Update system-probe secccomp profile (#501) (#528)

Co-authored-by: Bryce Kahle <bryce.kahle@datadoghq.com>
DataDog · Jun 24, 2022 · efb6e91 · efb6e91
1 parent e2b60a9
commit efb6e91
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/controllers/datadogagent/systemprobe.go b/controllers/datadogagent/systemprobe.go
@@ -148,6 +148,7 @@ const systemProbeSecCompData = `{
 			"fchownat",
 			"fcntl",
 			"fcntl64",
+			"flock",
 			"fstat",
 			"fstat64",
 			"fstatfs",
@@ -212,6 +213,8 @@ const systemProbeSecCompData = `{
 			"recvmmsg",
 			"recvmsg",
 			"rename",
+			"renameat",
+			"renameat2",
 			"restart_syscall",
 			"rmdir",
 			"rt_sigaction",
@@ -237,6 +240,7 @@ const systemProbeSecCompData = `{
 			"setgid32",
 			"setgroups",
 			"setgroups32",
+			"setitimer",
 			"setns",
 			"setrlimit",
 			"setsid",
@@ -252,6 +256,7 @@ const systemProbeSecCompData = `{
 			"stat64",
 			"statfs",
 			"sysinfo",
+			"symlinkat",
 			"tgkill",
 			"umask",
 			"uname",
@@ -284,6 +289,22 @@ const systemProbeSecCompData = `{
 		"comment": "",
 		"includes": {},
 		"excludes": {}
+		},
+		{
+		"names": [
+			"kill"
+		],
+		"action": "SCMP_ACT_ALLOW",
+		"args": [
+			{
+			"index": 1,
+			"value": 0,
+			"op": "SCMP_CMP_EQ"
+			}
+		],
+		"comment": "allow process detection via kill",
+		"includes": {},
+		"excludes": {}
 		}
 	]
 }