/*
 * If you use this configuration you may disable immutable capability
 * bit in default rule for all other executables.
 */

/usr/bin/chattr { 
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		immutable
	}
	
	exec deny all
}
