From 332e3ad8747e06f6b811974915162ba9c347a409 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 26 Oct 2017 11:37:12 -0700
Subject: [PATCH] Let salt-minion spawn shells

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index af4c2e92..dbf2d70f 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -804,7 +804,7 @@
     luajit, uwsgi, cfn-signal, apache_control_, beam.smp, paster, postfix-local,
     nginx_control, mailmng-service, web_statistic_e, statistics_coll, install-info,
     hawkular-metric, rhsmcertd-worke, parted, amuled, fluentd, x2gormforward,
-    parallels_insta
+    parallels_insta, salt-minion
     ]
 
 - rule: Run shell untrusted