tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "sys-clock-settime"
5
spec:
6
  kprobes:
7
  # __x64_sys_clock_settime(clockid_t which_clock, const struct kernel_timespec __user *tp)
8
  - call: "sys_clock_settime"
9
    syscall: true
10
    args:
11
    - index: 0
12
      type: int
13
    selectors:
14
    - matchPIDs:
15
      - operator: NotIn
16
        followForks: true
17
        isNamespacePID: true
18
        values:
19
        - 1
20
      - operator: NotIn
21
        followForks: true
22
        isNamespacePID: true
23
        values:
24
        - 0
25