Events flags embedding #4191
Events flags embedding #4191
Conversation
geyslan
force-pushed
the
states-of-events-cont
branch
4 times, most recently
from
8976c34
to
8e117e2
Compare
|
It's passing all the tests. Gonna polish it and leave it for review asap. |
geyslan
force-pushed
the
states-of-events-cont
branch
from
8e117e2
to
903dddb
Compare
pkg/ebpf/events_pipeline.go
Outdated
| _, hasSignature := t.eventSignatures[eventId] | ||
| isSignature := t.policyManager.IsSignature(eventId) |
There was a problem hiding this comment.
I don't think this change is correct.
We want to check if the event have signatures that depend on it (hasSignature) and not if the event itself is a signature (isSignature)
There was a problem hiding this comment.
I think I've changed the nomenclature but need to double check the logic. Soon I'll be returning to this. Tks.
There was a problem hiding this comment.
Well, you are right and I detected the main issue. As I only moved logic into the new place, I noticed that it didn't save the events in the map as required by sigs, it just set if it's a signature. So, at that stage it didn't work as a shortcut.
My last change includes:
Fix t.eventSignatures[eventId] logic, now accessible via policy
manager IsRequiredBySignature(), since the former was only flagging
the event as signature, but not as required by one.
There was a problem hiding this comment.
@geyslan, I tested it and compared it with the main branch (which, as you mentioned, has a bug).
It makes the access to event flags be done through the policy manager, which is responsible for setting up the dependencies manager. This also: - Turn the event flags access thread-safe. - Renames manager and config types. - Fix t.eventSignatures[eventId] logic, now accessible via policy manager IsRequiredBySignature(), since the former was only flagging the event as signature, but not as required by one.
geyslan
force-pushed
the
states-of-events-cont
branch
from
903dddb
to
4dfd7da
Compare
1. Explain what the PR does
4dfd7da chore: inject deps manager into policy manager
9aff9d2 chore(policy): introduce ManagerConfig
443869e fix: validateKallsymsDependencies() nil deref
4dfd7da chore: inject deps manager into policy manager
2. Explain how to test it
3. Other comments
This is a enabler for #3987.