update(falco_rules): disable three rules by default

[jasondellaluce]

What type of PR is this?

/kind cleanup

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

This sets three rules as disabled by default, each for a different reason:

• Contact EC2 Instance Metadata Service From Container: without custom overrides, the rule contains the unrolled condition container and not container, which means that the rule never triggers at default and just wastes evaluation time.
• Outbound Connection to C2 Servers: without custom overrides, the condition will require one of fd.sip and fd.sip.name to be contained in empty lists, which is impossible, meaning that the rule never triggers at default and just wastes evaluation time.
• Java Process Class File Download: This matches the recvfrom syscall, which is IO-related and performance-heavy. The recent Falco developments will automatically exclude those syscalls if the -A option is not used, which means that this rule will never trigger by default in the next Falco release.

Which issue(s) this PR fixes:

Special notes for your reviewer:

[poiana]

@jasondellaluce: The label(s) kind/cleanup, area/rules cannot be applied, because the repository doesn't have them.

In response to this:

What type of PR is this?

/kind cleanup

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

This sets three rules as disabled by default, each for a different reason:

• Contact EC2 Instance Metadata Service From Container: without custom overrides, the rule contains the unrolled condition container and not container, which means that the rule never triggers at default and just wastes evaluation time.
• Outbound Connection to C2 Servers: without custom overrides, the condition will require one of fd.sip and fd.sip.name to be contained in empty lists, which is impossible, meaning that the rule never triggers at default and just wastes evaluation time.
• Java Process Class File Download: This matches the recvfrom syscall, which is IO-related and performance-heavy. The recent Falco developments will automatically exclude those syscalls if the -A option is not used, which means that this rule will never trigger by default in the next Falco release.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[loresuso]

Sounds good!
/approve

[poiana]

LGTM label has been added.

Git tree hash: a337407533c1c469e8234845be1ede249f808c5a

[darryk10]

totally agree with this. users can enable those rules is specifically interested in the use case adding values to lists and changing macros.

[FedeDP]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: darryk10, FedeDP, jasondellaluce, loresuso

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment