Skip to content

Conversation

@rootxrishabh
Copy link
Member

Purpose of PR?:

Fixes #2022

Does this PR introduce a breaking change?

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix. Fixes #
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

@rootxrishabh
Copy link
Member Author

Working as expected -

Screenshot from 2025-06-24 01-37-55

@rksharma95
Copy link
Collaborator

@rootxrishabh can you check for presets as well?

Signed-off-by: Rishabh Soni <[email protected]>
@rootxrishabh
Copy link
Member Author

Added tty to all presets, using protect proc as an example here -

== Alert / 2025-06-24 09:39:25.013829 ==
ClusterName: default
HostName: rootxrishabh
NamespaceName: default
PodName: nginx-5869d7778c-rmq2j
Labels: app=nginx
ContainerName: nginx
ContainerID: e4b97af2cad5a335dca315bbb51b6fa3792eac1764d04fb33abee1eaccbd3601
ContainerImage: docker.io/library/nginx:latest@sha256:6784fb0834aa7dbbe12e3d7471e69c290df3e6ba810dc38b34ae33d3c1c05f7d
Type: MatchedPolicy
PolicyName: ksp-nginx-presets
Source: /usr/bin/ls /proc/37/
Resource: /proc/37
Operation: File
Enforcer: PRESET-ProtectProcPreset
Result: Permission denied
Cwd: /
HostPID: 183736
HostPPID: 17312
Owner: map[Name:nginx Namespace:default Ref:Deployment]
PID: 53
PPID: 17312
ParentProcessName: /usr/bin/bash
ProcessName: /usr/bin/ls
TTY: pts0
UID: 0

Copy link
Member

@Aryan-sharma11 Aryan-sharma11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rksharma95 rksharma95 merged commit 38d862b into kubearmor:main Jun 25, 2025
21 checks passed
@rootxrishabh rootxrishabh deleted the addTTYtoBPFLSM branch June 25, 2025 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add tty information to bpf-lsm generated telemetry

3 participants