Ignore sensitive mounts from ecs-agent

[fcoelho]

/kind rule-update
/area rules

What this PR does / why we need it:

Without this, as ecs-agent starts we get a bunch of errors that look
like this (reformatted for readability):

Notice Container with sensitive mount started (
  user=root
  command=init -- /agent ecs-agent (id=19d4e98bb0dc)
  image=amazon/amazon-ecs-agent:latest
  mounts=/proc:/host/proc:ro:false:rprivate,$lotsofthings
)

ecs-agent needs those to work properly, so this can cause lots of false
positives when starting a new instance.

Special notes for your reviewer:

This can be reproduced on ami ami-0da6ab8acebc7f9db in region sa-east-1 or any Amazon Linux 2 ECS-optimized ami (name pattern like amzn2-ami-ecs-hvm-*-x86_64-ebs)

Installed falco using the following commands:

rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public
curl -s -o /etc/yum.repos.d/draios.repo https://s3.amazonaws.com/download.draios.com/stable/rpm/draios.repo
yum -y install kernel-devel-$(uname -r)
yum -y install falco

Does this PR introduce a user-facing change?:

rules: ignore sensitive mounts from the ecs-agent

[poiana]

Welcome @fcoelho! It looks like this is your first PR to falcosecurity/falco 🎉

[leodido]

Looks good (it works as intended!) but can be probably engineered better (not creating a macro but using the macro already in place for such goal).

[poiana]

LGTM label has been added.

Git tree hash: 131dbeedc25777b322fff4856e6a6cb7b913205b

[fntlnz]

Hi @fcoelho - good catch, thanks for finding it! I tested this on ECS and can totally reproduce.

However can you please use the falco_sensitive_mount_images list instead? Just add the image in there and you get the same result, we have it for this purpose!

[fcoelho]

@fntlnz Just pushed that change instead, tested locally and seems to do the job too

[Kaizhe]

/lgtm

[poiana]

LGTM label has been added.

Git tree hash: 6794aa1789e08b29ef62dc4103ba5128cafece35

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kaizhe, leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [Kaizhe,leodido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment