[LIBS PLUGINS] Expose libs syscalls PPME_
events enum over a new plugin API
#1711
Labels
kind/feature
New feature or request
PPME_
events enum over a new plugin API
#1711
Motivation
Currently, plugins need to redefine syscalls event types (of type
falcosecurity::event_type
) resulting in needing to redefine an enum. This approach risks discrepancies between libs' nativePPME_
enum and the enum used by the plugins. For example the currentk8smeta
plugin follows this practice of redefinition. On the other hand the open PR falcosecurity/plugins#419 for theanomalydetection
plugin employs a workaround via importing the libs enum.Feature
When the event source is
syscall
, a new plugin API should be introduced to allow the importing of syscall libs'PPME_
events enum, making them accessible. This enables us to switch the plugin'sevt.get_type()
within theparse_event
plugin logic while reusing thePPME_
codes from libs, such asPPME_SYSCALL_EXECVEAT_X
andPPME_SYSCALL_EXECVE_19_X
, for example ...The text was updated successfully, but these errors were encountered: