From 823c105f548bcc7ef436c9905ec8bda7e9bf8898 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Fri, 29 Sep 2017 15:12:20 -0700
Subject: [PATCH] Let systemd-udevd spawn shells

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index e684c7cd..68236a34 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -625,7 +625,7 @@
     landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
     npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
     serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
-    timeout, updatedb.findut, mysql_ssl_rsa_s, adclient
+    timeout, updatedb.findut, mysql_ssl_rsa_s, adclient, systemd-udevd
     ]
 
 - rule: Run shell untrusted