selectors: add matchParentBinaries selector #4254

kobrineli · 2025-10-27T13:10:19Z

Description

This change adds matchParentBinaries selector, which might be useful for proper and granular filtering of parent binaries, which is needed in some specific cases.

For instance, there is a python script, which invokes some system calls, which we want to intercept and report. If such script is executed by some system process, we want to filter it out. Otherwise, we report it. For this filtering we need a selector for parent binary, because we cannot filter out events only by current binary, which in case of python script execution is always python.

For more real example, consider we want to hook all calls of chmod system call to prevent creating new binaries on the system manually. apt-key binary, when it installs some packages (such cases we don't want to report), doesn't call chmod directly, but uses /usr/bin/chmod binary, which calls chmod system call inside. matchParentBinaries selector would help to create accurate exclusion for this case.

Example of policy with matchParentBinaries selector:

Consider we want to get events about all files, which were made executable, with chmod syscall, but don't want to get events about apt-key making files executable. Unfortunately, apt-key doesn't make files executable with syscall directly, but uses /usr/bin/chmod binary, which calls chmod function, so to filter such events we need to have selectors for both parent and current binary, so the resulting policy will look like this:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: chmod-x-bit
spec:
  kprobes:
    - call: "sys_chmod"
      syscall: true
      args:
        - index: 0
          type: "string"
          label: "pathname"
        - index: 1
          type: "int"
          label: "mode"
      selectors:
        - matchArgs:
            - index: 1
              operator: "Mask"
              values:
                - "73" # X bit for owner, group or all (001001001)
          matchBinaries:
            - operator: "NotIn"
              values:
                "/usr/bin/chmod"
        - matchArgs:
            - index: 1
              operator: "Mask"
              values:
                - "73" # X bit for owner, group or all (001001001)
          matchBinaries:
            - operator: "In"
              values:
              - "/usr/bin/chmod"
          matchParentBinaries:
            - operator: "NotIn"
              values:
              - "/usr/bin/apt-key"

If current binary is not/usr/bin/chmod, we don't care about parent binary, but if current binary is /usr/bin/chmod, we don't want the parent binary to be /usr/bin/apt-key.

Changelog

tracingpolicy: add matchParentBinaries selector

netlify · 2025-10-27T13:11:05Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`2e7372c`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/696f66e90b6d9b0008a5c21b
😎 Deploy Preview	https://deploy-preview-4254--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

kobrineli · 2025-10-27T13:30:33Z

Probably I should add docs for this selector

kkourt

Thanks!

One thing that would help reviewing this PR would be to split it into multiple commits.
See https://tetragon.io/docs/contribution-guide/submitting-a-pull-request/.

Before the implementation, though, it would be interesting to specify the fetaure so that's it is clear what the semantics are. This can be done in the PR itself (e.g,. in a commit message), in an issue, or in a CFP (see https://github.com/cilium/design-cfps). Whatever works best for you!

For example, it would be very useful to have an example policy that uses the newly introduced operator and discuss how it works

kkourt · 2025-10-27T14:40:44Z

Another thing to note is that the functionality is similar to https://tetragon.io/docs/concepts/tracing-policy/selectors/#follow-children. So I wonder if something like:

- matchBinaries:
  - operator: "In"
    values:
    - "/usr/sbin/sshd"
    followChildren: true
  - operator: "NotIn"
    values:
    - "/usr/sbin/sshd"

Would achieve a similar result. The first thing to check would be if matchBinaries are ANDed as, for example, MatchAargs are. The second thing, is that this will not just match the parent, but every ancestor which might or might not be what we want.

kobrineli · 2025-10-27T14:48:00Z

@kkourt
Tetragon currently supports only one match binary operator by selector:
https://github.com/cilium/tetragon/blob/main/pkg/selectors/kernel.go#L1426

So listing multiple operators in match binary selector will fail.

kkourt · 2025-10-27T14:55:37Z

One more thing to note is that this looks related to

@kkourt Tetragon currently supports only one match binary operator by selector: https://github.com/cilium/tetragon/blob/main/pkg/selectors/kernel.go#L1426

So listing multiple operators in match binary selector will fail.

Thanks!

I don't remember why this limitation exists, but my guess is that this is something that can be fixed. So, then, the question in my mind is whether the use-case you are describing is better served by matching on the immediate parent or all on ancestors (for which some support already exists).

