Order of action and filter

[wland32]

auditd/audit.rules

Line 117 in da8d66d

-a exit,always -F arch=b32 -S mknod -S mknodat -k specialfiles

Why it the order of action and filter in this line "-a exit,always" and not "-a always,exit" like all the other lines have?

This line
https://github.com/Neo23x0/auditd/blob/master/audit.rules#L90
also seems to have a reverse order.

Is this intentional?

[Neo23x0]

Oh my .. no. Somehow I've missed this issue in 2019. I'll fix that.

[kovacs-andras]

It really doesn't matter because augenrules will make an -a always,exit from it anyways.
But I also prefer the same way as augenrules makes it because it's easier to read.