From 5b22b3dfef7fbdaffc8db764bfe712115ac1fae4 Mon Sep 17 00:00:00 2001
From: farshad-hobsons <fahad.arshad@hobsons.com>
Date: Wed, 9 Oct 2019 15:39:50 -0400
Subject: [PATCH] [stable/falco]: Restrict access to /dev on underlying host to
 (#17841)

Signed-off-by: Fahad Arshad <fahad.arshad@hobsons.com>
---
 stable/falco/CHANGELOG.md             | 6 ++++++
 stable/falco/Chart.yaml               | 2 +-
 stable/falco/templates/daemonset.yaml | 1 +
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md
index 52b192f367..8007d2efcd 100644
--- a/stable/falco/CHANGELOG.md
+++ b/stable/falco/CHANGELOG.md
@@ -3,6 +3,12 @@
 This file documents all notable changes to Sysdig Falco Helm Chart. The release
 numbering uses [semantic versioning](http://semver.org).
 
+## v1.0.9
+
+### Minor Changes
+
+* Restrict the access to `/dev` on underlying host to read only
+
 ## v1.0.8
 
 ### Minor Changes
diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml
index 8b09c77203..ee38cc563b 100644
--- a/stable/falco/Chart.yaml
+++ b/stable/falco/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: falco
-version: 1.0.8
+version: 1.0.9
 appVersion: 0.17.1
 description: Falco
 keywords:
diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml
index 8f40c60409..bfe22e948a 100644
--- a/stable/falco/templates/daemonset.yaml
+++ b/stable/falco/templates/daemonset.yaml
@@ -90,6 +90,7 @@ spec:
             {{- end}}
             - mountPath: /host/dev
               name: dev-fs
+              readOnly: true
             - mountPath: /host/proc
               name: proc-fs
               readOnly: true