audit 2.6 released

[Steve Grubb]

Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Auditd support for enriched data: uid/gid, saddr splitting, arch, syscall
- Make all libraries and utilities support and use enriched events
- Define dispatcher protocol to version 2
- Standardize all saddr interpretations in auparse
- Fix another DST bug in ausearch time conversion (#1334772)
- In autrace, if rule count loop times out don't assume 0 rules (#1344268)
- In auditd, check space left a little more often (#1345854)

This release of the audit package contains among other things a major new 
piece of functionality. The audit daemon can now enrich events with 
interpretation information at the time that the event is logged. This means 
that if a user account is deleted, the uid can still be resolved to what it 
was at the time of the event.

In terms of central log aggregation, this means that aggregated logs can have 
the uid mapping of the remote machine for interpretations. To enable this 
functionality, you would want to edit the log_format setting in auditd.conf 
and set it to ENRICHED. Restart the audit daemon and that's all there is to 
it.

When the enriched logging format is active, the event is completely formatted 
in the audit daemon and passed to audispd.  This means that you do not need to 
also set name_format in audispd.conf if you set it in auditd.conf.

If you write audispd plugins that want format set to binary, then you need to 
be aware that enriched events are set with version set to AUDISP_PROTOCOL_VER2 
to signify that the raw event is different and you might need to change what 
you are doing. If the plugin uses string, then feed the event to auparse like 
always and auparse will know what to do with it.

There is a change in interpretation for sockaddr fields. Now all the 
information about the source and destination are available.

There were three bug fixes.

Please let me know if you run across any problems with this release.

-Steve