Skip to content

Conversation

@ekoops
Copy link
Contributor

@ekoops ekoops commented Sep 30, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

Neither EF_OLD_VERSION can be used to always imply EF_TMP_CONVERTER_MANAGED, nor EF_TMP_CONVERTER_MANAGED can be used to always imply EF_OLD_VERSION.
Indeed:

  • some enter events are just old event that must be dropped and they are not marked as EF_TMP_CONVERTER_MANAGED (e.g.: PPME_SYSCALL_VFORK_E)
  • some enter events must be converted to their new versions leveraging the scap converter, but are not old versions of anything, so they are not marked as EF_OLD_VERSION (e.g.: PPME_SYSCALL_OPEN_E).

For this reason, this PR stabilizes EF_TMP_CONVERTER_MANAGED as EF_CONVERTER_MANAGED.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.

/milestone 0.22.0

Does this PR introduce a user-facing change?:

feat!: stabilize `EF_TMP_CONVERTER_MANAGED` as `EF_CONVERTER_MANAGED`

Neither `EF_OLD_VERSION` can be used to always imply
`EF_TMP_CONVERTER_MANAGED`, nor `EF_TMP_CONVERTER_MANAGED` can be used
to always imply `EF_OLD_VERSION`. Indeed:
- some enter events are just old event that must be dropped and they
  are not marked as `EF_TMP_CONVERTER_MANAGED` (e.g.:
`PPME_SYSCALL_VFORK_E`)
- some enter events must be converted to their new versions leveraging
  the scap converter, but are not old versions of anything, so they
  are not marked as `EF_OLD_VERSION` (e.g.: `PPME_SYSCALL_OPEN_E`).

For this reason, stabilize `EF_TMP_CONVERTER_MANAGED` as
`EF_CONVERTER_MANAGED`.

BREAKING CHANGE: change `EF_TMP_CONVERTER_MANAGED` flag name

Signed-off-by: Leonardo Di Giovanna <[email protected]>
@github-actions
Copy link

github-actions bot commented Sep 30, 2025

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

@codecov
Copy link

codecov bot commented Sep 30, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.18%. Comparing base (00a87de) to head (026a6d9).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2659   +/-   ##
=======================================
  Coverage   78.18%   78.18%           
=======================================
  Files         292      292           
  Lines       31781    31781           
  Branches     4656     4656           
=======================================
  Hits        24848    24848           
  Misses       6933     6933           
Flag Coverage Δ
libsinsp 78.18% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions
Copy link

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@leogr
Copy link
Member

leogr commented Sep 30, 2025

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

👇

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.

👇

/remove-hold

Copy link
Member

@deepskyblue86 deepskyblue86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Sep 30, 2025
@poiana
Copy link
Contributor

poiana commented Sep 30, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepskyblue86, ekoops

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [deepskyblue86,ekoops]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit f000fd3 into master Sep 30, 2025
69 of 72 checks passed
@poiana poiana deleted the ekoops/tmp-converter-managed branch September 30, 2025 19:35
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Sep 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

5 participants