From 54d4d9ed4e74cee7fe4aa898ec3bcc503073f997 Mon Sep 17 00:00:00 2001
From: Pierre-Gronau-ndaal
 <72132223+Pierre-Gronau-ndaal@users.noreply.github.com>
Date: Wed, 21 Feb 2024 06:22:35 +0100
Subject: [PATCH] Update audit.rules lz4

---
 audit.rules | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/audit.rules b/audit.rules
index 41b7e22..d0446c3 100644
--- a/audit.rules
+++ b/audit.rules
@@ -387,8 +387,11 @@
 -w /usr/bin/lzip -p x -k Data_Compressed
 -w /usr/local/bin/lzip -p x -k Data_Compressed
 
--w /usr/bin/lz4 -p x -k Data_Compressed
--w /usr/local/bin/lz4 -p x -k Data_Compressed
+-a always,exit -F arch=b32 -F path=/usr/bin/lz4 -F perm=x -F key=Data_Compressed
+-a always,exit -F arch=b64 -F path=/usr/bin/lz4 -F perm=x -F key=Data_Compressed
+
+-a always,exit -F arch=b32 -F path=/usr/local/bin/lz4 -F perm=x -F key=Data_Compressed
+-a always,exit -F arch=b64 -F path=/usr/local/bin/lz4 -F perm=x -F key=Data_Compressed
 
 -w /usr/bin/lzop -p x -k Data_Compressed
 -w /usr/local/bin/lzop -p x -k Data_Compressed