From 234026e14ba5357748f310bb36367676914af9c1 Mon Sep 17 00:00:00 2001 From: vin01 Date: Mon, 14 Nov 2022 22:16:24 +0100 Subject: [PATCH] rule(macro rpm_procs): let salt-call write to rpm database Signed-off-by: vin01 --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 208e70fd..009ce67c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -220,7 +220,7 @@ items: [probe_rpminfo, probe_rpmverify, probe_rpmverifyfile, probe_rpmverifypackage] - macro: rpm_procs - condition: (proc.name in (rpm_binaries, openscap_rpm_binaries) or proc.name in (salt-minion)) + condition: (proc.name in (rpm_binaries, openscap_rpm_binaries) or proc.name in (salt-call, salt-minion)) - list: deb_binaries items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,