Skip to content

Commit

Permalink
Readme: update execve known issue status
Browse files Browse the repository at this point in the history
  • Loading branch information
yanivagman committed Dec 17, 2019
1 parent 5b6bffc commit bdd847a
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -168,13 +168,12 @@ Adding new events (especially system calls) to Tracee is straightforward, but on
* Add envp to execve(at) syscalls. Put argv and envp in a list instead being different param for each arg
* Add full sockaddr struct fields to: "connect", "accept", "bind", "getsockname"
* Consider tracing commit_creds to detect potential kernel exploits
* Fix missing pathname in execveat syscall
* Add check for head and tail to avoid overflow in the submission buffer
* Change submission_buf size from 32 to num_of_cpu which can be determined by userspace and set accordingly
* Consider re-writing userspace side (python) in golang
* Reduce number of missing events by optimizing event_t to use 4 bytes (sent by perf_submit)

## Known Issues

* Pathname is missing in execveat syscall
* Pathname is missing in execve(at) syscalls - Issue #2627 in BCC project
* Lost events when event rate is high

0 comments on commit bdd847a

Please sign in to comment.