From 7ea80e39b1e5e7facc25c1b4f724dbbd3627aff7 Mon Sep 17 00:00:00 2001 From: Kaizhe Huang Date: Sat, 20 Mar 2021 17:15:07 -0700 Subject: [PATCH] rule(Set Setuid or Setgid bit) update: add k3s-agent in the whitelist Signed-off-by: Kaizhe Huang --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 276e1d74..d2f8a129 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2675,7 +2675,7 @@ condition: (always_true) - list: user_known_chmod_applications - items: [hyperkube, kubelet] + items: [hyperkube, kubelet, k3s-agent] # This macro should be overridden in user rules as needed. This is useful if a given application # should not be ignored alltogether with the user_known_chmod_applications list, but only in