homelab-gitops/platform/tetragon/policies/tracingpolicy-privilege-escalation.yaml

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-privilege-escalation
spec:
  kprobes:
    - call: "commit_creds"
      syscall: false
      return: true