tetragon: Add example killer policy

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
cilium · Aug 22, 2023 · 69718d7 · 69718d7
1 parent da4600b
commit 69718d7
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/examples/tracingpolicy/killer.yaml b/examples/tracingpolicy/killer.yaml
@@ -0,0 +1,34 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "kill-syscalls"
+spec:
+  lists:
+  - name: "dups"
+    type: "syscalls"
+    values:
+    - "sys_dup"
+    - "sys_dup2"
+  killers:
+  - syscalls:
+    - "list:dups"
+  tracepoints:
+  - subsystem: "raw_syscalls"
+    event: "sys_enter"
+    args:
+    - index: 4
+      type: "uint64"
+    selectors:
+    - matchArgs:
+      - index: 0
+        operator: "InMap"
+        values:
+        - "list:dups"
+      matchBinaries:
+      - operator: "In"
+        values:
+        - "/usr/bin/bash"
+      matchActions:
+      - action: "NotifyKiller"
+        argError: -1
+        argSig: 9