Add sensitive mount of mouting to /var/lib/kubelet*

falcosecurity · Nov 5, 2018 · 629b22a · 629b22a
1 parent f05ecf6
commit 629b22a
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -1387,6 +1387,7 @@
 - macro: sensitive_mount
   condition: (container.mount.dest[/proc*] != "N/A" or
               container.mount.dest[/var/run/docker.sock] != "N/A" or
+              container.mount.dest[/var/lib/kubelet*] != "N/A" or
               container.mount.dest[/] != "N/A" or
               container.mount.dest[/etc] != "N/A" or
               container.mount.dest[/root*] != "N/A")