Skip to content

Instantly share code, notes, and snippets.

@henrysachs
Created July 10, 2022 09:21
Show Gist options
  • Save henrysachs/1975a8fe862216b4301698c8c3135e85 to your computer and use it in GitHub Desktop.
Save henrysachs/1975a8fe862216b4301698c8c3135e85 to your computer and use it in GitHub Desktop.
tetragon sigkill file open
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: "sys-read-follow-prefix"
spec:
kprobes:
- call: "fd_install"
syscall: false
return: false
args:
- index: 0
type: int
- index: 1
type: "file"
selectors:
- matchPIDs:
- operator: NotIn
followForks: true
isNamespacePID: true
values:
- 1
matchArgs:
- index: 1
operator: "Prefix"
values:
- "/etc/"
matchActions:
- action: FollowFD
argFd: 0
argName: 1
- call: "__x64_sys_close"
syscall: true
args:
- index: 0
type: "int"
selectors:
- matchActions:
- action: UnfollowFD
argFd: 0
argName: 0
- call: "__x64_sys_read"
syscall: true
args:
- index: 0
type: "fd"
- index: 1
type: "char_buf"
returnCopy: true
- index: 2
type: "size_t"
- call: "__x64_sys_write"
syscall: true
args:
- index: 0
type: "fd"
- index: 1
type: "char_buf"
sizeArgIndex: 3
- index: 2
type: "size_t"
selectors:
- matchActions:
- action: Sigkill
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment