type:EXECVE a0:chattr* a1:\-i*