Initial commit
[ta/infra-ansible.git] / roles / audit / templates / 35-umount.rules.j2
diff --git a/roles/audit/templates/35-umount.rules.j2 b/roles/audit/templates/35-umount.rules.j2
new file mode 100644 (file)
index 0000000..74e46cf
--- /dev/null
@@ -0,0 +1,4 @@
+## umount
+-a always,exit -F arch=b32 -S umount -F key=32bit_umount
+-a always,exit -F arch=b32 -S umount2 -F key=32bit_umount2
+-a always,exit -F arch=b64 -S umount2 -F key=64bit_umount2