tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "syswritefollowfdpsswd"
5
spec:
6
  kprobes:
7
  - call: "fd_install"
8
    syscall: false
9
    args:
10
    - index: 0
11
      type: int
12
    - index: 1
13
      type: "file"
14
    selectors:
15
    - matchArgs:
16
      - index: 1
17
        operator: "Equal"
18
        values:
19
        - "/tmp/passwd"
20
      matchActions:
21
      - action: FollowFD
22
        argFd: 0
23
        argName: 1
24
  - call: "do_dup2"
25
    syscall: false
26
    args:
27
    - index: 0
28
      type: int
29
    - index: 1
30
      type: "file"
31
    - index: 2
32
      type: int
33
    selectors:
34
    - matchArgs:
35
      - index: 1
36
        operator: "Equal"
37
        values:
38
        - "/tmp/passwd"
39
      matchActions:
40
      - action: FollowFD
41
        argFd: 2
42
        argName: 1
43
  - call: "sys_close"
44
    syscall: true
45
    args:
46
    - index: 0
47
      type: "int"
48
    selectors:
49
    - matchActions:
50
      - action: UnfollowFD
51
        argFd: 0
52
        argName: 0
53
  - call: "sys_write"
54
    syscall: true
55
    args:
56
    - index: 0
57
      type: "fd"
58
    - index: 1
59
      type: "char_buf"
60
      sizeArgIndex: 3
61
    - index: 2
62
      type: "size_t"
63
    selectors:
64
    - matchPIDs:
65
      - operator: NotIn
66
        values:
67
        - 0
68
        - 1
69
      matchArgs:
70
      - index: 0
71
        operator: "Equal"
72
        values:
73
        - "/tmp/passwd"
74
      matchActions:
75
      - action: Sigkill
76