Communication mechanism between tracee-ebpf and trace-rules

[leiqi96]

tracee-ebpf and tracee-rules are 2 processes that communicate over a pipe. Where should I start learning this code

[itaysk]

This would be in the entrypoint script. https://github.com/aquasecurity/tracee/blob/main/entrypoint.sh

[leiqi96]

Is the Linux pipe FIFO? which code show that.

[itaysk]

Currently it's not a "Linux FIFO" but a simple shell pipe ("|") (but there's an open PR to make it a FIFO).
You can see the code in the previous answer.