Write a Tetragon TracingPolicy to monitor opens of sensitive files using a kprobe and matchArgs path filtering

Steps

1. Create a TracingPolicy with a kprobe on security_file_open or fd_install to capture file open events at the kernel level
2. Declare the relevant arguments; for fd_install declare argument at index 1 with type: file to extract path information
3. Under selectors, add a matchArgs entry specifying index (pointing to the path argument), operator: Prefix, and a values list with sensitive paths such as /etc/shadow, /etc/passwd, /root/.ssh/, and /etc/sudoers
4. Optionally add matchBinaries to limit monitoring to specific executables, or matchNamespaces to scope to a namespace
5. Apply the policy and generate test file access events; observe them with tetra getevents
6. Add action: Sigkill under matchActions if you want to enforce rather than just observe