fix: signature event not triggering if base filtered

pkg/ebpf/events_pipeline.go

@@ -249,11 +249,14 @@ func (t *Tracee) decodeEvents(outerCtx context.Context, sourceChan chan []byte)
 			}
 
 			// If there aren't any policies that need filtering in userland, tracee **may** skip
-			// this event, as long as there aren't any derivatives that depend on it. Some base
-			// events (for derivative ones) might not have set related policy bit, thus the need
-			// to continue with those within the pipeline.
+			// this event, as long as there aren't any derivatives or signatures that depend on it.
+			// Some base events (derivative and signatures) might not have set related policy bit,
+			// thus the need to continue with those within the pipeline.
 			if t.matchPolicies(&evt) == 0 {
-				if _, ok := t.eventDerivations[eventId]; !ok {
+				_, hasDerivation := t.eventDerivations[eventId]
+				_, hasSignature := t.eventSignatures[eventId]
+
+				if !hasDerivation && !hasSignature {
 					_ = t.stats.EventsFiltered.Increment()
 					continue
 				}

pkg/ebpf/tracee.go

@@ -77,6 +77,7 @@ type Tracee struct {
 	eventsSorter     *sorting.EventsChronologicalSorter
 	eventProcessor   map[events.ID][]func(evt *trace.Event) error
 	eventDerivations derive.Table
+	eventSignatures  map[events.ID]bool
 	// Artifacts
 	fileHashes     *lru.Cache[string, fileExecInfo]
 	capturedFiles  map[string]int64
@@ -181,6 +182,7 @@ func GetCaptureEventsList(cfg config.Config) map[events.ID]eventConfig {
 
 func (t *Tracee) handleEventsDependencies(eventId events.ID, submitMap uint64) {
 	definition := events.Definitions.Get(eventId)
+
 	eDependencies := definition.Dependencies
 	for _, dependentEvent := range eDependencies.Events {
 		ec, ok := t.events[dependentEvent.EventID]
@@ -190,6 +192,10 @@ func (t *Tracee) handleEventsDependencies(eventId events.ID, submitMap uint64) {
 		}
 		ec.submit |= submitMap
 		t.events[dependentEvent.EventID] = ec
+
+		if events.IsASignatureEvent(eventId) {
+			t.eventSignatures[dependentEvent.EventID] = true
+		}
 	}
 }
 
@@ -205,12 +211,13 @@ func New(cfg config.Config) (*Tracee, error) {
 	// Create Tracee
 
 	t := &Tracee{
-		config:        cfg,
-		done:          make(chan struct{}),
-		writtenFiles:  make(map[string]string),
-		readFiles:     make(map[string]string),
-		capturedFiles: make(map[string]int64),
-		events:        GetEssentialEventsList(),
+		config:          cfg,
+		done:            make(chan struct{}),
+		writtenFiles:    make(map[string]string),
+		readFiles:       make(map[string]string),
+		capturedFiles:   make(map[string]int64),
+		events:          GetEssentialEventsList(),
+		eventSignatures: make(map[events.ID]bool),
 	}
 
 	// Initialize capabilities rings soon

pkg/events/events.go

@@ -185,11 +185,9 @@ type Event struct {
 	Params       []trace.ArgMeta
 }
 
-func (e *Event) IsASignatureEvent() bool {
-	for _, s := range e.Sets {
-		if s == "signatures" {
-			return true
-		}
+func IsASignatureEvent(id ID) bool {
+	if id >= StartSignatureID && id <= MaxSignatureID {
+		return true
 	}
 
 	return false

pkg/filters/args.go

@@ -106,7 +106,7 @@ func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, even
 	}
 
 	// if the event is a signature event, we allow filtering on dynamic argument
-	if !argFound && !eventDefinition.IsASignatureEvent() {
+	if !argFound && !events.IsASignatureEvent(id) {
 		return InvalidEventArgument(argName)
 	}