tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "syscalls"
5
spec:
6
  kprobes:
7
  # int mount(const char *source, const char *target, const char *filesystemtype, unsigned long mountflags, const void *data);
8
  - call: "sys_mount"
9
    syscall: true
10
    args:
11
    - index: 0
12
      type:  "string"
13
    - index: 1
14
      type:  "string"
15