Add needrestart to things run by pkg mgmt.

falcosecurity · Nov 27, 2017 · ead8662 · ead8662
1 parent e89dd01
commit ead8662
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -203,7 +203,7 @@
   condition: proc.name in (package_mgmt_binaries)
 
 - macro: run_by_package_mgmt_binaries
-  condition: proc.aname in (package_mgmt_binaries)
+  condition: proc.aname in (package_mgmt_binaries, needrestart)
 
 - list: ssl_mgmt_binaries
   items: [ca-certificates]