From c736a843a0d64dd2b7b777e51cc3593d501a0b9c Mon Sep 17 00:00:00 2001 From: Hiroki Suezawa Date: Sun, 1 Dec 2019 23:44:14 +0900 Subject: [PATCH] rule update: Add kubelet to user_known_chmod_applications list Signed-off-by: Hiroki Suezawa --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 72140308..c632cd4a 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2436,7 +2436,7 @@ condition: (always_true) - list: user_known_chmod_applications - items: [hyperkube] + items: [hyperkube, kubelet] - rule: Set Setuid or Setgid bit desc: >