tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "sample-no-exec-id"
5
spec:
6
  kprobes:
7
  - call: "security_bprm_check"
8
    syscall: false
9
    args:
10
    - index: 0
11
      type: "linux_binprm"
12
    returnArg:
13
      index: 0
14
      type: "int"
15
    selectors:
16
      - matchArgs:
17
          - index: 0
18
            operator: "Equal"
19
            values:
20
              - "/usr/bin/sample-exec"
21