Tracee v0.14.0 Released!

[yanivagman]

🚨 Breaking changes 🔨

• Tracee no longer supports non-CORE environments. We made this decision since all major Linux distributions now come with kernel BTF already built in, and for those who don't, we have BTFHub that provides the missing BTFs, so CO-RE bpf simply works.
• Tracee CLI has been migrated to cobra/viper. With this there are a few minor changes to the CLI flags as described here: tracee one binary cli migration to cobra/viper #3000
• For more information on upcoming breaking changes, please read Tracee Roadmap update March 23 Tracee Roadmap update March 23 #2890.

🚀 What's new? 🚀

📩 Configuration from file 🔔

You can now configure Tracee through a configuration file instead of CLI flags. We've introduced the --config flag that takes a path to a json or yaml. CLI flags will still override the configuration file. For more information and example configuration files the documentation page https://aquasecurity.github.io/tracee/v0.14/docs/config/overview/.

🛡️ Reduce Tracee's attack surface 💪

We've reduced Tracee's attack surface by dropping all execution capabilities by default. We've also implemented execution rings with higher or lower privileges (capabilities), depending on the events being traced. This means that Tracee is running with very few, if any, capabilities as an effective process capability. This helps to protect against potential attacks.

🔨 Fixes 👷

• Fixed a bug that prevented Docker containers starting in GitHub runner jobs from being recognized (fix: detect container id from cgroup in GitHub Action fix: detect container id from cgroup in GitHub Action #3021).
• Fixed some network capture issues related to ingress packets when new connections occur. Before these fixes, initial TCP packets could be lost due to sockets not being fully traced. Thanks to @rohitburke for reporting the issue at network: events might be lost in already listening sockets #2739.
• Fixed an issue where remaining events in the pipeline were not consumed on Tracee exit consume remaining events after ctx is done #2969.

We hope these changes will make using Tracee even easier and more effective. If you have any questions or feedback, please don't hesitate to let us know!

[skandbug]

Running the Aarch64 version in a completely new Ubuntu (20.04 arm64), the following error occurs:

[rafaeldtinoco]

Yep, this is a known bug. We provide static binaries in the .tar.gz artifact because of that, but we still have to sort a few things out. Currently only tracee-ebpf-static works (for the static binaries). I believe you should use the docker image OR compile tracee with instructions from our docs (building tracee).

If you want to use the artifacts binaries, then I believe we're compiling our artifact binaries (for the .tar.gz) in an Ubuntu Jammy (likely has that GLIBC version).

[rafaeldtinoco]

BTW you can also compile packages for ubuntu if you would like.

$ git clone https://github.com/aquasecurity/tracee.git
$ make -f builder/Makefile.packaging ubuntu-bin-focal

And you shall find 3 .deb packages in the dist/ directory. You can install "tracee" package only to get the unified binary experience.

Only thing you need is docker installed in your host.

[skandbug]

Thanks

tracee can easily track a process (PID), but there will be the following scenarios.
If I want to use tracee to trace the execution of a series of commands, such as:
Command string 1: ls -sh
Command string 2: adb install 1.apk