audit 1.2.7 released

Amy Griffis amy.griffis at hp.com
Tue Sep 19 21:05:30 UTC 2006


Steve Grubb wrote:  [Mon Sep 18 2006, 08:13:40PM EDT]
> Please let me know if there are any problems with this release.

I'm seeing some truncated audit records, e.g.

type=DAEMON_END msg=audit(1158669003.740:6165) auditd normal halt,
sending auid=1001 pid=32268 subj=user_u:system_r:initrc_t:s0 res=suc

which should continue with something like

cess, auditd pid=6785

There are some static buffer sizes in auditd.c that look way too small
given that libselinux defines the max context size as

#define DEFAULT_CONTEXT_SIZE 255

I think this is an existing problem, and not new to 1.2.7.

Thanks,
Amy




More information about the Linux-audit mailing list