tetragon: Add security override example

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Oct 18, 2023 · fc517aa · fc517aa
1 parent dcfe76c
commit fc517aa
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/examples/tracingpolicy/override-security.yaml b/examples/tracingpolicy/override-security.yaml
@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "syswritefollowfdpsswd"
+spec:
+  kprobes:
+  - call: "security_inode_mkdir"
+    syscall: false
+    selectors:
+    - matchBinaries:
+      - operator: "In"
+        values:
+        - "/usr/bin/bash"
+    - matchActions:
+      - action: Override
+        argError: -1