-##- Unauthorized access attempts to files (unsuccessful)
--a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F key=access
--a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F key=access
--a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F key=access
--a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F key=access
+##- Unauthorized access attempts to files (unsuccessful)
+-a always,exit -F arch=b64 {{ S_creat }} {{ S_open }} -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F key=access
+-a always,exit -F arch=b32 {{ S_creat }} {{ S_open }} -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F key=access
+-a always,exit -F arch=b64 {{ S_creat }} {{ S_open }} -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F key=access
+-a always,exit -F arch=b32 {{ S_creat }} {{ S_open }} -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F key=access