jcloude/press/playbooks/roles/auditd/templates/priv_commands.rules.j2

{% for proc in priv_procs.stdout_lines -%}
-a always,exit -F path={{ proc }} -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

{% endfor %}