Bad merge.

Should be a list not a macro.
falcosecurity · Jul 12, 2016 · 6204c9f · 6204c9f
1 parent 5f70ff4
commit 6204c9f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -129,8 +129,8 @@
 - macro: system_procs
   condition: proc.name in (coreutils_binaries, user_mgmt_binaries)
 
-- macro: mail_procs
-  condition: proc.name in (sendmail, sendmail-msp, postfix, procmail, exim4)
+- list: mail_binaries
+  items: [sendmail, sendmail-msp, postfix, procmail, exim4]
 
 - macro: sensitive_files
   condition: fd.name startswith /etc and (fd.name in (/etc/shadow, /etc/sudoers, /etc/pam.conf) or fd.directory in (/etc/sudoers.d, /etc/pam.d))