<div dir="ltr">Hello,<div><br></div><div>By default, does auditd audit <span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px">read, write, execute, and attribute in audit rules or do you need to specify</span></div><div><span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px">-F perm=wxra ?</span></div><div><span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px"><br></span></div><div><span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px">For example,</span></div><div><span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px"><br></span></div><div>-a always,exit -F path=/usr/bin/at -F perm=wrxa<span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:14px"><br></span></div><div><br></div><div>vs</div><div><br></div><div>-a always,exit -F path=/usr/bin/at<br></div><div><br></div><div>Thanks and let me know if what I am asking doesn't make sense.</div><div><font color="#24292e" face="-apple-system, BlinkMacSystemFont, Segoe UI, Helvetica, Arial, sans-serif, Apple Color Emoji, Segoe UI Emoji"><span style="font-size:14px"><br clear="all"></span></font><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div><span>Gabriel Alford</span><span></span>
<p style="font-weight:normal;font-size:10px;margin:0px 0px 4px;text-transform:uppercase"><span>Member of the technical staff</span></p><p style="font-weight:normal;font-size:10px;margin:0px 0px 4px;text-transform:uppercase"><span>office of the chief technologist</span></p><p style="font-weight:normal;font-size:10px;margin:0px 0px 4px;text-transform:uppercase"><span>red hat Public Sector<br></span></p></div><p style="font-weight:normal;margin:0px;font-size:10px;color:rgb(153,153,153)"><a style="color:rgb(0,136,206);font-size:10px;margin:0px;text-decoration:none;font-family:"overpass",sans-serif" href="https://www.redhat.com" target="_blank">Red Hat <span><br><br></span></a></p>


<p style="font-weight:normal;margin:0px 0px 6px;font-size:10px;color:rgb(153,153,153)"><span style="margin:0px;padding:0px">
<a style="color:rgb(0,136,206);font-size:10px;margin:0px;text-decoration:none;font-family:"overpass",sans-serif" href="mailto:ralford@redhat.com" target="_blank">ralford@redhat.com</a>   </span>
<span>T: <a href="tel:650-254-4391" style="color:rgb(0,136,206);font-size:10px;margin:0px;text-decoration:none;font-family:"overpass",sans-serif" target="_blank">972-707-6483</a>     </span><span>M: <a href="tel:303-550-7234" style="color:rgb(0,136,206);font-size:11px;margin:0px;text-decoration:none;font-family:"overpass",sans-serif" target="_blank">303-550-7234</a>     </span>
</p>
<a href="https://red.ht/sig" target="_blank"> </a><a href="https://red.ht/sig" target="_blank"><img src="https://static.redhat.com/libs/redhat/brand-assets/latest/corp/logo.png" width="90" height="auto"></a></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>