Skip to content

Commit

Permalink
fix(event): fix hooked_syscall when picked by sig only
Browse files Browse the repository at this point in the history
Change is needed because for a signature event using the "hookedsyscall"
event, the hooked syscall won't be emitted, only the detection made by
the signature using the event as a dependency.
  • Loading branch information
rafaeldtinoco committed Oct 27, 2023
1 parent ccaeb71 commit de80640
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion pkg/ebpf/hooked_syscall_table.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ func (t *Tracee) hookedSyscallTableRoutine(ctx gocontext.Context) {
logger.Debugw("Starting hookedSyscallTable goroutine")
defer logger.Debugw("Stopped hookedSyscallTable goroutine")

if t.eventsState[events.HookedSyscall].Emit == 0 {
if t.eventsState[events.HookedSyscall].Submit == 0 {
return
}

Expand Down

0 comments on commit de80640

Please sign in to comment.