Closed stevegrubb closed 7 years ago
This is a duplicate of https://github.com/linux-audit/audit-kernel/issues/35
This is a duplicate of #35
I made mention of @stevegrubb's request in #35, so lets close this out and continue to track this RFE in #35.
This event should be a simple record with the following fields: pid, uid, auid, tty, session, context, comm, exe (in this order) + old value + new value if applicable.