{ "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "metadata": { "type": "object" }, "spec": { "additionalProperties": false, "description": "Tracing policy specification.", "properties": { "containerSelector": { "additionalProperties": false, "description": "ContainerSelector selects containers that this policy applies to.\nA map of container fields will be constructed in the same way as a map of labels.\nThe name of the field represents the label \"key\", and the value of the field - label \"value\".\nCurrently, only the \"name\" field is supported.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "additionalProperties": false, "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "enum": [ "In", "NotIn", "Exists", "DoesNotExist" ], "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.", "maxLength": 63, "pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$", "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": [ "object", "null" ] } }, "type": [ "object", "null" ], "x-kubernetes-map-type": "atomic" }, "enforcers": { "description": "A enforcer spec.", "items": { "additionalProperties": false, "properties": { "calls": { "description": "Calls where enforcer is executed in", "items": { "type": "string" }, "type": "array" } }, "required": [ "calls" ], "type": "object" }, "type": [ "array", "null" ] }, "fentries": { "description": "A list of fentry specs.", "items": { "additionalProperties": false, "properties": { "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "call": { "description": "Name of the function to apply the kprobe spec to.", "type": "string" }, "data": { "description": "A list of data to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "ignore": { "additionalProperties": false, "description": "Conditions for ignoring this kprobe", "properties": { "callNotFound": { "description": "Ignores calls that are not present in the system", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "return": { "default": false, "description": "Indicates whether to collect return value of the traced function.", "type": [ "boolean", "null" ] }, "returnArg": { "additionalProperties": false, "description": "A return argument to include in the trace output.", "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": [ "object", "null" ] }, "returnArgAction": { "description": "An action to perform on the return value.\nUse returnArg to include the return value in the event output.\nSupported actions are: TrackSock;UntrackSock", "type": [ "string", "null" ] }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed and short-circuited.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "syscall": { "default": true, "description": "Indicates whether the traced function is a syscall.", "type": [ "boolean", "null" ] }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "call" ], "type": "object" }, "type": [ "array", "null" ] }, "hostSelector": { "additionalProperties": false, "description": "HostSelector selects hosts that this policy applies to.\nFor now only ~ (none) and {} (all) is supported.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "additionalProperties": false, "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "enum": [ "In", "NotIn", "Exists", "DoesNotExist" ], "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.", "maxLength": 63, "pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$", "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": [ "object", "null" ] } }, "type": [ "object", "null" ], "x-kubernetes-map-type": "atomic" }, "kprobes": { "description": "A list of kprobe specs.", "items": { "additionalProperties": false, "properties": { "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "call": { "description": "Name of the function to apply the kprobe spec to.", "type": "string" }, "data": { "description": "A list of data to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "ignore": { "additionalProperties": false, "description": "Conditions for ignoring this kprobe", "properties": { "callNotFound": { "description": "Ignores calls that are not present in the system", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "return": { "default": false, "description": "Indicates whether to collect return value of the traced function.", "type": [ "boolean", "null" ] }, "returnArg": { "additionalProperties": false, "description": "A return argument to include in the trace output.", "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": [ "object", "null" ] }, "returnArgAction": { "description": "An action to perform on the return value.\nUse returnArg to include the return value in the event output.\nSupported actions are: TrackSock;UntrackSock", "type": [ "string", "null" ] }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed and short-circuited.