tetragon: Add example killer policy

Adding example killer policy that setups sys_enter raw syscalls and add filter for sys_dup and sys_dup2 syscalls plus match for /usr/bin/bash binary and kill it through killer. Signed-off-by: Jiri Olsa <[email protected]>
cilium · Sep 5, 2023 · 01efcd6 · 01efcd6
1 parent 4db97fa
commit 01efcd6
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/examples/tracingpolicy/killer.yaml b/examples/tracingpolicy/killer.yaml
@@ -0,0 +1,34 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "kill-syscalls"
+spec:
+  lists:
+  - name: "dups"
+    type: "syscalls"
+    values:
+    - "sys_dup"
+    - "sys_dup2"
+  killers:
+  - syscalls:
+    - "list:dups"
+  tracepoints:
+  - subsystem: "raw_syscalls"
+    event: "sys_enter"
+    args:
+    - index: 4
+      type: "uint64"
+    selectors:
+    - matchArgs:
+      - index: 0
+        operator: "InMap"
+        values:
+        - "list:dups"
+      matchBinaries:
+      - operator: "In"
+        values:
+        - "/usr/bin/bash"
+      matchActions:
+      - action: "NotifyKiller"
+        argError: -1
+        argSig: 9