audit-2.0.4 released

audit-2.0.4 released

[Steve Grubb]

Hi,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide  
soon. The ChangeLog is:

- Make alpha processor support optional
- Add support for the arm eabi processor
- add a compatible regexp processing capability to auparse (Miloslav Trmač)
- Fix regression in parsing user space originating records in aureport
- Add tcp_max_per_addr option in auditd.conf to limit concurrent connections
- Rearrange shutdown of auditd to allow DAEMON_END event more time

This release drops support for the alpha processor unless you re-add "--with-
alpha" to the ./configure line. This release also adds support for the arm eabi 
processor when you add "--with-armeb" to the ./configure line. Please note that 
the 2.6.32 kernel does not actually work for auditing on ARM systems. 
Hopefully someone will write the 4-5 lines of code to make it work.

A new regexp processing capability was added to libauparse. And there were 
several bug fixes. The first was that I noticed on 2.0.x systems that use of 
authentication mechanisms was not showing up in aureport even though they were 
in the logs. The problem was traced to not applying a patch that corrected 
parsing with the slight format change in the 2.0.x series. A new config option 
was added to auditd.conf to set the maximum number of concurrent system 
connections. The default is 1 which should work for most installations. And 
lastly, the shutdown sequence was altered slightly to give remote logged audit 
events a little more time to get sent before the audit daemon starts 
terminating child processes.

Please let me know if you run across any problems with this release.

-Steve