tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "syscalls"
5
spec:
6
  kprobes:
7
  # long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);
8
  - call: "sys_ptrace"
9
    syscall: true
10
    args:
11
     - index: 2
12
       type: "int"
13