-
Notifications
You must be signed in to change notification settings - Fork 412
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: parse arguments only if chosen by flag #3960
base: main
Are you sure you want to change the base?
fix: parse arguments only if chosen by flag #3960
Conversation
Fix an the issue that cause the parse arguments to always run. It was probably caused to support signatures using parsed arguments. From now on it should be chosen directly in these cases.
@@ -320,9 +320,6 @@ func GetTraceeRunner(c *cobra.Command, version string) (cmd.Runner, error) { | |||
runner.Printer = p | |||
runner.InstallPath = traceeInstallPath | |||
|
|||
// parse arguments must be enabled if the rule engine is part of the pipeline | |||
runner.TraceeConfig.Output.ParseArguments = true |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It seems that kernel tests require it on: https://github.com/aquasecurity/tracee/actions/runs/8555281070/job/23442355573?pr=3960#step:7:74
Pretty sure this is by design until we convert all our signatures to non parsed args. I should have a branch with a commit doing that lying somewhere on my machine if we opt for that. |
Actually, even if we convert all our signatures, we would introduce another problem, that the instant some opts to use the flag they would break the (now converted) signatures. So basically it would reintroduce the test failures from the opposite end. |
The more reasonable option is to require the user to use the flag if he wants to use the signatures. The main problem right now with this is the fact that Tracee is made to use the unparsed arguments. In the end, it makes more sense to give the user the option to choose whether he wants parsed or unparsed arguments. |
@rscampos I don't know how much you have tackled the analyze mode until now, but this is linked to it. |
1. Explain what the PR does
Fix an the issue that cause the parse arguments to always run. It was probably caused to support signatures using parsed arguments. From now on it should be chosen directly in these cases.
2. Explain how to test it
3. Other comments