From 87fd4aba70b2a19ad954655bd72562327422c4b0 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 26 Oct 2017 14:17:39 -0700
Subject: [PATCH] Let mesos-journald-(logger) spawn shells

---
 rules/falco_rules.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index dbf2d70f..36fbf673 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -138,7 +138,9 @@
 # Utility/etc programs known to run on mesos slaves. Truncation
 # intentional.
 - list: mesos_slave_binaries
-  items: [mesos-health-ch, mesos-docker-ex, mesos-agent, mesos-slave, mesos-logrotate, mesos-fetcher, mesos-executor, 3dt]
+  items: [mesos-health-ch, mesos-docker-ex, mesos-agent, mesos-slave,
+          mesos-logrotate, mesos-fetcher, mesos-executor, 3dt,
+          mesos-journald-]
 
 - list: phusion_passenger_binaries
   items: [PassengerAgent, PassengerWatchd]