v0.9.0
It's never been better to run Tracee in Kubernetes! This release represents a significant jump in the value of running Tracee in user's Kubernetes environment. This is most notably because of the huge contribution of Aqua's research team, adding 20+ new signatures to tracee-rules. Users can enable these to instantly gain detection of common cloud native attacks without having to write a single policy.
We've also revamped our documentation to make installing, running, and understanding Tracee even more accessible to its users.
Thank you to all our external contributors who participated in this release by either contributing code, documentation, or opening issues!
New Signatures
In #2271/2259, 20+ new signatures were introduced. Signatures allow users of Tracee to apply policies for what kind of potentially malicious behaviors they want to be alerted of.
For example, the new proc_mem_access signature alerts on common attack patterns where one process attempts to read for the memory of another vulnerable process. Credentials and secrets can be obtained this way
Check out the Available Rules page on the documentation site for an explanation of all provided signatures you can use with Tracee.
New Events
To power some of these new signatures and add more possibilities for future ones, we've added two new events, the raw hooks that Tracee uses to gather insight. In particular they are kallsyms_lookup_name and bpf_attach. (#2255 and #2079)
Documentation
We've restructured documentation to be more accessible for users, as opposed to just developers. There's also a new quickstart guide for running Tracee in Kubernetes, the target use-case for it. Check out the documentation site here.
More Highlights
There are many fixes and code quality improvements to Tracee. This includes but isn't limited to new tests, standardizing of logging, fixing the way you can install Tracee with Helm, and upgrading to the latest version of libbpf.
Breaking Changes
security_inode_unlinkevent's 'device' argument was renamed to 'dev' (#2175)
Docker images
docker pull docker.io/aquasec/tracee:0.9.0 (embedded eBPF CO-RE obj with BTFHUB support)docker pull docker.io/aquasec/tracee:full-0.9.0 (compiles non CO-RE eBPF object on startup)
Full Changelog
7954dc6 - docs: add overview to docs, contributing sections (#2275) (Jose Donizetti)
dcbcb9d - docs: stop creating docs for patch versions (#2274) (Jose Donizetti)
10b97e8 - signatures: add TRC-108 to the export list so it is installed (Rafael David Tinoco)
5271aef - signatures: do not install rego signatures by default (Rafael David Tinoco)
ecd378b - kerneltest: test new golang sigs instead of rego ones (Rafael David Tinoco)
bb5bb07 - signature: use socket_dup event instead of dup(s) syscalls in stdio_over_socket.go (RoiKol)
6a0f8a3 - signatures: use helpers to get addr argument details (RoiKol)
2694bdf - signatures: serialize TRC IDs (RoiKol)
5add098 - signature: use sched_process_exec instead of execve in kubernetes_api_connection.go sig (RoiKol)
3fc7d0e - signature: add syscall_table_hooking.go sig (RoiKol)
a5e955a - signature: add proc_fops_hooking.go sig (RoiKol)
08e363e - signature: add kubernetes_certificate_theft_attempt.go sig (RoiKol)
40fc0cd - signature: add kernel_module_loading.go sig (RoiKol)
0046569 - signature: add k8s_service_account_token.go sig (RoiKol)
36e5808 - signature: add illegitimate_shell.go sig (RoiKol)
305c7b4 - signature: add fileless_execution.go sig (RoiKol)
b5c88c3 - signature: add dynamic_code_loading.go sig (RoiKol)
904ace4 - signature: add disk_mount.go sig (RoiKol)
4e7fd14 - signature: add process_vm_write_code_injection.go sig (RoiKol)
cc469cb - signature: add ptrace_code_injection.go sig (RoiKol)
cd26823 - signature: add anti_debugging_ptraceme.go sig (RoiKol)
071bdfc - signature: add hidden_file_created.go sig (RoiKol)
d84122c - signature: add proc_mem_access.go sig (RoiKol)
b1013aa - signature: add proc_kcore_read.go sig (RoiKol)
2125a85 - signature: add core_pattern_modification.go sig (RoiKol)
a63f0b2 - signature: add rcd_modification.go sig (RoiKol)
f120665 - signature: add cgroup_release_agent_modification.go sig (RoiKol)
cc897ab - signature: add system_request_key_config_modification.go sig (RoiKol)
64356d7 - signature: add sched_debug_recon.go sig (RoiKol)
5150eb5 - signature: add sudoers_modification.go sig (RoiKol)
80f1aaa - signature: add default_loader_modification.go sig (RoiKol)
