From: Steve Grubb <sgrubb@redhat.com>
To: Linux Audit <linux-audit@redhat.com>
Subject: audit-3.1.1 released
Date: Thu, 27 Apr 2023 15:44:28 -0400 [thread overview]
Message-ID: <6001988.lOV4Wx5bFT@x2> (raw)
Hello,
I've just released a new version of the audit daemon. It can be
downloaded from http://people.redhat.com/sgrubb/audit. It will also be
in rawhide soon. The ChangeLog is:
- Add user friendly keywords for signals to auditctl
- In ausearch, parse up URINGOP and DM_CTRL records
- Harden auparse to better handle corrupt logs
- Fix a CFLAGS propogation problem in the common directory
- Move the audispd af_unix plugin to a standalone program
The most relevant thing to packagers is to know about the last item above.
Due to a timing race in the af_unix plugin, it was possible to get auditd to
not accept any more af_unix connections. You have to be root to connect, so
this is nothing a normal user could trigger. The fix was to pull the af_unix
plugin out of auditd to be a standalone program.
auditctl --signal can now use: stop, reload, rotate, resume, and state. This
can be used where people want to stop using the service command.
One last thing to mention, ausearch/auparse have been hardened to better deal
with corrupted logs.
SHA256: 46e46b37623cce09e6ee134e78d668afc34f4e1c870c853ef12e4193078cfe87
Please let me know if you run across any problems with this release.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
reply other threads:[~2023-04-27 19:44 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6001988.lOV4Wx5bFT@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.