From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: [PATCH 0/2] add support for more fields to the exclude filter Date: Wed, 1 Jun 2016 18:58:07 -0400 Message-ID: <1464821889-3109-1-git-send-email-rgb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com When support for avoiding in-band signals to indicate an unset loginuid was added to the kernel, userspace was neglected, so add them here as a prerequisite to enable their use in the exclude filter: See upstream kernel commits: 780a7654cee8d61819512385e778e4827db4bfbc 041d7b98ffe59c59fdd639931dea7d74f9aa9a59 The rest to support additional fields for the exclude filter is in the second patch. RFE: add additional fields for use in audit filter exclude rules https://github.com/linux-audit/audit-kernel/issues/5 Richard Guy Briggs (2): add support for loginuid_set using macro AUDIT_LOGINUID_SET exclude filter: add support for user filter fields docs/auditctl.8 | 2 +- lib/fieldtab.h | 2 ++ lib/libaudit.c | 21 ++++++++++++++++++--- 3 files changed, 21 insertions(+), 4 deletions(-)