Prepare for v0.24.0

[geyslan]

Tracee v0.24.0 Release Notes

🎯 Major New Features

1. traceectl - New CLI Tool

• Brand new traceectl command-line tool for gRPC interaction with Tracee
• Commands: version, event (with enable/disable), stream, and metrics
• Supports JSON and table output formats
• Enables remote control and monitoring of Tracee instances

2. LSM (Linux Security Module) Support

• Added LSM probe support for future eBPF enforcement capabilities
• New lsm_support_check tool to verify LSM program support
• Enhanced system detection for LSM capabilities
• Lays groundwork for security policy enforcement

3. Extended Events Infrastructure

• New framework for extending Tracee with custom events
• Reserved API event ID ranges (1500-1999, 3000-3999) for extensions
• Support for custom event argument parsing
• Enables third-party event integrations

4. FIPS 140-3 Compliance

• Build-time FIPS compliance support via FIPS=1 make flag
• Uses Go 1.24's native FIPS support
• Important for regulated environments

⚠️ Breaking Changes

1. Unified Server Flag

Consolidated 6 separate server flags into single --server flag.

Old flags (removed):

• --metrics-endpoint
• --grpc-listen-addr
• --http-listen-addr
• --healthz-endpoint
• --pprof-endpoint
• --pyroscope

Migration:

# Before
tracee --metrics-endpoint --grpc-listen-addr=tcp:4466

# After
tracee --server metrics --server grpc-address=tcp:4466

2. Event Decoding Overhaul

• Hardtyped and streamlined event decoding system
• All pointers now use trace.Pointer type (64-bit invariant)
• More consistent event data field naming
• Better Go type conformance

3. Container Flag Rename

• Finalized --cri to --containers flag rename
• --no-containers deprecated in favor of --containers enrich=false

🚀 Performance Improvements

• Signature Processing: Replaced parallel engine with optimized sequential processing
• Event Derivation: Converted to pointer-based API, eliminated event copying
• Hash Buffer: Replaced shared buffer with sync.Pool to eliminate lock contention
• File Hash Cache: Increased from 1024 to 2048 entries
• Decoder Pool: Pre-allocated to avoid repeated allocations
• Policy Matching: Optimized with early exit conditions
• Pipeline Channels: Reduced default size from 10000 to 1000
• Multiple eBPF-level optimizations for buffer handling

🏗️ Build & Toolchain

Clang 19 Upgrade

• Upgraded from Clang 14 to Clang 19
• Updated Alpine images from 3.19 to 3.21
• Modernized build toolchain for better compatibility

Go 1.24 Support

• Updated to Go 1.24 across all modules
• Required for FIPS support

BTFHub Improvements

• Parallel BTF generation for faster builds
• Improved script structure and modularity

📊 New Events & Enhancements

• New Event: security_task_prctl - Monitor prctl system calls
• New Event: heartbeat - Health monitoring event for liveness checks
• New Field: Added pwd (current working directory) to sched_process_exec event
• Enhanced: sched_process_exec now caches prev_comm for accurate tracking

💪 ARM64 Support

• Fixed ARM64 compatibility issues across the board
• ARM64 CI testing mirrored for unit and integration tests
• Fixed sockaddr handling, open flags, and filter compatibility
• Production-ready ARM64 support

🧪 Testing & Quality

Code Coverage

• Codecov integration with comprehensive testing
• Package Coverage Improvements:
  • stringutil: 100%
  • digest: 94.8%
  • logger: 92.9%
  • sharedobjs: 89.2%
  • environment: 77.3%
  • And many more...

Testing Infrastructure

• E2E Framework: New core and extended E2E test infrastructure
• Integration Tests: Added LSM, container events, fallbacks, and compatibility tests
• Over 186 bug fixes and test improvements

📚 Documentation

• New event documentation system with comprehensive guides
• Added LSM, syscall tracepoint, and lifecycle event docs
• Development workflows and tools documentation
• Contributing guides reorganized and updated
• "Why Choose Tracee" section added
• Fixed outdated references throughout

🛠️ Developer Experience

• Shell Script Style Guide: Google Shell Style Guide conformance
• Enhanced Logging: Better timestamp control and print formatting
• Checkpatch System: Comprehensive PR validation
• Modular Scripts: Better organization of script libraries
• CI Optimizations: Conditional module testing reduces CI time
• Dependabot configuration for automated updates

🐛 Notable Bug Fixes

• Fixed deadlock in concurrent event sending
• Prevented send-on-closed-channel races in multiple places
• Fixed namespace PID assignment in process tree
• Sanitized invalid UTF-8 in gRPC protobuf conversion
• Fixed buffer bounds checking for Clang 15 compatibility
• Resolved data races in capabilities initialization
• Fixed container info preservation after enrichment
• Corrected event field mappings in protobuf conversion
• Flushed output buffers to prevent data loss

🏛️ Architecture & Refactoring

• Reorganized pkg/datastores/ for better structure
• Moved utilities from pkg to common module
• Removed signatures/helpers package (consolidated)
• Split controlplane initialization and constructor
• Enhanced extension points throughout the codebase
• Better event compatibility and fallback system

📦 Dependencies

• Updated libbpfgo to v0.9.0-libbpf-1.5.1
• Bumped libcap for better capability handling
• Updated Kubernetes and container runtime dependencies
• Security updates across the dependency tree

---

Full Changelog: v0.23.0...v0.24.0

This release represents a significant evolution of Tracee with major architectural improvements, new capabilities for extending and controlling Tracee, and substantial performance optimizations.