Why doesn't chown produce an event
Greetings,
I have the following rule in audit.rules
-a exit,always -S chmod -S chown -S lchown -S fchown -F success!-1 -F key=mod
If I log in as a typical user and try "chown bob /etc/shadow" I don't get an
event produced, however if I try "chmod 666 /etc/shadow" I do.
What am I missing here?
Thanks!
Bob