> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ptrace attached to process

### Event Information

#### Meaning

* PTRACE attached to process event in a Kubernetes cluster indicates that a process is being traced by another process using the PTRACE system call.
* This event can be a potential security concern as it may indicate unauthorized debugging or monitoring of processes within the cluster.
* To investigate further, you can use the following kubectl command to list all running pods in the cluster: `kubectl get pods`. Then, inspect the logs of the suspicious pod using: `kubectl logs <pod_name>`.

#### Remediation

1. Identify the affected pod and its container:
   * Use the `kubectl get pods` command to list all the pods in the cluster.
   * Look for the pod that triggered the PTRACE event.
   * Identify the container within the pod that is associated with the event.

2. Patch the pod's security context:
   * Use the `kubectl patch` command to update the pod's security context.
   * Specify the pod name, namespace, and container name in the command.
   * Set the `securityContext` field to disable the `ptrace` capability for the container.
     ```yaml theme={null}
     apiVersion: v1
     kind: Pod
     metadata:
        name: <pod-name>
        namespace: <namespace>
     spec:
     containers:
     - name: <container-name>
        image: <container-image>
        securityContext:
           capabilities:
           drop:
              - SYS_PTRACE
     ```

3. Apply the changes to the pod:
   * Use the `kubectl apply` command to apply the updated manifest file.
   * Specify the path to the modified manifest file in the command.
   * The changes will be applied to the pod, disabling the `ptrace` capability for the affected container.

Example:

```bash theme={null}
# Identify the affected pod and container
kubectl get pods

# Use the kubectl patch command to drop the SYS_PTRACE capability:
kubectl patch pod <pod-name> -n <namespace> --type='json' -p='[{"op": "add", "path": "/spec/containers/0/securityContext/capabilities/drop", "value": ["SYS_PTRACE"]}]'

# Apply the changes to the pod
kubectl apply -f <path-to-modified-manifest-file>
```

Note: Replace `<pod-name>`, `<namespace>`, `<container-name>`, and `<path-to-modified-manifest-file>` with the appropriate values for your environment.