From 9c2fead5fc21931a0e49debeab2b33f568cac2a3 Mon Sep 17 00:00:00 2001
From: Mark Bolwell <mark.bollyuk@gmail.com>
Date: Mon, 25 Jul 2022 16:41:57 +0100
Subject: [PATCH] updated rule

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
---
 templates/audit/98_auditd_exception.rules.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/audit/98_auditd_exception.rules.j2 b/templates/audit/98_auditd_exception.rules.j2
index 4bc8909..a453f3b 100644
--- a/templates/audit/98_auditd_exception.rules.j2
+++ b/templates/audit/98_auditd_exception.rules.j2
@@ -3,6 +3,6 @@
 # This file contains users whose actions are not logged by auditd
 {% if allow_auditd_uid_user_exclusions %} 
 {% for user in rhel9cis_auditd_uid_exclude %}
--F uid!={{ user }}
+-a never,user -F uid!={{ user }} -F auid!={{ user }}
 {% endfor %}
 {% endif %}
\ No newline at end of file