blob: 1f9bee05b9f27de4b6cf1c787ec921c36f978ec9 [file] [log] [blame]
# Copyright 2016 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Monitor socket families, exclude AF_UNSPEC(0), AF_LOCAL(1), AF_INET(2),
# AF_INET6(10), AF_NETLINK(16) and AF_PACKET(17).
auditctl -a exit,always -F arch=b64 -S socket -F success=1 -F a0!=0 -F a0!=1 -F a0!=2 -F a0!=10 -F a0!=16 -F a0!=17 -k funky_socket
dont_exclude SYSCALL