diff --git a/examples/tracingpolicy/cves/cve-2023-2640-overlayfs-ubuntu.yaml b/examples/tracingpolicy/cves/cve-2023-2640-overlayfs-ubuntu.yaml index 5c637b3ade5..df94a5fdff0 100644 --- a/examples/tracingpolicy/cves/cve-2023-2640-overlayfs-ubuntu.yaml +++ b/examples/tracingpolicy/cves/cve-2023-2640-overlayfs-ubuntu.yaml @@ -37,6 +37,7 @@ spec: - index: 0 type: "string" returnArg: + index: 0 type: "int" selectors: - matchNamespaces: diff --git a/examples/tracingpolicy/datagram-with-selectors.yaml b/examples/tracingpolicy/datagram-with-selectors.yaml index 558e4542bd6..762074f755f 100644 --- a/examples/tracingpolicy/datagram-with-selectors.yaml +++ b/examples/tracingpolicy/datagram-with-selectors.yaml @@ -25,4 +25,4 @@ spec: - "IPPROTO_UDP" matchActions: - action: Post - rateLimit: 5 + rateLimit: "5" diff --git a/examples/tracingpolicy/datagram-with-sock-tracking.yaml b/examples/tracingpolicy/datagram-with-sock-tracking.yaml index e843df78cbd..abf25b39f88 100644 --- a/examples/tracingpolicy/datagram-with-sock-tracking.yaml +++ b/examples/tracingpolicy/datagram-with-sock-tracking.yaml @@ -12,6 +12,7 @@ spec: type: int label: "family" returnArg: + index: 0 type: sock returnArgAction: TrackSock selectors: @@ -19,7 +20,7 @@ spec: - index: 1 operator: "Equal" values: - - 2 + - "2" - call: "__sk_free" syscall: false args: @@ -51,4 +52,4 @@ spec: - "IPPROTO_UDP" matchActions: - action: Post - rateLimit: 5 + rateLimit: "5" diff --git a/examples/tracingpolicy/datagram_518.yaml b/examples/tracingpolicy/datagram_518.yaml index 927e07b5c37..8fa03c596e1 100644 --- a/examples/tracingpolicy/datagram_518.yaml +++ b/examples/tracingpolicy/datagram_518.yaml @@ -24,6 +24,7 @@ spec: - index: 1 type: int returnArg: + index: 0 type: sock returnArgAction: TrackSock selectors: @@ -31,8 +32,8 @@ spec: - index: 1 operator: "Equal" values: - - 2 - - 10 + - "2" + - "10" - call: "__sk_free" syscall: false args: @@ -43,8 +44,8 @@ spec: - index: 0 operator: "Family" values: - - 2 - - 10 + - "2" + - "10" - matchActions: - action: UntrackSock - call: "sk_filter_trim_cap" diff --git a/examples/tracingpolicy/dns-only-specified-servers.yaml b/examples/tracingpolicy/dns-only-specified-servers.yaml index 4a10ac7b8e8..5de03e54323 100644 --- a/examples/tracingpolicy/dns-only-specified-servers.yaml +++ b/examples/tracingpolicy/dns-only-specified-servers.yaml @@ -42,7 +42,7 @@ spec: - index: 2 operator: "DPort" values: - - 53 + - "53" - index: 2 operator: "NotDAddr" values: diff --git a/examples/tracingpolicy/openat_write.yaml b/examples/tracingpolicy/openat_write.yaml index e7f1c73e9f0..60207f4ee93 100644 --- a/examples/tracingpolicy/openat_write.yaml +++ b/examples/tracingpolicy/openat_write.yaml @@ -15,6 +15,7 @@ spec: - index: 2 type: "int" returnArg: + index: 0 type: int selectors: - matchArgs: @@ -25,11 +26,11 @@ spec: - index: 2 operator: "Mask" values: - - 0x40 # CREATE - - 0x1 # WRONLY - - 0x2 # RDWR + - "64" # CREATE (0x40) + - "1" # WRONLY (0x01) + - "2" # RDWR (0x02) matchReturnArgs: - index: 0 operator: "GT" values: - - 0 + - "0" diff --git a/examples/tracingpolicy/sys_write_sigkill.yaml b/examples/tracingpolicy/sys_write_sigkill.yaml index 5cf35ca627d..7f46bb6c53f 100644 --- a/examples/tracingpolicy/sys_write_sigkill.yaml +++ b/examples/tracingpolicy/sys_write_sigkill.yaml @@ -72,4 +72,4 @@ spec: values: - "/tmp/passwd" matchActions: - - action: SigKill + - action: Sigkill diff --git a/examples/tracingpolicy/tcp-accept.yaml b/examples/tracingpolicy/tcp-accept.yaml index a3b73d11b38..252d2fd108f 100644 --- a/examples/tracingpolicy/tcp-accept.yaml +++ b/examples/tracingpolicy/tcp-accept.yaml @@ -10,8 +10,9 @@ spec: args: - index: 1 type: int - label: "family" + label: "Family" returnArg: + index: 0 type: sock returnArgAction: TrackSock selectors: @@ -19,7 +20,7 @@ spec: - index: 1 operator: "Equal" values: - - 2 + - "2" - call: "__sk_free" syscall: false args: @@ -28,7 +29,7 @@ spec: selectors: - matchArgs: - index: 0 - operator: "family" + operator: "Family" values: - "AF_INET" - matchActions: @@ -45,13 +46,13 @@ spec: selectors: - matchArgs: - index: 0 - operator: "state" + operator: "State" values: - "TCP_SYN_RECV" - index: 1 operator: "Equal" values: - - 1 + - "1" - call: "tcp_close" syscall: false args: @@ -70,6 +71,7 @@ spec: - index: 0 type: "sock" returnArg: + index: 0 type: sock returnArgAction: TrackSock