Ubuntu 22.04 This test makes sure that /etc/audit/rules.d/ has mode 0600. If the target file or directory has an extended ACL, then it will fail the mode check. /etc/audit/rules.d ^.*rules$ exclude_symlinks__etc_audit_rulesd state_file_permissions_etc_audit_rulesd_0_mode_0600or_stricter_ false false false false false false false false false false symbolic link