audit 1.0.4 released

Steve Grubb sgrubb at redhat.com
Fri Sep 23 17:04:01 UTC 2005


On Friday 23 September 2005 12:39, Marcus Meissner wrote:
> You forgot to mention that a user program can actually crash auditd with
> it.

It can't crash auditd. I didn't forget to mention it. To my knowledge, 
anything related to this isn't publicly known. :)

> Or was it the pam module?

It was a combination of programs that are only available under un-updated FC4. 
As of audit 0.9.3 and later, the buffers were big enough that pam couldn't 
cause problems anymore. The fix I added is just to ensure that if any 3rd 
party apps are created that use audit_send_user_message, that they are 
protected.

-Steve




More information about the Linux-audit mailing list