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "syscall": { "default": true, "description": "Indicates whether the traced function is a syscall.", "type": [ "boolean", "null" ] }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "call" ], "type": "object" }, "type": [ "array", "null" ] }, "lists": { "description": "A list of list specs.", "items": { "additionalProperties": false, "properties": { "name": { "description": "Name of the list", "type": "string" }, "pattern": { "description": "Pattern for 'generated' lists.", "type": [ "string", "null" ] }, "type": { "description": "Indicates the type of the list values.", "enum": [ "syscalls", "generated_syscalls", "generated_ftrace" ], "type": [ "string", "null" ] }, "validated": { "description": "List was validated", "type": [ "boolean", "null" ] }, "values": { "description": "Values of the list", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] }, "loader": { "description": "Enable loader events", "type": [ "boolean", "null" ] }, "lsmhooks": { "description": "A list of uprobe specs.", "items": { "additionalProperties": false, "properties": { "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "hook": { "description": "Name of the function to apply the kprobe spec to.", "type": "string" }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "hook" ], "type": "object" }, "type": [ "array", "null" ] }, "options": { "description": "A list of overloaded options", "items": { "additionalProperties": false, "properties": { "name": { "description": "Name of the option", "type": "string" }, "value": { "description": "Value of the option", "type": [ "string", "null" ] } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] }, "podSelector": { "additionalProperties": false, "description": "PodSelector selects pods that this policy applies to", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "additionalProperties": false, "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "enum": [ "In", "NotIn", "Exists", "DoesNotExist" ], "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.", "maxLength": 63, "pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$", "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": [ "object", "null" ] } }, "type": [ "object", "null" ], "x-kubernetes-map-type": "atomic" }, "selectorsMacros": { "additionalProperties": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "description": "SelectorsMacros is used to define selectors macros, which can be used\nin probes/hooks selectors by their names.", "type": [ "object", "null" ] }, "tracepoints": { "description": "A list of tracepoint specs.", "items": { "additionalProperties": false, "properties": { "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "event": { "description": "Tracepoint event", "type": "string" }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "raw": { "description": "Enable raw tracepoint arguments", "type": [ "boolean", "null" ] }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "subsystem": { "description": "Tracepoint subsystem", "type": "string" }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "event", "subsystem" ], "type": "object" }, "type": [ "array", "null" ] }, "uprobes": { "description": "A list of uprobe specs.", "items": { "additionalProperties": false, "properties": { "addrs": { "description": "List of the traced addresses", "items": { "format": "int64", "type": "integer" }, "type": [ "array", "null" ] }, "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "btfPath": { "description": "path for a BTF file for the traced binary", "type": [ "string", "null" ] }, "data": { "description": "A list of data to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "offsets": { "description": "List of the traced offsets", "items": { "format": "int64", "type": "integer" }, "type": [ "array", "null" ] }, "path": { "description": "Name of the traced binary", "type": "string" }, "refCtrOffsets": { "description": "List of the traced ref_ctr_offsets", "items": { "format": "int64", "type": "integer" }, "type": [ "array", "null" ] }, "return": { "default": false, "description": "Indicates whether to collect return value of the traced function.", "type": [ "boolean", "null" ] }, "returnArg": { "additionalProperties": false, "description": "A return argument to include in the trace output.", "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": [ "object", "null" ] }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "symbols": { "description": "List of the traced symbols", "items": { "type": "string" }, "type": [ "array", "null" ] }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "path" ], "type": "object" }, "type": [ "array", "null" ] }, "usdts": { "description": "A list of usdt specs.", "items": { "additionalProperties": false, "properties": { "args": { "description": "A list of function arguments to include in the trace output.", "items": { "additionalProperties": false, "properties": { "btfType": { "description": "Type of original argument. This is currently only used in UsdtSpecs and UprobeSpecs for arguments with\nthe Resolve attribute set. It relies on the BTF file defined by BTFPath to extract the\ntype.", "type": [ "string", "null" ] }, "index": { "description": "Position of the argument.", "format": "int32", "minimum": 0, "type": "integer" }, "label": { "description": "Label to output in the JSON", "type": [ "string", "null" ] }, "maxData": { "default": false, "description": "Read maximum possible data (currently 327360). This field is only used\nfor char_buff data. When this value is false (default), the bpf program\nwill fetch at most 4096 bytes. In later kernels (\u003e=5.4) tetragon\nsupports fetching up to 327360 bytes if this flag is turned on", "type": [ "boolean", "null" ] }, "resolve": { "default": "", "description": "Resolve the path to a specific attribute", "type": [ "string", "null" ] }, "returnCopy": { "default": false, "description": "This field is used only for char_buf and char_iovec types. It indicates\nthat this argument should be read later (when the kretprobe for the\nsymbol is triggered) because it might not be populated when the kprobe\nis triggered at the entrance of the function. For example, a buffer\nsupplied to read(2) won't have content until kretprobe is triggered.", "type": [ "boolean", "null" ] }, "sizeArgIndex": { "description": "Specifies the position of the corresponding size argument for this argument.