Known Limitations and Roadmap

Known Limitations & Roadmap

v1 limitations (by design, not oversight)

• No inode/rename tracking. trace matches by exact path string. A file extracted or renamed to a new path shows up as an unrelated path, not a continuation of the same chain. The flagship "malware.zip → extracted → malware.exe" example only chains correctly because the extracting process opens both paths while watch is running (so the link is real, just derived from co-occurrence, not inode identity) — a mv or archive tool that doesn't hold both paths open at once would break the link.
• No library-load tracking. Only the top-level execve() target is recorded, not dlopen()/dynamic linker activity.
• PID reuse is handled, but coarsely. processes is keyed by (pid, started_ns) so distinct lifetimes of a recycled pid don't collide in the schema — but nothing currently prunes old rows, so the database grows without bound under a long-running watch.
• Requires root (or CAP_BPF + CAP_PERFMON) and a kernel exposing BTF at /sys/kernel/btf/vmlinux (5.8+, most distro kernels since ~2021).
• Single-host, no container/namespace awareness. A pid is a host pid; events aren't tagged with cgroup or mount namespace, so container-to-container provenance isn't distinguished.
• Ring buffer backpressure drops events, silently, under extreme burst. See BPF Hooks Reference § Ring buffer sizing.
• Pre-existing processes are seeded from /proc, not observed. watch snapshots /proc at startup so already-running processes get a name instead of a bare pid, but /proc only reports a process's current identity — a process that exec'd several times before provctl started shows only its latest image, and its earlier lineage is unrecoverable.

Roadmap ideas (not committed, in rough priority order)

1. Inode-based provenance. Track (device, inode) alongside path in file_events so renames/moves outside provctl's direct view can still be linked (requires also hooking rename-family syscalls).
2. Database retention/pruning. A --retain <duration> flag on watch to cap how long old process lifetimes and event rows are kept.
3. Container/namespace tagging. Record cgroup id / mount namespace on each event so ps/trace/timeline can scope to one container.
4. Library-load visibility. Either via dlopen uprobes or by reading /proc/<pid>/maps at exec time as a cheaper approximation.
5. provctl watch as a systemd service with the distro packages (see Installation), so capture survives reboots without a manual sudo provctl watch &.

Have an idea or found a real gap? Open an issue on the repo.