From a68d2ad769a17c43ae46b84ab244f1f19c1a8ae5 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 5 Oct 2017 08:44:13 -0700
Subject: [PATCH] Let bundle spawn shells.

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index ac9e9759..7ddb872f 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -813,7 +813,7 @@
                            monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
                            erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
                            runsv, supervisord, varnishd, crond, logrotate, timeout, tini,
-                           xrdb, xfce4-session, weave, mysql_ssl_rsa_s, logdna-agent)
+                           xrdb, xfce4-session, weave, mysql_ssl_rsa_s, logdna-agent, bundle)
     and not trusted_containers
     and not shell_spawning_containers
     and not parent_java_running_echo