From b4bd11bf7045dc0491aaa8e091a901e0086661d0 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 9 Nov 2017 14:16:52 -0800
Subject: [PATCH] Let nsrun spawn shells in containers.

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index bc5aa000..8be6f020 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -1143,7 +1143,7 @@
                            runsv, supervisord, varnishd, crond, logrotate, timeout, tini,
                            xrdb, xfce4-session, weave, logdna-agent, bundle, configure, luajit, nginx,
                            beam.smp, paster, postfix-local, hawkular-metric, fluentd, x2gormforward,
-                           '"[celeryd:"', flock)
+                           '"[celeryd:"', flock, nsrun)
     and not trusted_containers
     and not shell_spawning_containers
     and not parent_java_running_echo