From 48a23121dff03e44ba074fe42181fa1b85ce2967 Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Mon, 10 Jan 2022 09:30:17 +0100 Subject: [PATCH] new(userspace/falco): add support for kernel side simple consumer. Signed-off-by: Federico Di Pierro --- userspace/falco/falco.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index 8f81065a..690fa977 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -1206,6 +1206,11 @@ int falco_init(int argc, char **argv) if(!all_events) { + // Drop EF_DROP_SIMPLE_CONS kernel side + inspector->set_simple_consumer(); + // Eventually, drop any EF_DROP_SIMPLE_CONS event + // that reached userspace (there are some events that are not syscall-based + // like signaldeliver, that have the EF_DROP_SIMPLE_CONS flag) inspector->set_drop_event_flags(EF_DROP_SIMPLE_CONS); }