-
Notifications
You must be signed in to change notification settings - Fork 412
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
WIP: getting started writing additional policy examples #3435
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
apiVersion: aquasecurity.github.io/v1beta1 | ||
kind: TraceePolicy | ||
metadata: | ||
name: bpf-attach | ||
annotations: | ||
# https://aquasecurity.github.io/tracee/v0.17/docs/events/builtin/extra/bpf_attach/ | ||
description: traces whether a BPF program was attached to a probe in the system | ||
spec: | ||
scope: | ||
- global | ||
rules: | ||
- event: bpf_attach |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
apiVersion: aquasecurity.github.io/v1beta1 | ||
kind: TraceePolicy | ||
metadata: | ||
name: write | ||
annotations: | ||
# https://aquasecurity.github.io/tracee/latest/docs/events/builtin/syscalls/write/ | ||
description: traces write events across all scopes | ||
spec: | ||
scope: | ||
- global | ||
rules: | ||
- event: write | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This event on its own doesn't cover all file writes. There are some other syscalls which may trigger a file write (e.g. writev) so it needs to be clarified in the description or update the policy with all syscalls that may trigger a file write There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. aha, thank you for clarifying -- will update it |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The apiVersion and kind will soon be changed (@josedonizetti ) so if this will be merged after, don't forget to update it as well