diff --git a/KubeArmor/monitor/syscalls_arm64.go b/KubeArmor/monitor/syscalls_arm64.go index c19030386..4b5cc800a 100644 --- a/KubeArmor/monitor/syscalls_arm64.go +++ b/KubeArmor/monitor/syscalls_arm64.go @@ -63,7 +63,7 @@ const ( SocketConnect = 462 SocketAccept = 463 - Capable = 464 + Capable = 464 DropAlert = 0 ) diff --git a/deployments/get/objects.go b/deployments/get/objects.go index 102697604..7c21376c7 100644 --- a/deployments/get/objects.go +++ b/deployments/get/objects.go @@ -283,6 +283,11 @@ func GenerateDaemonSet(env, namespace string) *appsv1.DaemonSet { MountPath: "/media/root/etc/os-release", ReadOnly: true, }, + { + Name: "procfs-path", //BPF (read-only) + MountPath: "/proc", + ReadOnly: true, + }, } var volumes = []corev1.Volume{ @@ -328,6 +333,15 @@ func GenerateDaemonSet(env, namespace string) *appsv1.DaemonSet { }, }, }, + { + Name: "procfs-path", + VolumeSource: corev1.VolumeSource{ + HostPath: &corev1.HostPathVolumeSource{ + Path: "/proc", + Type: &hostPathDirectory, + }, + }, + }, } if env == "gke" { @@ -375,7 +389,7 @@ func GenerateDaemonSet(env, namespace string) *appsv1.DaemonSet { Operator: "Exists", }, }, - HostPID: true, + HostPID: false, HostNetwork: true, RestartPolicy: "Always", DNSPolicy: "ClusterFirstWithHostNet",