Bug Report

General Information

• Environment description: k3s v1.30.6+k3s1
• Kernel version (run uname -a): 6.6.63-1-lts
• Orchestration system version in use (e.g. kubectl version, ...)

  Client Version: v1.30.6+k3s1
  Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
  Server Version: v1.30.6+k3s1
  

• Link to relevant artifacts (policies, deployments scripts, ...)
• Target containers/pods

To Reproduce

• to replicate the behaviour modify kubearmor to ignore /usr/bin/date

  if path == "/usr/bin/date" {
    return ""
  }
  

• deploy nginx deployment

  kubectl create deployment nginx --image=nginx
  

• apply ksp

  apiVersion: security.kubearmor.com/v1
  kind: KubeArmorPolicy
  metadata:
    name: ksp-nginx-allow-bin-dir-process
  spec:
    action: Allow
    process:
      matchDirectories:
      - dir: /bin/
        recursive: true
    selector:
      matchLabels:
        app: nginx
  

• observe kubearmor telemetry in a seperate terminal

  karmor logs
  

• execute inside nginx pod

  /usr/bin/date +%Y-%m-%d %H:%M:%S
  

Expected behavior

if processName is empty, telemetry should use source information as processName

Screenshots

ProcessName is not present in the telemetry.