Re: audit 2.5 released

This release adds audit by executable name support if your kernel also supports it. The audit by executable names support will allow you to write rules that target an exact application so that you can see if it is doing something odd. An example rule would look like this: -a always,exit -F arch=x86_64 -S connect,sendto -F exe=/bin/sh -F key=bash- network I think you will need the 4.4 kernel or later to use this feature.