Tracee Configuration API

[itaysk]

In order to allow configuration of tracee-ebpf during runtime, for example to change filters, an API definition is required to communicate to tracee-ebpf.
This API can then be implemented through gRPC, HTTP or any other integration method deemed appropriate.

work breakdown from #636 (comment):

• Load/unload a bpf program in runtime
• Attach/detach an event to a bpf program in runtime
• (depends on 1+2) - enable/disable events in runtime
• Update filters in runtime (Tracee-eBPF Filter configuration API #1726 )
• Update capture options in runtime

[yanivagman]

Having a unix socket may be a better fit for this use case

[grantseltzer]

What is the use case for this where tracee couldn't just restart? Could we start a new instance of tracee-ebpf and then close the old one?

[itaysk]

+ @eidans

[itaysk]

https://github.com/developer-guy/falco-hot-reload-with-sidecar

[itaysk]

related discussions:
#405
#454

[rafaeldtinoco]

One thing that will allow this to happen is the discussion being made at:

aquasecurity/libbpfgo#78 (comment)

which will allow links to be detached/destroyed and re-attached/created again.

[yanivagman]

This issue is too big. I think we should split it to the following issues:

1. Load/unload a bpf program in runtime
2. Attach/detach an event to a bpf program in runtime
3. (depends on 1+2) - enable/disable events in runtime
4. Update filters in runtime
5. Update capture options in runtime

[itaysk]

I get that the PR that will fix this issue is too big. but do you think the issue is too big as well? If we split it into multiple issues, are they meaningful on their own or only in the context of this feature request? for now I've created your breakdown suggestion as subtasks under this issue. If you/others prefer it as individual issues, go for it! (you can click the "covert to issue" button next to each task)

[mtcherni95]

I think we should achieve most of the requirements by for example adding a gRPC server within tracee-ebpf. We can define in a proto a grpc service like "Configuration" with many rpcs, each of them regarding a "domain" like update of filter, captures, events and so on.

[itaysk]

We should consider what's the widest common interface that tracee's users would like. I'm not sure that's GRPC

[yanivagman]

Updated the issue to include things from #1725, which is a dup

[yanivagman]

Closing in favor of #2991