On Wednesday 23 May 2007 15:04, Paul Whitney wrote: > -a exit,possible -S chmod -F success=0 -F success!=0 > -a exit,possible -S fchmod -F success=0 -F success!=0
-a exit,always -S chmod -S fchmod -F success=0 You can combine the syscalls into 1 rule. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
