tetragon: add example tracingpolicy for security_bprm_check

Signed-off-by: David Windsor <dawindso@cisco.com>
cilium · Feb 15, 2024 · 17eb9ff · 17eb9ff
1 parent aa97782
commit 17eb9ff
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/examples/tracingpolicy/security_bprm_check.yaml b/examples/tracingpolicy/security_bprm_check.yaml
@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "sample-no-exec-id"
+spec:
+  kprobes:
+  - call: "security_bprm_check"
+    syscall: false
+    args:
+    - index: 0
+      type: "linux_binprm"
+    returnArg:
+      index: 0
+      type: "int"
+    selectors:
+      - matchArgs:
+          - index: 0
+            operator: "Equal"
+            values:
+              - "/usr/bin/sample-exec"