From 5755e79fe9405f8288af04e67645ea96293357eb Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Tue, 7 Nov 2017 11:03:04 -0800
Subject: [PATCH] Let polkit-agent-he(lper) read sensitive files.

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 389d4ed7..472d17b0 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -722,7 +722,7 @@
   items: [
     iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,
     vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,
-    pam-auth-update, /usr/sbin/spamd
+    pam-auth-update, /usr/sbin/spamd, polkit-agent-he
     ]
 
 # Add conditions to this macro (probably in a separate file,