From e9e01779017d3cbb8613ccb4abe554e984ba1caa Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Mon, 6 Nov 2017 15:27:53 -0800 Subject: [PATCH] Add additional phusion cmdlines. --- rules/falco_rules.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 1683390c..6cf69ca4 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -504,7 +504,8 @@ - macro: run_by_passenger_agent condition: ((proc.pname=ruby and proc.aname[2]=PassengerAgent) or - proc.pcmdline startswith "ruby /usr/share/passenger/helper-scripts/rack-preloader.rb") + proc.pcmdline startswith "ruby /usr/share/passenger/helper-scripts/rack-preloader.rb" or + proc.pcmdline startswith "ruby /usr/local/bundle/bin/passenger") # Also handles running semi-indirectly via scl - macro: run_by_foreman