tetragon
                                
                                 tetragon copied to clipboard
                                
                                    tetragon copied to clipboard
                            
                            
                            
                        Multiple selectors doesn't works
Hello Like in the title
Multiple selectors doesn't works for __x64_sys_write call
example:
  - call: "__x64_sys_write"
    syscall: true
    args:
    - index: 0
      type: "fd"
    - index: 1
      type: "char_buf"
      sizeArgIndex: 3
    - index: 2
      type: "size_t"
    selectors:
      - matchArgs:
        - index: 0
          operator: "Prefix"
          values:
          - "/etc/"
        matchActions:
        - action: Post
      - matchArgs:
        - index: 0
          operator: "Prefix"
          values:
          - "/var/"
        matchActions:
        - action: Sigkill
As i understood - it should kill all writes to /var and post all writes to /etc
I have reproduced this and it is indeed an issue. Only the first matchArgs seems to work.