Skip to content

Commit

Permalink
Add LSM TracingPolicy examples
Browse files Browse the repository at this point in the history
Adding examples of lsm tracing policies to monitor file access and
process execution.

Signed-off-by: Andrei Fedotov <anfedotoff@yandex-team.ru>
  • Loading branch information
anfedotoff authored and kkourt committed Jul 19, 2024
1 parent fe8da46 commit 183af31
Show file tree
Hide file tree
Showing 2 changed files with 46 additions and 0 deletions.
25 changes: 25 additions & 0 deletions examples/tracingpolicy/lsm_brm_check.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: "lsm"
spec:
lsmhooks:
- hook: "bprm_check_security"
args:
- index: 0
type: "linux_binprm"
selectors:
- matchBinaries:
- operator: "In"
values:
- "/usr/bin/zsh"
- "/usr/bin/bash"
matchArgs:
- index: 0
operator: "Postfix"
values:
- "contrib/tester-progs/nop"
matchActions:
- action: Override
argError: -1
21 changes: 21 additions & 0 deletions examples/tracingpolicy/lsm_file_open.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: "lsm-file-open"
spec:
lsmhooks:
- hook: "file_open"
args:
- index: 0
type: "file"
selectors:
- matchBinaries:
- operator: "In"
values:
- "/usr/bin/cat"
matchArgs:
- index: 0
operator: "Equal"
values:
- "/etc/passwd"
- "/etc/shadow"

0 comments on commit 183af31

Please sign in to comment.