Merge pull request #67 from ansible-lockdown/staging_pr66

Update rule in ubtu18cis_4_1_15_actions.rules.j2
ansible-lockdown · Jan 18, 2022 · 4126c16 · 4126c16
2 parents 354261a + db0dc3d
commit 4126c16
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/templates/audit/ubtu18cis_4_1_15_actions.rules.j2 b/templates/audit/ubtu18cis_4_1_15_actions.rules.j2
@@ -1,5 +1,5 @@
--a always,exit -F arch=b32 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=4294967295 -S execve -k actions
+-a always,exit -F arch=b32 -C euid!=uid -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k actions
 {% if ansible_architecture == 'x86_64' -%}
--a always,exit -F arch=b64 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=4294967295 -S execve -k actions
+-a always,exit -F arch=b64 -C euid!=uid -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k actions
 {% endif %}