Mark Stemm 33793d233b Rule(Disallowed K8s User): quote colons ...

It turns out if you read this rules file with falco versions 0.24.0 and
earlier, it can't parse the bare string containing colons:

(Ignore the misleading error context, that's a different problem):

```
Thu Sep 10 10:31:23 2020: Falco initialized with configuration file
/etc/falco/falco.yaml
Thu Sep 10 10:31:23 2020: Loading rules from file
/tmp/k8s_audit_rules.yaml:
Thu Sep 10 10:31:23 2020: Runtime error: found unexpected ':'
---
  source: k8s_audit
    tags: [k8s]
    # In a local/user rules file, you could override this macro to
```

I think the change in 0.25.0 to use a bundled libyaml fixed the problem,
as it also upgraded libyaml to a version that fixed
https://github.com/yaml/libyaml/pull/104.

Work around the problem with earlier falco releases by quoting the colon.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2020-09-23 17:48:36 +02:00

..

application_rules.yaml

update: license headers

2019-10-08 16:02:26 +02:00

CMakeLists.txt

build(rules): fix rules etc dir

2020-09-10 15:01:07 +02:00

falco_rules.local.yaml

update: license headers

2019-10-08 16:02:26 +02:00

falco_rules.yaml

rule(Delete or rename shell history):skip dockerfs

2020-09-23 17:48:36 +02:00

k8s_audit_rules.yaml

Rule(Disallowed K8s User): quote colons

2020-09-23 17:48:36 +02:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00