PS: Might be worth updating the docs to reflect above.

kevsecurity · 2025-10-27T14:56:22Z

@kkourt Tetragon currently supports only one match binary operator by selector: https://github.com/cilium/tetragon/blob/main/pkg/selectors/kernel.go#L1426

So listing multiple operators in match binary selector will fail.

I wonder if supporting 2 binary selectors would be easier than supporting N, but would potentially achieve the result without supporting parent selectors altogether?

We could maybe have a limit to how many "generations" of children we follow. In this case, a limit of 1 generation would prevent reporting grandchildren. Haven't looked to see if this is easy or not however.

kobrineli · 2025-10-27T15:09:48Z

I wonder if supporting 2 binary selectors would be easier than supporting N, but would potentially achieve the result without supporting parent selectors altogether?

Currently exactly 1 matchBinaries selector is mapped by selector idx. If it is not complicated to support mapping the array of matchBinaries selectors by selector idx, probably with additional field with index in tg_mb_paths map, then it would be easier, than supporting matchParents selector. But I'm afraid, that such changes will lead to hard refactoring in bpf code, while supporting separate selector, which can also be only one for current selectors set, seems pretty easy.

Moreover, maybe explicit parents filtering, working in the same way as current process binary filtering, is easier to understand and to read.

kobrineli · 2025-10-27T15:26:11Z

So, then, the question in my mind is whether the use-case you are describing is better served by matching on the immediate parent or all on ancestors (for which some support already exists).

With current existing support we cannot exclude the binary itself because of the selector number limitation.
Moreover, we may want to apply filter for concrete child of parent process, rather than to all process children (as with followChildren option), combining matchBinaries and matchParents selectors.

kobrineli · 2025-10-27T15:31:00Z

So I wonder if something like:

- matchBinaries:
  - operator: "In"
    values:
    - "/usr/sbin/sshd"
    followChildren: true
  - operator: "NotIn"
    values:
    - "/usr/sbin/sshd"

Would achieve a similar result.

If we want to match concrete child process, seems like this wouldn't achieve the same result.

kobrineli · 2025-10-28T08:04:31Z

@kkourt
Hi!
I've separated PR into several commits.

kkourt · 2025-10-28T08:14:43Z

@kkourt Hi! I've separated PR into several commits.

Thanks! Can you please add some context in the commit messages (see: https://tetragon.io/docs/contribution-guide/submitting-a-pull-request/)?

Before merging the PR, we would need tests and documentation updates. If you are looking for early feedback, can you add an example (maybe in the commit message) on how to use the new selector?

kkourt · 2025-10-28T08:36:37Z

I'm also seeing some CI failures:

--- FAIL: TestKprobeSigkillExecveMap1 (306.00s)
    kprobe_sigkill_test.go:65: child pid is 32313 and spec file is /tmp/sigkill-3506928072.yaml
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="BTF discovery: default kernel btf file found" btf-file=/sys/kernel/btf/vmlinux
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Creating new EventCache" retries=15 delay=2s
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Starting process manager" enableK8s=false enableProcessCred=true enableProcessNs=true
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Starting JSON exporter"
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Cgroup rate disabled (0/0s)"
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="BTF file: using metadata file" metadata=/sys/kernel/btf/vmlinux
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="Loading sensor" name=__base__
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="Loading kernel version 6.11.11"
    logcapture.go:24: time=2025-10-28T08:17:34.945Z level=INFO msg="Loaded sensor successfully" sensor=__base__
    logcapture.go:24: time=2025-10-28T08:17:34.984Z level=INFO msg="Read ProcFS /proc appended 222/284 entries"
    logcapture.go:24: time=2025-10-28T08:17:34.984Z level=WARN msg="failed to put value in execve_map" value="&{Process:{Pid:10 Pad:0 Ktime:540000000} Parent:{Pid:2 Pad:0 Ktime:540000000} Flags:0 Nspid:0 Namespaces:{UtsInum:4026531838 IpcInum:4026531839 MntInum:4026531841 PidInum:4026531836 PidChildInum:4026531836 NetInum:4026531840 TimeInum:4026531834 TimeChildInum:4026531834 CgroupInum:4026531835 UserInum:4026531837} Capabilities:{Permitted:2199023255551 Effective:2199023255551 Inheritable:0} Binary:{PathLength:27 Reversed:0 Path:[107 119 111 114 107 101 114 47 48 58 48 72 45 101 118 101 110 116 115 95 104 105 103 104 112 114 105 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] End:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] EndR:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] Args:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] MBSet:0 MBGen:0}}" error="update: key too big for map: argument list too long"

kobrineli · 2025-10-28T09:01:18Z

I'm also seeing some CI failures:

