feat: add tetragon process blog

[paularah]

No description provided.

[netlify]

👷 Deploy Preview for cilium processing.

Name	Link
🔨 Latest commit	8ca691d
🔍 Latest deploy log	https://app.netlify.com/projects/cilium/deploys/690a0c5e9be5c20008bb5026

[netlify]

✅ Deploy Preview for cilium ready!

Name	Link
🔨 Latest commit	b76c131
🔍 Latest deploy log	https://app.netlify.com/projects/cilium/deploys/6926ce1d0fd3c50008af2fde
😎 Deploy Preview	https://deploy-preview-814--cilium.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[mtardy]

Looks good overall, your policy might not work, two comments:

[mtardy]

Some important comments here:

1. At fd_install stage in the kernel, symlinks have been resolved, so self will be resolved in the /proc/self/exe to /proc/<actualPID>/exe and not appear as self for fd_install, but even if you can guess the PID, the exe thing itself is a symlink to the actual path so you can't really match on a symlink using fd_install, the realpath that you will see in fd_install is the actual path of the binary.
2. If the policy worked, since this is path reference here, at fd_install stage, while symbolic link or relative path should be resolved, hard link for example will not be detected. This is a caveat tied to path integrity monitoring.

All that to say that your policy can't work with fd_install as the hook point here unfortunately. It has the benefit of having symlink resolved on one side so that /path/to/file is always /path/to/file even if you use /path/to../to/file but this benefits makes it non practicable to match on a symlink itself.

[paularah]

Thanks. I rewrote this. reproduced and tested it too.

spec:
  kprobes:
    - call: '__x64_sys_openat'
      syscall: true
      args:
        - index: 1
          type: string
        - index: 2
          type: int
      selectors:
        - matchArgs:
            - index: 1
              operator: Equal
              values:
                - '/proc/self/exe'
            #Require write access (flags & 3 != 0 → not O_RDONLY)
            - index: 2
              operator: Mask
              values:
                - '3'
          #Only suspicious when NOT in the host PID namespace
          matchNamespaces:
            - namespace: Pid
              operator: NotIn
              values:
                - 'host_ns'
          matchActions:
            - action: Sigkill

[mtardy]

This thing hasn't landed yet even on master cilium/tetragon#4254, is this okay for you?

[paularah]

rewrote this is using child process visibility

spec:
  kprobes:
    - call: 'sys_execve'
      syscall: true
      args:
        - index: 0
          type: 'string'
      selectors:
        - matchBinaries:
            - operator: 'In'
              values:
                - '/usr/sbin/nginx'
                - '/usr/bin/node'
                - '/usr/local/bin/python'
              followChildren: true
          matchArgs:
            - index: 0
              operator: 'Equal'
              values:
                - '/bin/bash'
                - '/bin/sh'
          matchActions:
            - action: Post

[xmulligan]

I'm not sure why the nutanix commits are in there

[paularah]

I'm not sure why the nutanix commits are in there

Might've messed up the commit tree. I can push a fix here in this PR or open a seperate PR after we've merged the blog.

[xmulligan]

Can you fix it here in this PR? It's getting difficult to review

[xmulligan]

@mtardy can you do one last check before we publish?