Using SlimCred struct in a golang signature

[michaelkatch]

Hey,

I'm writing a signature based on "commit_creds" event.
While writing it I encountered a problem. Using "oldData, err := helpers.GetTraceeArgumentByName(eventObj, "old_cred")" returns the following struct :
type Argument struct { ArgMeta Value interface{} json:"value" }
Trying to convert "oldData.Value" to type "SlimCred struct" with the following
oldDataConv := oldData.Value.(map[string]interface{}) yields the following error :
"panic: interface conversion: interface {} is external.SlimCred, not map[string]interface {}"
I tried oldDataConv := oldData.Value.(map[string]interface{}) as well

I'm executing tracee with the command :
../../tracee-ebpf/dist/tracee-ebpf -o format:gob -o option:detect-syscall -c exec -t event=commit_creds, | ./tracee-rules --input-tracee file:stdin --input-tracee format:gob --output-template=../templates/rawjson.tmpl

I appreciate the help,
Thanks

[itaysk]

since you are using gob serialization, did you try to cast the argument value to external.slimCred

tracee/tracee-ebpf/tracee/external/external.go

Line 101 in 422e86e

type SlimCred struct {

?

[michaelkatch]

It works using gob as input!
For json input I'll use json unmarshal to convert it to "commit_creds_slim" struct.
Thank you