Greetings, I have the following rule in audit.rules
-a exit,always -S chmod -S chown -S lchown -S fchown -F success!-1 -F key=modIf I log in as a typical user and try "chown bob /etc/shadow" I don't get an event produced, however if I try "chmod 666 /etc/shadow" I do.
What am I missing here? Thanks! Bob -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
