From 6aa2373acd7d936047aabf079df280b52747d46c Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 24 Aug 2017 14:14:11 -0700
Subject: [PATCH] More x-related shell spawners

Add additional x-related shell spawning programs.
---
 rules/falco_rules.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 253c7458..15d32bdc 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -738,7 +738,8 @@
                            nomachine_binaries,
                            monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
                            erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
-                           runsv, supervisord, varnishd, crond, logrotate, x2goagent, timeout, tini)
+                           runsv, supervisord, varnishd, crond, logrotate, x2goagent, timeout, tini,
+                           xrdb, xfce4-session)
     and not trusted_containers
     and not shell_spawning_containers
     and not parent_java_running_echo