github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-12 05:58:26 +00:00
Code Issues Projects Releases Wiki Activity

fix(rules): correct indentation

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso 2021-02-18 17:39:18 +01:00 committed by poiana
parent 37a6caae12
commit 85db1aa997
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
rules/falco_rules.yaml
View File

@ -1724,22 +1724,23 @@
container.image.repository endswith /prometheus-node-exporter or container.image.repository endswith /prometheus-node-exporter or
container.image.repository endswith /image-inspector)) container.image.repository endswith /image-inspector))
#602401143452.dkr.ecr is official AWS EKS registry. AWS has different ECR repo per region # 602401143452.dkr.ecr is official AWS EKS registry. AWS has different ECR repo per region
#602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy # 602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy
#602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/kube-proxy # 602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/kube-proxy
#For this reason we use two macro to match all regions # For this reason we use two macro to match all regions
- macro: allowed_aws_eks_registry_root - macro: allowed_aws_eks_registry_root
condition: > condition: >
(container.image.repository startswith "602401143452.dkr.ecr") (container.image.repository startswith "602401143452.dkr.ecr")
- macro: aws_eks_image - macro: aws_eks_image
condition: > condition: >
(allowed_aws_eks_registry_root and (allowed_aws_eks_registry_root and
(container.image.repository endswith ".amazonaws.com/amazon-k8s-cni" or (container.image.repository endswith ".amazonaws.com/amazon-k8s-cni" or
container.image.repository endswith ".amazonaws.com/eks/kube-proxy")) container.image.repository endswith ".amazonaws.com/eks/kube-proxy"))
- macro: aws_eks_image_sensitive_mount - macro: aws_eks_image_sensitive_mount
condition: > condition: >
(allowed_aws_eks_registry_root and container.image.repository endswith ".amazonaws.com/amazon-k8s-cni") (allowed_aws_eks_registry_root and container.image.repository endswith ".amazonaws.com/amazon-k8s-cni")
# These images are allowed both to run with --privileged and to mount # These images are allowed both to run with --privileged and to mount