tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "kill-syscalls"
5
spec:
6
  lists:
7
  - name: "dups"
8
    type: "syscalls"
9
    values:
10
    - "sys_dup"
11
    - "sys_dup2"
12
    - "__ia32_sys_dup"
13
  enforcers:
14
  - calls:
15
    - "list:dups"
16
  tracepoints:
17
  - subsystem: "raw_syscalls"
18
    event: "sys_enter"
19
    args:
20
    - index: 4
21
      type: "syscall64"
22
    selectors:
23
    - matchArgs:
24
      - index: 0
25
        operator: "InMap"
26
        values:
27
        - "list:dups"
28
      matchBinaries:
29
      - operator: "In"
30
        values:
31
        - "/usr/bin/bash"
32
      matchActions:
33
      - action: "NotifyEnforcer"
34
        argError: -1
35
        argSig: 9
36