ab1f7b1 - signature: add cgroup_notify_on_release_modification.go sig (RoiKol)
7a48cea - signature: add ld_preload.go sig (RoiKol)
6885524 - signature: add scheduled_task_modification.go sig (RoiKol)
c173d22 - signature: add docker_abuse.go sig (RoiKol)
5b029ff - signature: add proc_mem_code_injection.go sig (RoiKol)
7b8b964 - signature: add dropped_executable.go sig (RoiKol)
f78982b - signature: add aslr_inspection.go sig (RoiKol)
4e9750a - Update tracee tags in deployments (#2256) (grantseltzer)
1376dfa - docs: restructuring documentation (#2265) (Jose Donizetti)
abf218b - docs: update RELEASING.md to publish helm (#2270) (Jose Donizetti)
cb1d0f3 - k8s: make postee optional (#2268) (Jose Donizetti)
53e1bbc - k8s: add kind to helm publishing for testing (#2263) (Jose Donizetti)
6242a21 - rules: migrate log calls to new logger (#2224) (Shubham Palriwala)
784df91 - events: add kallsyms_lookup_name event (RoiKol)
fe7cbbb - events: add bpf_attach event (#2079) (roikol)
3e24071 - Upgrade libbpfgo to v0.4.3-libbpf-1.0.1 and (#2220) (grantseltzer)
2f49db4 - integration: fix integration tests (#2250) (Rafael David Tinoco)
ae12514 - refactor: improve help handling (#2241) (Jose Donizetti)
bd48dd2 - Fix helm publishing (#2247) (Jose Donizetti)
88791a7 - k8s: fix helm publishing (#2245) (Jose Donizetti)
9a1f8c9 - refactor: remove debug flag from pkg/server (#2239) (Jose Donizetti)
f44a435 - uprobe: fix uprobe trigger triggered from multiple tracee instances (#2230) (AsafEitani)
9965fd9 - tests: add filters tests and benchmarks (Nadav Strahilevitz)
9e8ba73 - filters: refactor to allow multiple parses (Nadav Strahilevitz)
05bf6f5 - filters: add error files (Nadav Strahilevitz)
4f8684a - filters: add Min and Max methods (Nadav Strahilevitz)
1529dbe - filters: move enabling logic to methods (Nadav Strahilevitz)
cb56c15 - filters: encapsulate min, max, args and ret logic (Nadav Strahilevitz)
6697e68 - filters: split into bpf filters (Nadav Strahilevitz)
98666e1 - filters: add filter constructors (Nadav Strahilevitz)
5dbc539 - filters: reuse StringFilter in ArgFilter (Nadav Strahilevitz)
c75230e - flags: remove tests (Nadav Strahilevitz)
bb611da - events: add GetID helper (Nadav Strahilevitz)
81eb1b3 - filters: add prefix and suffix sets (Nadav Strahilevitz)
f363f1c - pkg/ebpf: fix bug in support for arg types (#2228) (Alon Zivony)
dd41bad - pkg/ebpf+events: created new event for sigaction (Alon Zivony)
4a918e2 - pkg/ebpf: fix get_node_addr macro (Alon Zivony)
024d5b4 - events: include 32bit syscalls in syscall event range (#2218) (Nadav Strahilevitz)
5c2aabe - container enrichment: skip enriched events (#2214) (Nadav Strahilevitz)
a929e9d - metrics: add events filtered stat (#2212) (Nadav Strahilevitz)
c29685c - kerneltest: fix test name variable (#2213) (Rafael David Tinoco)
ec9bcd1 - logger: change API function names (#2208) (Geyslan Gregório)
968152e - log: introduce logger package (#2110) (Geyslan Gregório)
1efc149 - docs: fix symbols_loaded typos (Nadav Strahilevitz)
3989bc3 - events: move symbols_loaded to userspace event ids (Nadav Strahilevitz)
23666f8 - pkg/ebpf: quick fix for args_map memory leak (Alon Zivony)
374e729 - tracee.bpf.c: fix submit of shared_object_loaded (Nadav Strahilevitz)
bfdd481 - README: Fix typo (Margarita Manterola)
306275d - types/trace: support arbitrary pointers in json (#2182) (Alon Zivony)
bc58ca8 - Test: Add Unit tests for params under event parsing (#2199) (Shubham Palriwala)
264056c - refactor: clean up tracee-rules/main.go (#2194) (Jose Donizetti)
b567f6b - fix: change k8s version to 0.8.3 (#2195) (Jose Donizetti)
c0ffcc6 - Test_getTailCalls: fix intermittent failure (#2192) (Nadav Strahilevitz)
cedb4c3 - README: fix indention of "docker run" blocks (#2193) (Nils Hanke)
fefeb08 - pprof: move to server package (#2180) (Jose Donizetti)
c0d24c7 - docs: small fixes (Yaniv Agman)
4f2d828 - bpf-nocore: remove compilation warnings and unused variables (#2179) (Rafael David Tinoco)
ccfb903 - deprecation: adjust deprecation warnings (Rafael David Tinoco)
a8a3668 - parse_args: fix {get,set}sockopt new parse option (Rafael David Tinoco)
9cd4e86 - capabilities: fix usage of kernel version interface (grantseltzer)
4848140 - libbpf: bump to v1.0.0 (Rafael David Tinoco)
ca6e82f - libbpfgo: bump to v0.4.0-libbpf-1.0.0-8-g14c6bc9 (Rafael David Tinoco)
8468f89 - events: rename security_inode_unlink device arg (#2175) (AsafEitani)