Prepare for v0.11.0

[yanivagman]

Draft to collaborate on v0.11.0 release announcement

🚀 What's new? 🚀

🎯 Multi-Scopes 🔍

It is now possible to provide more than one set of filters to Tracee. The new feature allows you to group sets of filters into individual "scopes". To create a scope, add a <number>: prefix to the filter on the command line. For example --trace 1:event=execve (notice the 1: prefix).

For example, let's say we wanted Tracee to collect the proc_mem_access signature across the system, and also any security_file_open under a specific directory. If we applied a filter to security_file_open, it would indirectly filter proc_mem_access because it depends on that event.
The new multi-scopes feature solved this common problem by letting you define two separate scopes for the two use-cases:

sudo tracee \
-t 1:event=proc_mem_access \
-t 2:event=security_file_open -t 2:security_file_open.args.pathname="/some/path/*" \

We have created scopes 1 and 2 which filter events individually. You can also see matching scopes in a new field on the event, which represent all matching scopes for the given event as a bitmap.
Read the documentation for more details and examples: Scopes

🌐 Network capture 🎣

This version of Tracee brings lots of new features for the network packets capturing (pcap) functionality:

• No need to specify a network interface: Tracee can now trace all network packets given to a process.
• Multiple choices of how to save the PCAP files (to be read by tcpdump):
  • A single file: keeps all network packets in a single PCAP file (host, containers, all processes)
  • Per container: keeps a single PCAP file PER container, containing all network packets for that container.
  • Per process: keeps a single PCAP file PER executed process, per CONTAINER directory.
  • Per command: keeps a single PCAP file PER command name, per CONTAINER directory.
• Limit how much of the packet payload is saved on each PCAP file, or choose to capture just headers.

Examples:

$ sudo tracee-ebpf \
    --trace event=net_packet_icmp \
    --capture network \
    --capture pcap:process,container,command
$ cd /tmp/tracee/out
$ find pcap
     pcap
     pcap/commands
     pcap/commands/b86533d11f3
     pcap/commands/b86533d11f3/ping.pcap
     pcap/commands/host
     pcap/commands/host/sshd.pcap
     pcap/commands/host/zerotier-one.pcap
     pcap/commands/host/node.pcap
     pcap/commands/fd95a035ce5
     pcap/commands/fd95a035ce5/ping.pcap
     pcap/processes
     pcap/processes/b86533d11f3
     pcap/processes/b86533d11f3/ping_1261180_1663772450241192.pcap
     pcap/processes/host
     pcap/processes/host/node_186708_1573567360495399.pcap
     pcap/processes/host/node_1196826_1662656211119567.pcap
     pcap/processes/host/zerotier-one_7882_137007714376.pcap
     pcap/processes/host/sshd_1196773_1662654999660718.pcap
     pcap/processes/fd95a035ce5
     pcap/processes/fd95a035ce5/ping_1261163_1663769383806467.pcap
     pcap/containers
     pcap/containers/host.pcap
     pcap/containers/b86533d11f3.pcap
     pcap/containers/fd95a035ce5.pcap

Read the documentation for more details and examples: Network capture

📩 New Events 🔔

• vfs_read and vfs_readv
• print_mem_dump
• HTTP request/response

🌪️ Binary filter improvements ⚙️

• Binary filter now detects processes that started before Tracee
• Binary filter now support specifying paths in specific mount namespace

Read the documentation for more details and examples: Event Filtering

✂️ Misc 🔟

• The missing arguments for an event now have a default value of nil, instead of being omitted from the event.
• Filtering for syscalls in events is now done through --trace event_name.context.syscall=syscall_name

🚨 Breaking changes 🔨

• detect-syscall flag is removed and is on by default
• The syscall that triggered each event is now included in its context. Events that previously had the syscall argument will no longer include it and their syscall should be accessed from the context instead.
• Thread start time is now since epoch
• --capture profile feature was removed from tracee and moved to a separate project https://github.com/aquasecurity/tracee-action
• default set of events changed to a less noisy, yet valuable set of evens. Also see the discussion for more details: Changing the default set of events #2611