\nThis field is used only for char_buf and char_iovec types.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "source": { "description": "Source of the data, if missing the default if function arguments", "type": [ "string", "null" ] }, "type": { "default": "auto", "description": "Argument type.", "enum": [ "auto", "int", "sint8", "int8", "uint8", "sint16", "int16", "uint16", "uint32", "sint32", "int32", "ulong", "uint64", "size_t", "long", "sint64", "int64", "char_buf", "char_iovec", "skb", "sock", "sockaddr", "socket", "sockaddr_un", "string", "fd", "file", "filename", "path", "nop", "bpf_attr", "perf_event", "bpf_map", "user_namespace", "capability", "kiocb", "iov_iter", "cred", "const_buf", "load_info", "module", "syscall64", "kernel_cap_t", "cap_inheritable", "cap_permitted", "cap_effective", "linux_binprm", "data_loc", "net_device", "bpf_cmd", "dentry", "bpf_prog" ], "type": "string" } }, "required": [ "index", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "btfPath": { "description": "path for a BTF file for the traced binary", "type": [ "string", "null" ] }, "message": { "description": "A short message of 256 characters max that will be included\nin the event output to inform users what is going on.", "type": [ "string", "null" ] }, "name": { "description": "Usdt name", "type": "string" }, "path": { "description": "Name of the traced binary", "type": "string" }, "provider": { "description": "Usdt provider name", "type": "string" }, "selectors": { "description": "Selectors to apply before producing trace output. Selectors are ORed.", "items": { "additionalProperties": false, "description": "KProbeSelector selects function calls for kprobe based on PIDs and function arguments. The\nresults of MatchPIDs and MatchArgs are ANDed.", "properties": { "macros": { "description": "A list of macros names, defined in spec.selectorsMacros.\nFilters specified in macros will be appended to corresponding filters of the selector.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "matchActions": { "description": "A list of actions to execute when this selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchBinaries": { "description": "A list of binary exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchCapabilities": { "description": "A list of capabilities and IDs", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchCapabilityChanges": { "description": "IDs for capabilities changes", "items": { "additionalProperties": false, "properties": { "isNamespaceCapability": { "default": false, "description": "Indicates whether these caps are namespace caps.", "type": [ "boolean", "null" ] }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "type": { "default": "Effective", "description": "Type of capabilities", "enum": [ "Effective", "Inheritable", "Permitted" ], "type": [ "string", "null" ] }, "values": { "description": "Capabilities to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchData": { "description": "A list of argument filters. MatchData are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaceChanges": { "description": "IDs for namespace changes", "items": { "additionalProperties": false, "properties": { "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace types (e.g., Mnt, Pid) to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchNamespaces": { "description": "A list of namespaces and IDs", "items": { "additionalProperties": false, "properties": { "namespace": { "description": "Namespace selector name.", "enum": [ "Uts", "Ipc", "Mnt", "Pid", "PidForChildren", "Net", "Time", "TimeForChildren", "Cgroup", "User" ], "type": "string" }, "operator": { "description": "Namespace selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Namespace IDs (or host_ns for host namespace) of namespaces to match.", "items": { "type": "string" }, "type": "array" } }, "required": [ "namespace", "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchPIDs": { "description": "A list of process ID filters. MatchPIDs are ANDed.", "items": { "additionalProperties": false, "properties": { "followForks": { "default": false, "description": "Matches any descendant processes of the matching PIDs.", "type": [ "boolean", "null" ] }, "isNamespacePID": { "default": false, "description": "Indicates whether PIDs are namespace PIDs.", "type": [ "boolean", "null" ] }, "operator": { "description": "PID selector operator.", "enum": [ "In", "NotIn" ], "type": "string" }, "values": { "description": "Process IDs to match.", "items": { "format": "int32", "type": "integer" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "type": [ "array", "null" ] }, "matchParentBinaries": { "description": "A list of process parent exec name filters.", "items": { "additionalProperties": false, "properties": { "followChildren": { "default": false, "description": "In addition to binaries, match children processes of specified binaries.", "type": [ "boolean", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "In", "NotIn", "Prefix", "NotPrefix", "Postfix", "NotPostfix" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": "array" } }, "required": [ "operator", "values" ], "type": "object" }, "maxItems": 1, "type": [ "array", "null" ] }, "matchReturnActions": { "description": "A list of actions to execute when MatchReturnArgs selector matches", "items": { "additionalProperties": false, "properties": { "action": { "description": "Action to execute.