lsmhooks do not support matchData despite being documented in the TracingPolicy API reference

[franfreire]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem?

The Tetragon TracingPolicy API reference documents lsmhooks[index].selectors[index].matchData, but matchData is not actually supported for LSM hooks. Any TracingPolicy that uses matchData inside an lsmhooks selector fails to load with matchData index out of bonds (0,0). The docs are confusing because the field is documented but unimplemented for this hook type.

Environment

• Tetragon version: v1.7.0 (binary release tetragon-v1.7.0-amd64)
• Kernel: 6.12.38+deb13-amd64 (Debian 13)
• Deployment: standalone binary as a systemd service, policies loaded from /etc/tetragon/tetragon.tp.d/

Expected behavior

Since the API reference lists lsmhooks[index].selectors[index].matchData, it should be possible to use matchData in LSM hook selectors, e.g. to filter on data resolved from the current task (like cred.euid.val) when enforcing with the Override action.

Actual behavior

The policy fails to load. Tetragon exits with:

level=error msg="Failed to execute tetragon" error="policy handler 'tracing' failed loading policy '<name>': parseMatchArgs  error: matchData index out of bonds (0,0)"

Minimal reproducer

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "test-matchdata-lsm"
spec:
  lsmhooks:
  - hook: "path_rename"
    args:
    - index: 0
      type: "path"
      label: "old_dir"
    selectors:
    - matchArgs:
      - args: [0]
        operator: "Prefix"
        values:
        - "/home"
      matchData:
      - index: 0
        operator: "GT"
        values:
        - "1000"

Describe the feature you would like

Request

Add a data field to LsmHookSpec (mirroring KProbeSpec.Data) which is especially useful for policy enforcement (Override action) filtering on resolved task fields such as cred.euid.val.

If this is intentionally unsupported for LSM hooks, the API reference should be updated to not list lsmhooks[index].selectors[index].matchData, and ideally the schema validation should reject matchData in LSM selectors with a clear error instead of the cryptic matchData index out of bonds (0,0).

Describe your proposed solution

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[mtardy]

Hey 👋 indeed quite often we share the data structures into the API definition between the various selectors. It doesn't mean that it's actually supported since the reference is just auto generated based on that.

I think a first step could be improving the error you see:

• we can extend CEL to get you instant feedback that this can't be used like that
• improve the error message in that case so that the message is better
• extend the support to LSM hooks.

Would you be willing to contribute patches for these?

Thanks! cc fyi @olsajiri

[olsajiri]

matchData won't work without data: support, which lsm does not seem to support ATM, we need to add it