chore(proctree) adjust the place for process tree initialization

pkg/ebpf/controlplane/controller.go

@@ -64,9 +64,7 @@ func (ctrl *Controller) Start() {
 // Run runs the controller.
 func (ctrl *Controller) Run(ctx context.Context) {
 	ctrl.ctx = ctx
-
 	ctrl.debug(false)
-	ctrl.readProcFS()
 
 	for {
 		select {
@@ -114,16 +112,6 @@ func (ctrl *Controller) processSignal(signal signal) error {
 
 // Private
 
-// readProcFS reads the procfs and feeds the process tree with data.
-func (ctrl *Controller) readProcFS() {
-	go func() {
-		err := ctrl.processTree.FeedFromProcFS(proctree.AllPIDs)
-		if err != nil {
-			logger.Debugw("error feeding process tree from procfs", "error", err)
-		}
-	}()
-}
-
 // debug prints the process tree every 5 seconds (for debugging purposes).
 func (ctrl *Controller) debug(enable bool) {
 	//

pkg/ebpf/tracee.go

@@ -361,6 +361,19 @@ func (t *Tracee) Init() error {
 		logger.Debugw("Initializing buckets cache", "error", errfmt.WrapError(err))
 	}
 
+	// Initialize Process Tree
+
+	err = capabilities.GetInstance().Specific(
+		func() error {
+			t.processTree, err = proctree.NewProcessTree()
+			return err
+		},
+		cap.DAC_READ_SEARCH,
+	)
+	if err != nil {
+		return errfmt.WrapError(err)
+	}
+
 	// Initialize cgroups filesystems
 
 	t.cgroups, err = cgroup.NewCgroups()
@@ -1225,13 +1238,6 @@ func (t *Tracee) initBPF() error {
 		return errfmt.WrapError(err)
 	}
 
-	// Initialize Process Tree (right before Control Plane starts)
-
-	t.processTree, err = proctree.NewProcessTree()
-	if err != nil {
-		return errfmt.WrapError(err)
-	}
-
 	// Initialize Control Plane
 	t.controlPlane, err = controlplane.NewController(
 		t.bpfModule,

pkg/proctree/proctree.go

@@ -6,6 +6,7 @@ import (
 	lru "github.com/hashicorp/golang-lru/v2"
 
 	"github.com/aquasecurity/tracee/pkg/errfmt"
+	"github.com/aquasecurity/tracee/pkg/logger"
 )
 
 //
@@ -51,11 +52,21 @@ func NewProcessTree() (*ProcessTree, error) {
 		return nil, errfmt.WrapError(err)
 	}
 
-	return &ProcessTree{
+	procTree := &ProcessTree{
 		processes: processes,
 		threads:   threads,
 		mutex:     &sync.RWMutex{},
-	}, nil
+	}
+
+	// Walk procfs and feed the process tree with data.
+	go func() {
+		err := procTree.FeedFromProcFS(AllPIDs)
+		if err != nil {
+			logger.Debugw("error feeding process tree from procfs", "error", err)
+		}
+	}()
+
+	return procTree, nil
 }
 
 //

pkg/proctree/proctree_procfs.go

@@ -176,7 +176,6 @@ func (pt *ProcessTree) FeedFromProcFS(givenPid int) error {
 		taskPath := fmt.Sprintf("/proc/%v/task", p)
 		taskDirs, err := os.ReadDir(taskPath)
 		if err != nil {
-			fmt.Println(err)
 			return err
 		}
 		for _, taskDir := range taskDirs {