tetragon: Add example killer policy

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Jul 11, 2023 · 21daede · 21daede
1 parent 8f5e782
commit 21daede
Showing 1 changed file with 29 additions and 0 deletions.
diff --git a/examples/tracingpolicy/killer.yaml b/examples/tracingpolicy/killer.yaml
@@ -0,0 +1,29 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "kill-syscalls"
+spec:
+  killers:
+  - syscalls:
+    - "sys_dup"
+  tracepoints:
+  - subsystem: "raw_syscalls"
+    event: "sys_enter"
+    args:
+    - index: 4
+      type: "uint64"
+    selectors:
+    - matchArgs:
+      - index: 0
+        operator: "InRefMap"
+        values:
+        - "ref:killer"
+      matchPIDs:
+      - operator: In
+        followForks: true
+        values:
+        - 137562
+      matchActions:
+      - action: "NotifyKiller"
+        argError: -1
+        argSig: 9