--- FAIL: TestKprobeSigkillExecveMap1 (306.00s)
    kprobe_sigkill_test.go:65: child pid is 32313 and spec file is /tmp/sigkill-3506928072.yaml
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="BTF discovery: default kernel btf file found" btf-file=/sys/kernel/btf/vmlinux
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Creating new EventCache" retries=15 delay=2s
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Starting process manager" enableK8s=false enableProcessCred=true enableProcessNs=true
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Starting JSON exporter"
    logcapture.go:24: time=2025-10-28T08:17:34.681Z level=INFO msg="Cgroup rate disabled (0/0s)"
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="BTF file: using metadata file" metadata=/sys/kernel/btf/vmlinux
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="Loading sensor" name=__base__
    logcapture.go:24: time=2025-10-28T08:17:34.682Z level=INFO msg="Loading kernel version 6.11.11"
    logcapture.go:24: time=2025-10-28T08:17:34.945Z level=INFO msg="Loaded sensor successfully" sensor=__base__
    logcapture.go:24: time=2025-10-28T08:17:34.984Z level=INFO msg="Read ProcFS /proc appended 222/284 entries"
    logcapture.go:24: time=2025-10-28T08:17:34.984Z level=WARN msg="failed to put value in execve_map" value="&{Process:{Pid:10 Pad:0 Ktime:540000000} Parent:{Pid:2 Pad:0 Ktime:540000000} Flags:0 Nspid:0 Namespaces:{UtsInum:4026531838 IpcInum:4026531839 MntInum:4026531841 PidInum:4026531836 PidChildInum:4026531836 NetInum:4026531840 TimeInum:4026531834 TimeChildInum:4026531834 CgroupInum:4026531835 UserInum:4026531837} Capabilities:{Permitted:2199023255551 Effective:2199023255551 Inheritable:0} Binary:{PathLength:27 Reversed:0 Path:[107 119 111 114 107 101 114 47 48 58 48 72 45 101 118 101 110 116 115 95 104 105 103 104 112 114 105 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] End:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] EndR:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] Args:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] MBSet:0 MBGen:0}}" error="update: key too big for map: argument list too long"

Is it an issue of this PR?
There is error update: key too big for map: argument list too long while putting a value into execve_map, which was not changed in this PR.

mtardy

Thanks, overall looks good to me, just a few nits

Probably I should add docs for this selector

Please update the documentation with this new selector (see https://tetragon.io/docs/concepts/tracing-policy/selectors/).

pkg/selectors/kernel.go

mtardy · 2025-10-28T15:57:28Z

I see checkpatch is complaining and other CI checks, you can run make checkpatch locally and see more docs on how to create a nice PR here https://tetragon.io/docs/contribution-guide/submitting-a-pull-request/ if that can help :)

kevsecurity

LGTM (barring the red test results).

olsajiri

would it be possible to handle this as special case of current BinarySelector, having some parent bool like:

diff --git a/pkg/k8s/apis/cilium.io/v1alpha1/types.go b/pkg/k8s/apis/cilium.io/v1alpha1/types.go
index 6c3210b0acf5..b5133b1e5fe2 100644
--- a/pkg/k8s/apis/cilium.io/v1alpha1/types.go
+++ b/pkg/k8s/apis/cilium.io/v1alpha1/types.go
@@ -124,6 +124,10 @@ type BinarySelector struct {
        // +kubebuilder:validation:Optional
        // +kubebuilder:default=false
        FollowChildren bool `json:"followChildren"`
+       // match parent binary
+       // +kubebuilder:validation:Optional
+       // +kubebuilder:default=false
+       Parent bool `json:"parent"`
 }

then all the code dups with binary selectors would go away
we could perhaps think a bit about some maps max_entries tuning

kobrineli · 2025-10-29T09:50:10Z

@olsajiri Hi!
Current implementation of matchBinaries selector allows to have only one matchBinaries per selector, so filtering both current binary and parent binary will not be possible.

matchBinaries selector refactoring might be complicated and not so easy as adding additional new selector for direct parent filtering.

