Tracee v0.6.5 release!

[grantseltzer]

v0.6.5 is here! This release contains various fixes, optimizations, and upgrades.

See the release page for a full change-log: https://github.com/aquasecurity/tracee/releases/tag/v0.6.5

Breaking changes

• The exec-info output option of tracee-ebpf was renamed to exec-hash to more accurately describe it's effect
• The --security-alerts flag of tracee-ebpf was removed, you can choose to trace mem_prot_alert directly using the --trace flag
• If --output file: points to an existing file, it will not be used instead of being removed and recreated.

Notable changes

• Full 64 character container IDs (was 12) (tracee-ebpf: use cgroup id for container id resolution #1130)
• Added support for reporting container IDs from podman container engine (tracee-ebpf: use cgroup id for container id resolution #1130)
• New events (tracepoints) cgroup_mkdir, cgroup_rmdir(tracee-ebpf: use cgroup id for container id resolution #1130)
• sched_process_exec now reports the type of stdin inode attached to the executed process (add type of stdin in sched_process_exec #1214)
• security_file_open event now reports ctime (add ctime to security_file_open and fix variable type #1167)

Notable fixes

• Tracee-ebpf will now properly be fully loaded and ready before signaling that it's ready (wait for tracee-ebpf to load #967)
• Fixed missing tiny dependency in the slim contianer (fix: install the tini package in the tracee:slim container image #1162)
• Container tracing will now work even when run with pidns=host