tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "sys-linkat-passwd"
5
spec:
6
  kprobes:
7
  - call: "sys_linkat"
8
    syscall: true
9
    args:
10
    - index: 0
11
      type: "int"
12
    - index: 1
13
      type: "string"
14
    - index: 2
15
      type: "int"
16
    - index: 3
17
      type: "string"
18
    - index: 4
19
      type: "int"
20
    selectors:
21
    - matchArgs:
22
      - index: 1
23
        operator: "Equal"
24
        values:
25
        - "/etc/passwd"
26