Update audit.rules

fix: #125
Neo23x0 · Jan 9, 2024 · dfb7898 · dfb7898
1 parent 639bad5
commit dfb7898
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/audit.rules b/audit.rules
@@ -461,7 +461,7 @@
 
 ## Privilege Abuse
 ### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
--a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse
+-a always,exit -F dir=/home -F auid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse
 
 # Socket Creations
 # will catch both IPv4 and IPv6