tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "sys-symlink-passwd"
5
spec:
6
  kprobes:
7
  - call: "sys_symlinkat"
8
    syscall: true
9
    args:
10
    - index: 0
11
      type: "string"
12
    - index: 1
13
      type: "int"
14
    - index: 2
15
      type: "string"
16
    selectors:
17
    - matchArgs:
18
      - index: 0
19
        operator: "Equal"
20
        values:
21
        - "/etc/passwd"
22
      matchActions:
23
      - action: Override
24
        argError: -1
25