Use 'syscall' source in extractor plugin

[Snailll]

Motivation
I want to make a custom extractor plugin to extend some field in the syscall events, just like some file stats .
So can I use 'syscall' source in my custom extractor plugin?

Feature

Alternatives

Additional context

[jasondellaluce]

Hi @Snailll, this is not supported yet but is in high demand in the community. This will be on the project roadmap, but I think no progress has been made so far.

[Snailll]

Hi @jasondellaluce ,thanks for your reply. How about the feasibility of writing a custom ebpf driver , a source plugin and a extractor plugin.
So I can get syscall info from the ebpf driver then extend fields in the syscall events by a custom plugin?

[jasondellaluce]

From a feasibility perspective, you can make something like this work even right now. However, the events coming from your source plugin will only be of "plugin type" from the standpoint of libsinsp and libscap, and so existing fields (evt.type, fd.name, proc.name, ...) will not be usable in Falco rules because the libsinsp internal state is not built from those kind of events.

I hope we will able to change this in the future. An OK solution will be to let plugins generate events of any type (not just "plugin type"). Note that the event type is a very meaningful information used by both libscap and libsinsp to implement things like capture reproduction (.scap files) and the reproduction of the system's state. I hope we'll explore this direction in the near future.

On the bright side, if you plan to built a plugin on top of other non syscall-related features of eBPF, than that would make sense even now and would be a cool project/contribution to attempt! 😄

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jasondellaluce]

/remove-lifecycle rotten
/reopen

[poiana]

@jasondellaluce: Reopened this issue.

In response to this:

/remove-lifecycle rotten
/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[jasondellaluce]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale