From de3ca31b15110ddd8db4e1b49a159b8413ffc066 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Wed, 12 Jul 2017 18:25:36 -0700
Subject: [PATCH] Allow certbot to spawn shells.

Part of let's encrypt.
---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 6e0c1efc..7e83cfac 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -483,7 +483,7 @@
     pyclean, py3clean, pip, pip2, ansible-playboo, man-db,
     init, pluto, mkinitramfs, unattended-upgr, watch, sysdig,
     landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
-    npm, cloud-init, toybox, ceph, hhvm
+    npm, cloud-init, toybox, ceph, hhvm, certbot
     ]
 
 - rule: Run shell untrusted