Add LSM TracingPolicy examples

Adding examples of lsm tracing policies to monitor file access and process execution. Signed-off-by: Andrei Fedotov <[email protected]>
cilium · Jul 15, 2024 · 7aaa765 · 7aaa765
1 parent a799857
commit 7aaa765
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 0 deletions.
diff --git a/examples/tracingpolicy/lsm_brm_check.yaml b/examples/tracingpolicy/lsm_brm_check.yaml
@@ -0,0 +1,25 @@
+
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "lsm"
+spec:
+  lsmhooks:
+  - hook: "bprm_check_security"
+    args:
+      - index: 0
+        type: "linux_binprm"
+    selectors:
+    - matchBinaries:
+      - operator: "In"
+        values:
+        - "/usr/bin/zsh"
+        - "/usr/bin/bash"
+      matchArgs:
+        - index: 0
+          operator: "Postfix"
+          values:
+            - "contrib/tester-progs/nop"
+      matchActions:
+      - action: Override
+        argError: -1
diff --git a/examples/tracingpolicy/lsm_file_open.yaml b/examples/tracingpolicy/lsm_file_open.yaml
@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "lsm-file-open"
+spec:
+  lsmhooks:
+  - hook: "file_open"
+    args:
+      - index: 0
+        type: "file"
+    selectors:
+    - matchBinaries:
+      - operator: "In"
+        values:
+        - "/usr/bin/cat"
+      matchArgs:
+      - index: 0
+        operator: "Equal"
+        values:
+        - "/etc/passwd"
+        - "/etc/shadow"