feat(ebpf): restrict set_fs_pwd to (f)chdir syscall (#4359) (#4361)

commit: ab6344f (main), cherry-pick Co-authored-by: OriGlassman <[email protected]>
aquasecurity · Oct 21, 2024 · dc7e08f · dc7e08f
1 parent 1e8fc73
commit dc7e08f
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -5088,6 +5088,9 @@ int BPF_KPROBE(trace_set_fs_pwd)
     if (!init_program_data(&p, ctx, SET_FS_PWD))
         return 0;
 
+    if (p.event->context.syscall != SYSCALL_CHDIR && p.event->context.syscall != SYSCALL_FCHDIR)
+        return 0;
+
     if (!evaluate_scope_filters(&p))
         return 0;