Tracee v0.18.0 Released!

[rafaeldtinoco]

🚨 Breaking changes 🔨

Tracee policies apiVersion and kind were renamed for better compatibility as Kubernetes CRDs:

apiVersion: tracee.aquasec.com/v1beta1
kind: Policy

🚀 What's new? 🚀

💡 New GRPC API (Experimental) ☎️

Tracee now has a fully functional beta GRPC API. The following operations are supported with more coming in the future:

• Consume events using GRPC stream
• Enable/Disable events
• Diagnostics & Logging
• Performance Counters

Note that events of the GRPC API follow a new event structure which isn't compatible with the older event structure. In future versions of Tracee this new structure will replace the older one for all other interactions.

🗃️ Process Tree 🌲

Tracee now maintains live representation of the system processes tree. This information is exposed to signatures through the datasource mechanism which allows signatures to access data collected by Tracee.

An example on how this feature can be used by a signature event can be found here.

📩 Events / Signatures ⚡️

• New event: ftrace_hook (events: add ftrace_hook event #3412)
• Add argv to security_bprm_check (feat: add argv to security_bprm_check #3442)

🦄 Misc 💐

• Filter file capture by ELF type (feat: filter file capture by ELF type #3361)

🔨 Fixes 👷

• fix(ebpf): triggerMemDump check all filters (fix(ebpf): triggerMemDump check all filters #3504)
• fix(packaging): adjust ubuntu and fedora packaging (fix(packaging): adjust ubuntu and fedora packaging #3502)
• fix: stackaddress needs to have symbol name
• fix(event): enable ksymbols engine for PrintMemDump (fix(definitions): ksymbols dependencies handled wrongly #3443)
• Fix(capture): fix verifier issue with elf capture (Fix(capture): fix verifier issue with elf capture #3433)
• fix: fix section name for vfs_readv (fix: fix section name for vfs_readv #3421)
• fix: capture of writev (fix: capture of writev #3413)
• fix: ignore error for cgroups that doesn't exist
• fix: log level should match zap log priority
• fix: k8s policies tutorial
• fix(cmd): --help flag parsing
• fix(capture): remove CONFIG_KALLSYMS_ALL dependency (bugfix(capture): remove CONFIG_KALLSYMS_ALL dependency #3381)
• fix(config): loading config file
• fix(flags)!: del help cmd, add md files for flags (remove help command, create flags markdown docs #3321)
• fix: validate policy names are rfc 1123 (fix: validate policy names are rfc 1123 #3335)
• fix(ebpf): size of mntns/pidns filters key holders (fix(ebpf): size of mntns/pidns filters key holders #3337)
• feature:(ebpf): don't fail on probe attachment err