Re: AUDIT Rules

Steve Grubb
2007-05-23T19:10:12Z

On Wednesday 23 May 2007 15:04, Paul Whitney wrote:
> -a exit,possible -S chmod -F success=0 -F success!=0
> -a exit,possible -S fchmod -F success=0 -F success!=0

-a exit,always -S chmod -S fchmod -F success=0

You can combine the syscalls into 1 rule.

-Steve