On Tue, Jan 10, 2017 at 9:49 AM, Maupertuis Philippe <philippe.maupertuis@equensworldline.com> wrote:

Hello list,

On my fedora 24 with audit-2.6.7-1.fc24.x86_64, the man auditctl list :

exe Absolute path to application that while executing this rule will apply to. This can only be used on the exit list.

On my RHEL7.3 with audit-2.6.5-3.el7.x86_64 the option is missing.

Reading the changelog at https://people.redhat.com/sgrubb/audit/ChangeLog, I couldn’t find in which version it was introduced.

Is this option available on 4.x kernel only ?

Is there any chance that the option finally arrive on RHEL 7 ?

See also https://access.redhat.com/solutions/2482361 which has a deep link to the relevant section of the RHEL7.3 release notes. As Steve mentioned, it didn't get added to the man page but that should be fixed in RHEL 7.4.