tetragon
tetragon copied to clipboard
Multiple selectors doesn't works
Hello Like in the title
Multiple selectors doesn't works for __x64_sys_write call
example:
- call: "__x64_sys_write"
syscall: true
args:
- index: 0
type: "fd"
- index: 1
type: "char_buf"
sizeArgIndex: 3
- index: 2
type: "size_t"
selectors:
- matchArgs:
- index: 0
operator: "Prefix"
values:
- "/etc/"
matchActions:
- action: Post
- matchArgs:
- index: 0
operator: "Prefix"
values:
- "/var/"
matchActions:
- action: Sigkill
As i understood - it should kill all writes to /var and post all writes to /etc
I have reproduced this and it is indeed an issue. Only the first matchArgs
seems to work.