Skip to content

Conversation

@Aryan-sharma11
Copy link
Member

@Aryan-sharma11 Aryan-sharma11 commented Dec 9, 2025

Purpose of PR?:

Fixes #2302

{
  "Timestamp": 1765272001,
  "UpdatedTime": "2025-12-09T09:20:01.450811Z",
  "ClusterName": "default",
  "HostName": "aryan",
  "NamespaceName": "presets",
  "Owner": {
    "Ref": "Deployment",
    "Name": "fileless",
    "Namespace": "presets"
  },
  "PodName": "fileless-867bc8c769-g7mr5",
  "Labels": "app=fileless",
  "ContainerID": "af796c9c6d48dba28a5190336fcbea6c16b05904ec86af2175c463662b97a72a",
  "ContainerName": "fileless",
  "ContainerImage": "docker.io/kubearmor/ubuntu-w-utils:0.2@sha256:3e51e92a839b5e8f0dba01e08ec21fa2c1afe85111544a45aba29708c52de44f",
  "HostPPID": 3494068,
  "HostPID": 3625937,
  "PPID": 3494068,
  "PID": 110,
  "UID": 0,
  "ParentProcessName": "/usr/bin/dash",
  "ProcessName": "/proc/self/fd/3",
  "PolicyName": "ksp-preset-block-fileless",
  "Severity": "8",
  "Tags": "MITRE,VDSFKR",
  "ATags": [
    "MITRE",
    "VDSFKR"
  ],
  "Message": "Fileless execution is blocked",
  "Type": "MatchedPolicy",
  "Source": "/proc/self/fd/3",
  "Operation": "Process",
  "Resource": "memfd:",
  "Enforcer": "PRESET-FilelessExecutionPreset",
  "Action": "Block",
  "Result": "Permission denied",
  "Cwd": "/",
  "TTY": "pts0",
  "ExecEvent": {
    "ExecID": "15573283688141239",
    "ExecutableName": "python3"
  },
  "KubeArmorVersion": "v1.6.5-6-g01320956-dirty",
  "NodeID": "efc78266a44e507e428f499e4b92f75d2762926c45050a2ff15b16d834dd415f"
}

Does this PR introduce a breaking change?

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix. Fixes #
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

rksharma95
rksharma95 previously approved these changes Dec 9, 2025
@rksharma95 rksharma95 merged commit 3a0e2f4 into kubearmor:main Dec 11, 2025
15 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

provide message and tag with Preset telemetry alerts

3 participants