Mark Stemm c6169e1aaa Rule updates 2018 11.v1 (#455) ...

* Add sensitive mount of mouting to /var/lib/kubelet*

* Fix GKE/Istio false positives

- Allow kubectl to write below /root/.kube
- Allow loopback/bridge (e.g. /home/kubernetes/bin/) to setns.
- Let istio pilot-agent write to /etc/istio.
- Let google_accounts(_daemon) write user .ssh files.
- Add /health as an allowed file below /.

This fixes https://github.com/falcosecurity/falco/issues/439.

* Improve ufw/cloud-init exceptions

Tie them to both the program and the file being written.

Also move the cloud-init exception to monitored_directory.

2018-11-09 11:51:15 -08:00

..

application_rules.yaml

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

CMakeLists.txt

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

falco_rules.local.yaml

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

falco_rules.yaml

Rule updates 2018 11.v1 (#455)

2018-11-09 11:51:15 -08:00

k8s_audit_rules.yaml

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00