exclude's effect with multiple rules

[Michael C Thompson]

Hey all,

So if I have the following two rules, what should be expected behaviour?

auditctl -a entry,always -S chmod
auditctl -a exclude,always -S all

... Assume we can change the ordering.

Thanks,
Mike