Software >> OS >> Unix >> Linux >> RHEL >> 7 >> How to resolve error (-F missing operation for auid) when applying audit rules hardening




When running

auditctl -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod


Encounter the error

-F missing operation for auid

 

Enclose the operands that contain '>' within double quotes

auditctl -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F "auid>=1000" -F auid!=4294967295 -k perm_mod