+		ID:          "TRC-102",
+		Version:     "1",
+		Name:        "Anti-Debugging detected",
+		EventName:   "anti_debugging",
+		Description: "A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.",
+		Properties: map[string]interface{}{
+			"Severity":             1,
+			"Category":             "defense-evasion",
+			"Technique":            "Debugger Evasion",
+			"Kubernetes_Technique": "",
+			"id":                   "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391",
+			"external_id":          "T1622",
+		},
+	}, nil
 }
 
 func (sig *AntiDebuggingPtraceme) GetSelectedEvents() ([]detect.SignatureEventSelector, error) {