From 679faddd52469395a2b0ece8ab64c24cd67584ba Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@securityonionsolutions.com>
Date: Fri, 10 Sep 2021 13:44:37 -0400
Subject: [PATCH] Update so-rule-update to pass all args to docker exec

Instead of passing $1, build a string from all args and add that to the command string for the docker exec statement
---
 salt/common/tools/sbin/so-rule-update | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/salt/common/tools/sbin/so-rule-update b/salt/common/tools/sbin/so-rule-update
index 0fc691d36..a3c2616a4 100755
--- a/salt/common/tools/sbin/so-rule-update
+++ b/salt/common/tools/sbin/so-rule-update
@@ -2,6 +2,9 @@
 
 . /usr/sbin/so-common
 
+argstr=""
+for arg in "$@"; do
+    argstr="${argstr} \"${arg}\""
+done
 
-got_root
-docker exec so-idstools /bin/bash -c "cd /opt/so/idstools/etc && idstools-rulecat --force $1"
+docker exec so-idstools /bin/bash -c "cd /opt/so/idstools/etc && idstools-rulecat --force ${argstr}"