Added security capabilities, especially IPC_LOCK (#1671)

to Sniffer in case eBPF traffic capture mechanism is used.

helm-chart/templates/09-worker-daemon-set.yaml

@@ -155,6 +155,11 @@ spec:
                 {{ print "- " . }}
                 {{- end }}
                 {{- end }}
+                {{- if .Values.tap.capabilities.ebpfCapture }}
+                {{- range .Values.tap.capabilities.ebpfCapture }}
+                {{ print "- " . }}
+                {{- end }}
+                {{- end }}
               drop:
                 - ALL
           readinessProbe:

helm-chart/values.yaml

@@ -85,10 +85,6 @@ tap:
           filter: ""
           canDownloadPCAP: true
           canUseScripting: true
-          scriptingPermissions:
-            canSave: true
-            canActivate: true
-            canDelete: true
           canUpdateTargetedPods: true
           canStopTrafficCapturing: true
           showAdminConsoleLink: true
@@ -121,7 +117,6 @@ tap:
     - SYS_ADMIN
     - SYS_PTRACE
     - DAC_OVERRIDE
-    - IPC_LOCK
     ebpfCapture:
     - SYS_ADMIN
     - SYS_PTRACE
@@ -165,6 +160,7 @@ pcapdump:
   maxTime: 1h
   maxSize: 500MB
   pcapSrcDir: pcapdump
+  time: time
 kube:
   configPath: ""
   context: ""