diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c index 112b44d9bb10..c9d05192630a 100644 --- a/pkg/ebpf/c/tracee.bpf.c +++ b/pkg/ebpf/c/tracee.bpf.c @@ -5088,6 +5088,9 @@ int BPF_KPROBE(trace_set_fs_pwd) if (!init_program_data(&p, ctx, SET_FS_PWD)) return 0; + if (p.event->context.syscall != SYSCALL_CHDIR && p.event->context.syscall != SYSCALL_FCHDIR) + return 0; + if (!evaluate_scope_filters(&p)) return 0;