On Friday, October 25, 2013 11:53:47 AM leam hall wrote: > For audit.rules purposes, if the stig.rules from the repo audits on unlink, > does that cover rmdir? No. If you strace the rmdir command you will see what syscalls are involved. The rmdir syscall is involved. -Steev