From 82377348ce46015b92b0202d9588aef3dbb833cd Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Tue, 7 Nov 2017 11:00:43 -0800
Subject: [PATCH] Add another way to run npm

This one seen on redhat installs
---
 rules/falco_rules.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 495a175c..15250ae3 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -444,7 +444,8 @@
   condition: (proc.pcmdline="perl Makefile.PL")
 
 - macro: parent_node_running_npm
-  condition: proc.pcmdline startswith "node /usr/local/bin/npm"
+  condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or
+              proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm")
 
 - macro: parent_nginx_running_serf
   condition: (proc.pname=nginx and proc.cmdline startswith "sh -c serf")