Revert "types: add context flags with container flag to event (#2007)"

This reverts commit 2339d3e.

Author: rafaeldtinoco

types/trace/trace.go

@@ -12,59 +12,50 @@ import (
 
 // Event is a single result of an ebpf event process. It is used as a payload later delivered to tracee-rules.
 type Event struct {
-	Timestamp           int          `json:"timestamp"`
-	ThreadStartTime     int          `json:"threadStartTime"`
-	ProcessorID         int          `json:"processorId"`
-	ProcessID           int          `json:"processId"`
-	CgroupID            uint         `json:"cgroupId"`
-	ThreadID            int          `json:"threadId"`
-	ParentProcessID     int          `json:"parentProcessId"`
-	HostProcessID       int          `json:"hostProcessId"`
-	HostThreadID        int          `json:"hostThreadId"`
-	HostParentProcessID int          `json:"hostParentProcessId"`
-	UserID              int          `json:"userId"`
-	MountNS             int          `json:"mountNamespace"`
-	PIDNS               int          `json:"pidNamespace"`
-	ProcessName         string       `json:"processName"`
-	HostName            string       `json:"hostName"`
-	ContainerID         string       `json:"containerId"`
-	ContainerImage      string       `json:"containerImage"`
-	ContainerName       string       `json:"containerName"`
-	PodName             string       `json:"podName"`
-	PodNamespace        string       `json:"podNamespace"`
-	PodUID              string       `json:"podUID"`
-	EventID             int          `json:"eventId,string"`
-	EventName           string       `json:"eventName"`
-	ArgsNum             int          `json:"argsNum"`
-	ReturnValue         int          `json:"returnValue"`
-	StackAddresses      []uint64     `json:"stackAddresses"`
-	ContextFlags        ContextFlags `json:"contextFlags"`
-	Args                []Argument   `json:"args"` //Arguments are ordered according their appearance in the original event
-}
-
-// ContextFlags are flags representing event context
-type ContextFlags struct {
-	ContainerStarted bool `json:"containerStarted"`
+	Timestamp           int        `json:"timestamp"`
+	ThreadStartTime     int        `json:"threadStartTime"`
+	ProcessorID         int        `json:"processorId"`
+	ProcessID           int        `json:"processId"`
+	CgroupID            uint       `json:"cgroupId"`
+	ThreadID            int        `json:"threadId"`
+	ParentProcessID     int        `json:"parentProcessId"`
+	HostProcessID       int        `json:"hostProcessId"`
+	HostThreadID        int        `json:"hostThreadId"`
+	HostParentProcessID int        `json:"hostParentProcessId"`
+	UserID              int        `json:"userId"`
+	MountNS             int        `json:"mountNamespace"`
+	PIDNS               int        `json:"pidNamespace"`
+	ProcessName         string     `json:"processName"`
+	HostName            string     `json:"hostName"`
+	ContainerID         string     `json:"containerId"`
+	ContainerImage      string     `json:"containerImage"`
+	ContainerName       string     `json:"containerName"`
+	PodName             string     `json:"podName"`
+	PodNamespace        string     `json:"podNamespace"`
+	PodUID              string     `json:"podUID"`
+	EventID             int        `json:"eventId,string"`
+	EventName           string     `json:"eventName"`
+	ArgsNum             int        `json:"argsNum"`
+	ReturnValue         int        `json:"returnValue"`
+	StackAddresses      []uint64   `json:"stackAddresses"`
+	Args                []Argument `json:"args"` //Arguments are ordered according their appearance in the original event
 }
 
 // EventOrigin is where a trace.Event occured, it can either be from the host machine or from a container
 type EventOrigin string
 
 const (
-	ContainerOrigin     EventOrigin = "container"      // Events originated from within a container, starting with the entry-point execution
-	HostOrigin          EventOrigin = "host"           // Events originated from the host
-	ContainerInitOrigin EventOrigin = "container-init" // Events originated from within container, before entry-point execution
+	ContainerOrigin EventOrigin = "container"
+	HostOrigin      EventOrigin = "host"
 )
 
-// Origin derive the EventOrigin of a trace.Event
+// Derive the EventOrigin of a trace.Event
 func (e Event) Origin() EventOrigin {
-	if e.ContextFlags.ContainerStarted {
+	if e.ContainerID != "" || e.ProcessID != e.HostProcessID {
 		return ContainerOrigin
+	} else {
+		return HostOrigin
 	}
-	if e.ContainerID != "" {
-		return ContainerInitOrigin
-	}
-	return HostOrigin
 }
 
 const (

types/trace/trace_test.go

@@ -135,18 +135,15 @@ func TestEvent_Origin(t *testing.T) {
 				EventName:     "execve",
 				HostProcessID: 321,
 				ProcessID:     123,
-				ContainerID:   "ab123",
-				ContextFlags:  ContextFlags{ContainerStarted: true},
 			},
 			expected: ContainerOrigin,
 		},
 		{
 			event: Event{
-				EventName:    "runc",
-				ContainerID:  "ab123",
-				ContextFlags: ContextFlags{ContainerStarted: false},
+				EventName:   "execve",
+				ContainerID: "ab123",
 			},
-			expected: ContainerInitOrigin,
+			expected: ContainerOrigin,
 		},
 	}
 
@@ -168,7 +165,6 @@ func TestEvent_ToProtocol(t *testing.T) {
 				EventName:     "execve",
 				HostProcessID: 123,
 				ProcessID:     123,
-				ContextFlags:  ContextFlags{ContainerStarted: false},
 			},
 			expected: protocol.Event{
 				Headers: protocol.EventHeaders{
@@ -182,7 +178,6 @@ func TestEvent_ToProtocol(t *testing.T) {
 					EventName:     "execve",
 					HostProcessID: 123,
 					ProcessID:     123,
-					ContextFlags:  ContextFlags{ContainerStarted: false},
 				},
 			},
 		},
@@ -191,7 +186,6 @@ func TestEvent_ToProtocol(t *testing.T) {
 				EventName:     "execve",
 				HostProcessID: 123,
 				ProcessID:     321,
-				ContextFlags:  ContextFlags{ContainerStarted: true},
 			},
 			expected: protocol.Event{
 				Headers: protocol.EventHeaders{
@@ -205,28 +199,25 @@ func TestEvent_ToProtocol(t *testing.T) {
 					EventName:     "execve",
 					HostProcessID: 123,
 					ProcessID:     321,
-					ContextFlags:  ContextFlags{ContainerStarted: true},
 				},
 			},
 		},
 		{
 			payload: Event{
-				EventName:    "open",
-				ContainerID:  "abc123",
-				ContextFlags: ContextFlags{ContainerStarted: false},
+				EventName:   "open",
+				ContainerID: "abc123",
 			},
 			expected: protocol.Event{
 				Headers: protocol.EventHeaders{
 					Selector: protocol.Selector{
-						Origin: string(ContainerInitOrigin),
+						Origin: string(ContainerOrigin),
 						Source: "tracee",
 						Name:   "open",
 					},
 				},
 				Payload: Event{
-					EventName:    "open",
-					ContainerID:  "abc123",
-					ContextFlags: ContextFlags{ContainerStarted: false},
+					EventName:   "open",
+					ContainerID: "abc123",
 				},
 			},
 		},