Snitch should not mount entire host rootfs

[DelusionalOptimist]

Feature Request

Short Description
KubeArmor snitch currently mounts the entire rootfs of the host - ref

Describe the solution you'd like

We should specify the host path volume mounts at a more granular level. For example:

• For detecting container runtimes /var/run should be enough
• For apparmor profiles /etc/apparmor.d should be enough

and so on...

We may use older KubeArmor daemonset for reference on the same.

[rksharma95]

/var/run, /run to detect container runtime
/sys/kernel/ for btf, securityfs
/sys/module/apparmor/parameters/enabled ref: https://kubernetes.io/docs/tutorials/security/apparmor/#before-you-begin
/var/lib/kubelet/seccomp for seccomp

[Utkar5hM]

I would like to work on this.