Tracee v0.11.1 released!

[rafaeldtinoco]

Tracee v0.11.1 just released! This is a bug-fix release!
https://github.com/aquasecurity/tracee/releases/tag/v0.11.1

🚨 Important Fixes

• Network packet events (bellow) missing/corrupted. Anyone relying on network events should migrate to this version because of this fix. More Info.

  • net_packet_ipv4
  • net_packet_ipv6
  • net_packet_tcp
  • net_packet_udp
  • net_packet_icmp
  • net_packet_icmpv6
  • net_packet_dns
  • net_packet_dns_request
  • net_packet_dns_response
  • net_packet_http
  • net_packet_http_request
  • net_packet_http_response

• Network packet capture (PCAP) default option is now a single file. Other options include "container", "processed" and "command" (so PCAP files are split into those categories as well).

• Tracee BTFHub support includes all available kernels from the Hub (was missing build script update). Kernels that don't have BTF information embedded for the following distros:

  • CentOS 7 (5.4 kernel)
  • CentOS 8 (4.18 kernels)
  • RHEL 8 (4.18 kernels)
  • SLES 15.3 (5.3 kernels)
  • Oracle Linux 7 (5.4 kernels)
  • Oracle Linux 8 (5.4 kernels)
  • Debian 10 (5.10 kernels)
  • Fedora 28 (5.0 kernels)
  • Fedora 29 (5.3 kernels)
  • Fedora 30 (5.0 and 5.6 kernels)
  • Fedora 31 (5.3 kernels)
  • Ubuntu Bionic (5.0, 5.3, 5.4 kernels)
  • Ubuntu Focal (5.4, 5.8, 5.11 kernels)

🚀 Misc fixes

• 56dc0ac - network: fix: check if socket family is supported
• 66ed18d - network: fix network packets corruption
• 1aca152 - network: fix segfault in DNS parser
• cc7e768 - tracee-rules: bypass capabilities if user not root
• 58e5a0b - pipeline: fix multiple derived events logic
• e690784 - btfhub: sync new kernels recently added
• a422503 - fix: change log flag to be a string slice
• 4a36406 - logger: flush logs periodically
• 061f163 - metrics: remove old net event stats
• 4dee790 - chore: improve --help command
• b2e34c0 - signatures: add path to dropped_executable data
• dbbe479 - network: default to capturing all network traffic
• 2d57873 - documentation: expose events documentation
• 5125b57 - tracee: fix pid file initialization
• b328b1b - lockdown: fix: turn error message into a debug one
• be49c79 - network: fix retval for IPv6 packets
• f941e2a - packaging: fix os packaging
• 12dcab5 - ebpf: add reset_event_args() function
• eee6e20 - golang: fix deprecated go packages functions
• ac6b77a - docs: update required docker flags
• 091dba0 - Fix processes root directory access
• d98256c - refactor: small fixes after ebpf code split
• 1f87e92 - fix: tests: TestInitNamespacesEvent to integration
• 16a5e54 - fix: filters: uint can't be less than 0