On Oct 25, 2016 05:12, "teroz" <<a href="mailto:terence.namusonge@gmail.com">terence.namusonge@gmail.com</a>> wrote: > > I used one of the dirtycow root exploits on Fedora24 configured with 30-pci-dss-v31.rules. I was expecting an ANOM_ROOT_TRANS record but didn't get one. What triggers an ANOM_ROOT_TRANS record? What then is the best way to trivially audit for a successful privilege escalation? > I would imagine that if it's hijacking an already root or setuid binary, you won't see anything. As far as that record goes, I have no idea, I'll let an auditing expert answer that question. > > > > > -- > Linux-audit mailing list > <a href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/linux-audit">https://www.redhat.com/mailman/listinfo/linux-audit</a>