\nNOTE: actions FollowFD, UnfollowFD, and CopyFD are marked as deprecated and planned to\nbe removed in version 1.5.", "enum": [ "Post", "FollowFD", "UnfollowFD", "Sigkill", "CopyFD", "Override", "GetUrl", "DnsLookup", "NoPost", "Signal", "TrackSock", "UntrackSock", "NotifyEnforcer", "CleanupEnforcerNotification", "Set" ], "type": "string" }, "argError": { "description": "error value for override action", "format": "int32", "type": [ "integer", "null" ] }, "argFd": { "description": "An arg index for the fd for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argFqdn": { "description": "A FQDN to lookup for the dnsLookup action", "type": [ "string", "null" ] }, "argIndex": { "description": "An arg index for the set action", "format": "int32", "type": [ "integer", "null" ] }, "argName": { "description": "An arg index for the filename for fdInstall action", "format": "int32", "type": [ "integer", "null" ] }, "argRegs": { "description": "An arg value for the regs action", "items": { "type": "string" }, "type": [ "array", "null" ] }, "argSig": { "description": "A signal number for signal action", "format": "int32", "type": [ "integer", "null" ] }, "argSock": { "description": "An arg index for the sock for trackSock and untrackSock actions", "format": "int32", "type": [ "integer", "null" ] }, "argUrl": { "description": "A URL for the getUrl action", "type": [ "string", "null" ] }, "argValue": { "description": "An arg value for the set action", "format": "int32", "type": [ "integer", "null" ] }, "imaHash": { "description": "Enable collection of file hashes from integrity subsystem.\nOnly valid with the post action.", "type": [ "boolean", "null" ] }, "kernelStackTrace": { "description": "Enable kernel stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] }, "rateLimit": { "description": "A time period within which repeated messages will not be posted. Can be\nspecified in seconds (default or with 's' suffix), minutes ('m' suffix)\nor hours ('h' suffix). Only valid with the post action.", "type": [ "string", "null" ] }, "rateLimitScope": { "description": "The scope of the provided rate limit argument. Can be \"thread\" (default),\n\"process\" (all threads for the same process), or \"global\". If \"thread\" is\nselected then rate limiting applies per thread; if \"process\" is selected\nthen rate limiting applies per process; if \"global\" is selected then rate\nlimiting applies regardless of which process or thread caused the action.\nOnly valid with the post action and with a rateLimit specified.", "type": [ "string", "null" ] }, "userStackTrace": { "description": "Enable user stack trace export. Only valid with the post action.", "type": [ "boolean", "null" ] } }, "required": [ "action" ], "type": "object" }, "type": [ "array", "null" ] }, "matchReturnArgs": { "description": "A list of argument filters. MatchArgs are ANDed.", "items": { "additionalProperties": false, "properties": { "args": { "description": "Position of the operator arguments (in spec file) to apply fhe filter to.", "items": { "format": "int32", "minimum": 0, "type": "integer" }, "type": [ "array", "null" ] }, "index": { "description": "Position of the argument (in function prototype) to apply fhe filter to.", "format": "int32", "minimum": 0, "type": [ "integer", "null" ] }, "operator": { "description": "Filter operation.", "enum": [ "Equal", "NotEqual", "Prefix", "NotPrefix", "Postfix", "NotPostfix", "GreaterThan", "LessThan", "GT", "LT", "Mask", "SPort", "NotSPort", "SPortPriv", "NotSportPriv", "DPort", "NotDPort", "DPortPriv", "NotDPortPriv", "SAddr", "NotSAddr", "DAddr", "NotDAddr", "Protocol", "Family", "State", "InMap", "NotInMap", "CapabilitiesGained", "InRange", "NotInRange", "SubString", "SubStringIgnCase", "CelExpr", "FileType", "NotFileType" ], "type": "string" }, "values": { "description": "Value to compare the argument against.", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "required": [ "operator" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "tags": { "description": "Tags to categorize the event, will be include in the event output.\nMaximum of 16 Tags are supported.", "items": { "type": "string" }, "maxItems": 16, "type": [ "array", "null" ] } }, "required": [ "name", "path", "provider" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" } }, "required": [ "metadata", "spec" ], "type": "object", "x-kubernetes-validations": [ { "message": "TracingPolicyNamespaced should have a null spec.hostSelector.", "rule": "!has(self.spec.hostSelector)" } ] }