Adds a rule that logs any write to or attribute change on /etc/passwd, tagging events with the key passwd_changes. The -w flag means watch, and -p wa selects write and attribute permissions. Find events later with ausearch -k passwd_changes.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.