On Tuesday, September 8, 2020 7:02:01 PM EDT Gabriel Alford wrote: > Hello, > > By default, does auditd audit read, write, execute, and attribute in audit > rules or do you need to specify > -F perm=wxra ? > > For example, > > -a always,exit -F path=/usr/bin/at -F perm=wrxa > > vs > > -a always,exit -F path=/usr/bin/at
They are equivalent. Specifying -F perm= is so that you can fine tune what you want instead of everything. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
