Re: -F perm in audit rules
On Tuesday, September 8, 2020 7:02:01 PM EDT Gabriel Alford wrote:
Hello,
By default, does auditd audit read, write, execute, and attribute in audit
rules or do you need to specify
-F perm=wxra ?
For example,
-a always,exit -F path=/usr/bin/at -F perm=wrxa
vs
-a always,exit -F path=/usr/bin/at
They are equivalent. Specifying -F perm= is so that you can fine tune what you
want instead of everything.
-Steve