mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-22 18:32:08 +00:00
rule(Write below etc): add calco exceptions
Add several calico images and command line programs that end up writing below /etc/calico. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
parent
7ae0ce1936
commit
7effc02c60
@ -1183,7 +1183,10 @@
|
|||||||
|
|
||||||
- macro: calico_writing_conf
|
- macro: calico_writing_conf
|
||||||
condition: >
|
condition: >
|
||||||
(proc.name = calico-node and fd.name startswith /etc/calico)
|
(((proc.name = calico-node) or
|
||||||
|
(container.image.repository=gcr.io/projectcalico-org/node and proc.name in (start_runit, cp)) or
|
||||||
|
(container.image.repository=gcr.io/projectcalico-org/cni and proc.name=sed))
|
||||||
|
and fd.name startswith /etc/calico)
|
||||||
|
|
||||||
- macro: prometheus_conf_writing_conf
|
- macro: prometheus_conf_writing_conf
|
||||||
condition: (proc.name=prometheus-conf and fd.name startswith /etc/prometheus/config_out)
|
condition: (proc.name=prometheus-conf and fd.name startswith /etc/prometheus/config_out)
|
||||||
|
Loading…
Reference in New Issue
Block a user