# Copyright 2016 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# Monitor socket families, exclude AF_UNSPEC(0), AF_LOCAL(1), AF_INET(2),
# AF_INET6(10), AF_NETLINK(16) and AF_PACKET(17).
auditctl -a exit,always -F arch=b64 -S socket -F success=1 -F a0!=0 -F a0!=1 -F a0!=2 -F a0!=10 -F a0!=16 -F a0!=17 -k funky_socket

dont_exclude SYSCALL