I am little confused by the relationship between audit rules.
I want to log all other users command history and read/write passwd except me (auid 16382)
However, it seems I have to add -F auid!=16382 on both rules.
-a always,exit -F arch=b32 -S execve -k EXEC_log
-w /etc/passwd -p wr -k identity_write
I tried to add following rules "before" the two rules above.
-a never,exit -F auid=16382
However, it does not work at all.
So, the rules in audit rules seem independent from each other. Am I right?