Tracee v0.22.0 Released!

[itaysk]

⚠️ Breaking Changes

Deprecation of ARM Kernels 5.4 and 4.18

Deprecating support ARM CPU on Linux kernels 5.4 and 4.18. Users on ARM are encouraged to update to newer kernels. #4247

⚡ New and modified Events

• New event tracee_info that exports information relating to Tracee upon startup, providing more visibility into the internal state of Tracee. #4166
• New event security_task_setrlimit #4148
• New event security_settime64 to monitor time-related security changes. #4201
• New event net_packet_raw for capturing the full payload of network packets. #4122
• sched_process_exec event added prev_comm field. #4206
• module_load event added path and ctime fields. #4235

🚀 New Features

Pipeline Channel Size Configuration

You can now configure the buffer size fo Go Channels that are used internally in Tracee's event processing pipeline. This is done using the new --pipeline-channel-size flag or pipeline-channel-size configuration file key. This can be useful when fine-tuning Tracee for the host it is installed on. #4182

Events Timestamp Using Boot Time

Tracee events timestamp now report more accurate boot time which accounts for time system was suspended (on supported kernels). This improves compatibility with other Linux facilities such as procfs. #4117

💎 Performance Optimizations

Reduced Dependency on sys_enter/sys_exit

Multiple eBPF programs were optimized to no longer rely on Linux's sys_enter/sys_exit mechanism, including events: security_socket_setsockopt, security_file_open, security_socket_accept, mem_prot_alert, security_socket_bind, set_fs_pwd, trace_execute_failed2, and security_socket_connect. This should improve the performance and resource utilization of Tracee. #4224 #4226 #4213 #4227 #4225 #4228 #4220 #4256 #4202

Argument Parsing Enhancements

Enhanced the performance of data field parsing in policy event filters, reducing execution time and improving overall efficiency. #4197, #4198 #4199 #4194

Process Tree Improvements

Significant improvements made to the process tree (Proctree) feature, reducing RSS memory usage and enhancing performance. #4261 #4242

BPF Object Release

BPR programs objects are now released after locaded, saving approximately 14MB of RSS memory. #4209

Signature Metadata Optimization

Changed the signature metadata definition struct to be static, reducing memory allocation and size when large number of sugnatures are loaded. #4237

Other BPF performance optimizations

#4217 #4200 #4183 #4200

🛠️ Bug Fixes

• Resolved issues in integration tests to ensure reliable test coverage. #4157
• Fixed a deadlock within the dependencies package that could cause the application to hang. #4173
• Addressed concurrency issues in the capabilities package, ensuring safer parallel execution. #4175
• Ensured manual files are included in the release image/archive to provide necessary documentation. #4230
• Corrected handling of tabs in input lines for ftrace_hook events to ensure accurate parsing. #4110
• Fixed the incorrect syscall ID used for compat in eBPF programs. #4245
• Ensured correct event dependency probe for process_execute_failed. #4203
• Corrected the TRACE_RET_FUNC macro to ensure proper function tracing in all scenarios. #4216
• Fixed the check for triggering container enrichment on cgroups. Previously, non container cgroup entries could trigger enrichment, which would cause error logs and was generally wrong. #4193

For a complete list of changes and further details, please refer to the commit log on the project repository.