cilium / tetragon

eBPF-based Security Observability and Runtime Enforcement

Home Page:https://tetragon.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Cannot track users attempting to follow symlinks outside of a directory root

dwindsor opened this issue · comments

In order to track attempts to follow symlinks outside of a directory root, we need to be able to extract the d_name.name member from struct dentry.

The LSM function used to track this behavior is security_inode_follow_link (available since 4.19):

int security_inode_follow_link(struct dentry *dentry, struct inode *inode, bool rcu);