audit 2.4.5 released

Steve Grubb sgrubb at redhat.com
Fri Dec 18 19:49:25 UTC 2015


Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Fix auditd disk flushing for data and sync modes
- Fix auditctl to not show options not supported on older OS
- Add audit.m4 file to aid adding support to other projects
- Fix C99 inline function build issue
- Add account lock and unlock event types
- Change logging loophole check to geteuid()
- Fix ausearch to not consider AUDIT_PROCTITLE events malformed (Burn Alting)
- Fix ausearch to parse FEATURE_CHANGE events

This release fixes disk flushing to work as it was intended. If you use either 
the data or sync mode, you might notice a performance change.

This release also fixes a build issue when using a new compiler.

The loophole that we allow for a process to continue when it should fail was 
changed to use the euid rather than the uid. This should be more correct based 
on the capabilities man page.

Ausearch was having problems parsing AUDIT_PROCTITLE and  FEATURE_CHANGE 
events. This was cleaned up and now passed the ausearch-test test suite.

This release will also be the beginning point of a new branch, audit-2.4, that 
will be lightly maintained for a while. At this point I don't think there will 
be a 2.4.6 release, but you never know.

Going forward to the 2.5 release, I would like to make a lot of changes to the 
rules and break them up into small ones that can be assembled by augenrules. I 
will also restructure a few of the directories and get things ready to start 
doing more with the data format. The audit by process name patch will be 
applied real soon since a kernel with that work should be landing soon.

Please let me know if you run across any problems with this release.

-Steve




More information about the Linux-audit mailing list