Moreover, matchBinaries selector supports followChildren option, which works with mbsetid field of process in tetragon execve map, so combining 2 different matchBinaries selector, which both can change this field, will be a problem, and this place will need to be changed as well.

olsajiri

I think it's ok, left one comment.. please squash changes from the top fix commit to the patchset

@kkourt could you please check if you're ok with that? thanks

bpf/process/pfilter.h

kkourt

Thanks! The PR is really well written, and I enjoyed reading it!

A have a couple of nits, but otherwise LGTM!

pkg/selectors/selectors.go

bpf/process/types/basic.h

This adds genericMatchBinariesSelector enumeration, renames match binaries maps and changes match binaries parsing to allow parsing other matchBinaries-like selectors in future with the same code. Signed-off-by: Kobrin Ilay <[email protected]>

This commit introduces new matchParentBinaries selector, which is used for filtering parent process binaries. New selector works similarly to matchBinaries selector, including followChildren option, which allows to match not only direct parent binaries, but transitive parent binaries as well. matchParentBinaries selector is needed in cases when we want to have granular filters on parent binaries for some events. For example, we may want to intercept calls for specific system call from specific binary only in case it was executed with interactive shell. For that we can add following selector, which will match only process with bash, sh or zsh parent: ``` - matchParentBinaries: - operator: "In" values: - "/usr/bin/bash" - "/usr/bin/sh" - "/usr/bin/zsh" ``` Signed-off-by: Kobrin Ilay <[email protected]>

This commit adds crds generated for matchParentBinaries selector Signed-off-by: Kobrin Ilay <[email protected]>

This commits adds logic for parsing matchParentBinaries selector. New selector is stored in same maps as matchBinaries selector, but has key offset equal to MaxSelectors. Signed-off-by: Kobrin Ilay <[email protected]>

bpf/lib/process.h

This commit adds parents binary map to sensors and restricts using matchParentBinariesMap selector when parents map is not enabled. Parents map is disabled by default due to additional memory overhead from storing info about parent binaries. Default parents map size is same as default execve map size. Signed-off-by: Kobrin Ilay <[email protected]>

This commit adds bpf code for parent binaries filtering for new matchParentBinaries selector. Match binaries bpf maps sizes are increased to MAX_SELECTORS * 2 to store both selectors options. Parent filtering is processed with the same code, but key for matchParentBinaries has offset equal to MAX_SELECTORS. Signed-off-by: Kobrin Ilay <[email protected]>

This commit adds test for new matchParentBinaries selector. In the test we verify that all operations (In, NotIn, Prefix, NotPrefix, Postfix, NotPostfix) work correctly. Signed-off-by: Kobrin Ilay <[email protected]>

Signed-off-by: Kobrin Ilay <[email protected]>

kobrineli · 2026-01-20T12:49:31Z

@mtardy @kkourt
Hi! Thanks
Fixed latest nits, all tests passed

mtardy · 2026-01-20T15:59:53Z

@mtardy @kkourt Hi! Thanks Fixed latest nits, all tests passed

Thanks a lot, we'll see if Kev has anything to say but I think this is ready to merge. Thanks a lot for sticking around and being resilient on developing that cool feature!

kevsecurity

LGTM

kobrineli requested a review from a team as a code owner October 27, 2025 13:10

kobrineli requested a review from kevsecurity October 27, 2025 13:10

kobrineli force-pushed the add-match-parents-filter branch 2 times, most recently from 4f73f6d to e31cabe Compare October 27, 2025 13:27

kobrineli force-pushed the add-match-parents-filter branch from e31cabe to 70ac377 Compare October 27, 2025 13:41

kkourt reviewed Oct 27, 2025

View reviewed changes

kobrineli force-pushed the add-match-parents-filter branch from 70ac377 to d503dbd Compare October 27, 2025 15:28

kobrineli force-pushed the add-match-parents-filter branch from d503dbd to 12bf008 Compare October 28, 2025 08:03

kkourt added the release-note/major This PR introduces major new functionality label Oct 28, 2025

kobrineli force-pushed the add-match-parents-filter branch 2 times, most recently from eeab3e7 to 5d54ba8 Compare October 28, 2025 15:30

mtardy reviewed Oct 28, 2025

View reviewed changes

pkg/selectors/kernel.go Show resolved Hide resolved

pkg/selectors/kernel.go Outdated Show resolved Hide resolved

pkg/selectors/kernel.go Outdated Show resolved Hide resolved

pkg/selectors/kernel.go Outdated Show resolved Hide resolved

pkg/selectors/kernel.go Show resolved Hide resolved

kevsecurity approved these changes Oct 28, 2025

View reviewed changes

olsajiri reviewed Oct 29, 2025

View reviewed changes

kobrineli force-pushed the add-match-parents-filter branch from 5d54ba8 to 600672b Compare October 29, 2025 09:44

