Current File : //usr/share/audit/sample-rules/70-einval.rules
## These are rules are to locate poorly written programs.
## Its never planned to waste time on a syscall with incorrect parameters
## This is more of a debugging step than something people should run with
## in production.
-a never,exit -F arch=b64 -S rt_sigreturn
-a always,exit -S all -F exit=-EINVAL -F key=einval-retcode
Mr. DellatioNx196 GaLers xh3LL Backd00r 1.0, Coded By Mr. DellatioNx196 - Bogor BlackHat