From e3ef7a2ed487948999d2d283b7a9b63b3070b674 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 9 Nov 2017 14:10:35 -0800
Subject: [PATCH] Be more flexible about perl Makefile.PL

Allow the command line to start with that command.
---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 2975ce82..3c0cf030 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -443,7 +443,7 @@
        proc.pcmdline startswith "node /opt/yarn/bin/yarn.js"))
 
 - macro: makefile_perl
-  condition: (proc.pcmdline="perl Makefile.PL")
+  condition: (proc.pcmdline startswith "perl Makefile.PL")
 
 - macro: parent_node_running_npm
   condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or