Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?

When an application gets executed do all the specified syscalls have to be executed within a short time period of each other or at the same time or just be in the application?

If I wanted to fine tune my auditd rules to look for exploits, would I specify all the syscalls listed in the exploit?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.