Close_fd policy

 apiVersion: cilium.io/v1alpha1
 kind: TracingPolicy
 metadata:
   name: "capability-change"
 spec:
   kprobes:
   - call: "__close_fd"
     syscall: false
     args:
     - index: 0
       type: "nop"
     - index: 1
       type: "nop"
     selectors:
     - matchCapabilities:
       - type: Effective
         operator: In
         values:
         - "CAP_SYS_ADMIN"
       matchCapabilityChanges:
       - type: Effective
         operator: In
         values:
         - "CAP_SYS_ADMIN"
       matchActions:
       - action: Sigkill
         argError: 0