Repository navigation
debugging pr-merged workflow - #17
Merged
Merged
Conversation
Signed-off-by: rcohen <rcohen@armosec.io>
matanshk
approved these changes
Mar 15, 2023
5 of 8 tasks
matthyx
added a commit
that referenced
this pull request
Nov 2, 2026
Re-pin the replace from the contributor's fork to the merge of kubescape/inspektor-gadget#17 (9864428b73f8) on the kubescape fork and drop the NOTE marker, so check-ig-pin passes. The merge reverts the fork-only commit that disabled kubelet runtime socket discovery without a CA bundle. The carried notation-go and ebpf-profiler replaces still match the fork's go.mod. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
matthyx
added a commit
that referenced
this pull request
Nov 2, 2026
…1062) * feat(exec): use resolved file path and basename argv[0] matching for IG v0.57 IG v0.57 captures the real argv after exec, so argv[0] is no longer the requested pathname. - GetExecPathFromEvent returns file, then exepath, then comm; add GetFile() to ExecEvent (DatasourceEvent, StructEvent). - R0040 (cp.was_executed_with_args) uses B1': argv[0] compared by basename ignoring a leading '-', full compare when profile[0] contains a wildcard, single-element guard, nil/empty runtime argv treated as unknown (match). Rewrite the stale matching comment to the storage semantics. - Exec alert CommandLine/Cmdline are the full argv, falling back to the path. - Malware scan: add GetHostFilePathsFromEvent; exec scans file, falls back to /proc/<pid>/exe for empty, memfd or deleted files, and also scans exepath when it differs (shebang, binfmt_misc). - Exec operator keeps events with an empty args payload (GetArgs() == nil). - TestExecFields expects tty_major, tty_minor, ctime, fctime, pctime. - Document field semantics, path order, B1', scan paths and rule gating. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * build(deps): pin inspektor-gadget v0.57.0 fork merge and bump gadgets to v0.57.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * test(tty): expect phase-2 TTY semantics from trace_exec v0.57.0 trace_exec v0.57.0 emits tty_major/tty_minor, so GetHasTTY reads the device major instead of the ambiguous index. Test_35 still encoded the v0.48.1 contract. CI run 41026324629 measured c-pts0=1, R9903=3, R9904=0. - R9901 must now fire for the single exec on /dev/pts/0. - R9903 must fire and R9904 must stay silent. - Update the rule file comments and docs/features/exec-tty-field.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * build(deps): pin inspektor-gadget to merged kubescape fork PR #17 Re-pin the replace from the contributor's fork to the merge of kubescape/inspektor-gadget#17 (9864428b73f8) on the kubescape fork and drop the NOTE marker, so check-ig-pin passes. The merge reverts the fork-only commit that disabled kubelet runtime socket discovery without a CA bundle. The carried notation-go and ebpf-profiler replaces still match the fork's go.mod. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * fix(exec): keep an oversized argv[0] so R0040 cannot be bypassed With IG v0.57 the argv block is capped at 5120 bytes and a trailing partial argument is dropped. When argv[0] alone exceeds the cap, the payload has no complete argument, the event carried empty args, and matchExecArgv treated it as an unknown capture, so R0040 matched any arguments of a learned binary (exec -a with a long name). Keep the truncated argv[0] as the only argument instead; an empty payload still yields nil (argv unknown). Test_35 now re-reads the alerts after a settle interval before asserting that R9901 (no-TTY container) and R9904 did not fire, so a late alert cannot slip past the snapshot taken when R9902 arrived. Addresses CodeRabbit review 5735305704. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> --------- Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview