From e21fecf0efb97cbfd37289f33a3e2d80b974eda6 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Fri, 27 Jan 2017 09:03:25 -0800 Subject: [PATCH] Remove cchh image. We had added this image while the changes in https://github.com/draios/falco/pull/177 made it to everyone. This is in a release now, so we'll remove it from the rule set. --- rules/falco_rules.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 17735cff..be45867a 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -345,8 +345,7 @@ container.image startswith sysdig/falco or container.image startswith sysdig/sysdig or container.image startswith gcr.io/google_containers/hyperkube or - container.image startswith gcr.io/google_containers/kube-proxy or - container.image startswith cchh/sysdig) + container.image startswith gcr.io/google_containers/kube-proxy) - rule: File Open by Privileged Container desc: Any open by a privileged container. Exceptions are made for known trusted images.