kobrineli force-pushed the add-match-parents-filter branch 2 times, most recently from 6f2a2db to 142f650 Compare January 6, 2026 20:29

kobrineli requested a review from olsajiri January 6, 2026 20:30

kobrineli force-pushed the add-match-parents-filter branch 4 times, most recently from faa51c7 to 0f197ae Compare January 13, 2026 09:49

olsajiri reviewed Jan 13, 2026

View reviewed changes

bpf/process/pfilter.h Outdated Show resolved Hide resolved

kobrineli force-pushed the add-match-parents-filter branch 4 times, most recently from 6086133 to b017dfc Compare January 13, 2026 21:33

kkourt added the needs-rebase This PR needs to be rebased because it has merge conflicts. label Jan 20, 2026

kkourt approved these changes Jan 20, 2026

View reviewed changes

pkg/selectors/selectors.go Show resolved Hide resolved

bpf/process/types/basic.h Show resolved Hide resolved

kobrineli added 4 commits January 20, 2026 14:17

pkg/k8s: generate crds for MatchParentBinaries

2a3f68e

This commit adds crds generated for matchParentBinaries selector Signed-off-by: Kobrin Ilay <[email protected]>

selectors: parse matchParentBinaries selector

f376252

This commits adds logic for parsing matchParentBinaries selector. New selector is stored in same maps as matchBinaries selector, but has key offset equal to MaxSelectors. Signed-off-by: Kobrin Ilay <[email protected]>

kobrineli force-pushed the add-match-parents-filter branch from b017dfc to 2e7372c Compare January 20, 2026 11:28

mtardy approved these changes Jan 20, 2026

View reviewed changes

bpf/lib/process.h Outdated Show resolved Hide resolved

kobrineli added 4 commits January 20, 2026 15:07

test: matchParentBinaries test

f25533a

This commit adds test for new matchParentBinaries selector. In the test we verify that all operations (In, NotIn, Prefix, NotPrefix, Postfix, NotPostfix) work correctly. Signed-off-by: Kobrin Ilay <[email protected]>

docs: add docs for matchParentBinaries selector and new flags

884cb06

Signed-off-by: Kobrin Ilay <[email protected]>

kobrineli force-pushed the add-match-parents-filter branch from 2e7372c to 884cb06 Compare January 20, 2026 12:09

kkourt removed the needs-rebase This PR needs to be rebased because it has merge conflicts. label Jan 20, 2026

kevsecurity approved these changes Jan 20, 2026

View reviewed changes

kkourt merged commit 9dbe634 into cilium:main Jan 20, 2026
60 checks passed

selectors: add matchParentBinaries selector #4254

selectors: add matchParentBinaries selector #4254

Uh oh!

Conversation

kobrineli commented Oct 27, 2025 • edited by kkourt Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Uh oh!

netlify bot commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

kobrineli commented Oct 27, 2025

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

kkourt commented Oct 27, 2025

Uh oh!

kobrineli commented Oct 27, 2025

Uh oh!

kkourt commented Oct 27, 2025

Uh oh!

kevsecurity commented Oct 27, 2025

Uh oh!

kobrineli commented Oct 27, 2025

Uh oh!

kobrineli commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kobrineli commented Oct 27, 2025

Uh oh!

kobrineli commented Oct 28, 2025

Uh oh!

kkourt commented Oct 28, 2025

Uh oh!

kkourt commented Oct 28, 2025

Uh oh!

kobrineli commented Oct 28, 2025

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mtardy commented Oct 28, 2025

Uh oh!

kevsecurity left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olsajiri left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kobrineli commented Oct 29, 2025

Uh oh!

olsajiri left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kobrineli commented Jan 20, 2026

Uh oh!

mtardy commented Jan 20, 2026

Uh oh!

kevsecurity left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

kobrineli commented Oct 27, 2025 •

edited by kkourt

Loading

netlify bot commented Oct 27, 2025 •

edited

Loading

kobrineli commented Oct 27, 2025 •

edited

Loading

kevsecurity left a comment •

edited

Loading

olsajiri left a comment •

edited

Loading