fix(sinsp): plugin capture listen capability exception

Signed-off-by: Gianmatteo Palmieri <mail@gian.im> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
falcosecurity · Sep 10, 2024 · 6cc1a12 · 6cc1a12
1 parent dd16507
commit 6cc1a12
Showing 1 changed file with 12 additions and 3 deletions.
diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp
@@ -403,7 +403,10 @@ void sinsp::open_common(scap_open_args* oargs, const scap_vtable* vtable, scap_p
 	// notify registered plugins of capture open
 	for (auto& p : m_plugin_manager->plugins())
 	{
-		p->capture_open();
+		if (p->caps() & CAP_CAPTURE_LISTENING)
+		{
+			p->capture_open();
+		}
 	}
 }
 
@@ -805,9 +808,15 @@ void sinsp::close()
 	}
 
 	// notify registered plugins of capture close
-	for (auto& p : m_plugin_manager->plugins())
+	if (m_mode != SINSP_MODE_NONE)
 	{
-		p->capture_close();
+		for (auto& p : m_plugin_manager->plugins())
+		{
+			if (p->caps() & CAP_CAPTURE_LISTENING)
+			{
+				p->capture_close();
+			}
+		}
 	}
 
 	// purge pending routines and wait for the running ones