-
Notifications
You must be signed in to change notification settings - Fork 400
Closed
Labels
enhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers
Description
system monitor provides tty information for any observed event.
KubeArmor/KubeArmor/BPF/system_monitor.c
Lines 1031 to 1040 in 3c18ec1
// check if tty is attached | |
struct signal_struct *signal; | |
signal = READ_KERN(task->signal); | |
if (signal != NULL){ | |
struct tty_struct *tty = READ_KERN(signal->tty); | |
if (tty != NULL){ | |
// a tty is attached | |
bpf_probe_read_str(&context->tty, TTY_LEN, (void *)tty->name); | |
} | |
} |
we need to have same information with the telemetry generated by BPF-LSM enforcer.
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers
Type
Projects
Status
Done