Skip to content

Commit

Permalink
fix: derived event not triggering if base filtered
Browse files Browse the repository at this point in the history
  • Loading branch information
josedonizetti committed Jun 28, 2023
1 parent 0b97409 commit 00f71ab
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions pkg/ebpf/events_pipeline.go
Original file line number Diff line number Diff line change
Expand Up @@ -510,16 +510,16 @@ func (t *Tracee) deriveEvents(ctx context.Context, in <-chan *trace.Event) (
t.handleError(err)
}

for i, derivative := range derivatives {
for i := range derivatives {
// Skip events that dont work with filtering due to missing types being handled.
// https://github.com/aquasecurity/tracee/issues/2486
switch events.ID(derivative.EventID) {
switch events.ID(derivatives[i].EventID) {
case events.SymbolsLoaded:
case events.SharedObjectLoaded:
case events.PrintMemDump:
default:
// Derived events might need filtering as well
if t.matchPolicies(&derivative) == 0 {
if t.matchPolicies(&derivatives[i]) == 0 {
_ = t.stats.EventsFiltered.Increment()
continue
}
Expand Down

0 comments on commit 00f71ab

Please sign in to comment.