From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B95D5C433F5 for ; Fri, 1 Oct 2021 17:21:46 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 360B76126A for ; Fri, 1 Oct 2021 17:21:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 360B76126A Authentication-Results: mail.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1633108905; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=Abu24lHiO38iZ+e3bWTUMIrflHSq+OSN9FAnL9xYba8=; b=XIHXNElAwMWiHtcb90btnfY7RavQKdvzJBrHfSGk+fHMMcXd7w8Uhh4TsRIcFHjJikfBd8 CUm4RXZzC4nx3Mand9gKjCuRvaTCKa1u3HVy7Yn2kIIDkAZDwxnOoXTrqjNbdnQaPiZj6z tKmOApxXSJf5Vnv4jUyzfyx+9Fkslo8= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-97-hQghNI8ZOe6SdbqVpAIryA-1; Fri, 01 Oct 2021 13:21:43 -0400 X-MC-Unique: hQghNI8ZOe6SdbqVpAIryA-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id AD0D28145E5; Fri, 1 Oct 2021 17:21:39 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D214A5F4E1; Fri, 1 Oct 2021 17:21:38 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 910B74E58F; Fri, 1 Oct 2021 17:21:36 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 191HLYY8000308 for ; Fri, 1 Oct 2021 13:21:34 -0400 Received: by smtp.corp.redhat.com (Postfix) id 3D529100EBBE; Fri, 1 Oct 2021 17:21:34 +0000 (UTC) Received: from x2.localnet (unknown [10.22.17.206]) by smtp.corp.redhat.com (Postfix) with ESMTP id 066C81002EF0 for ; Fri, 1 Oct 2021 17:21:29 +0000 (UTC) From: Steve Grubb To: Linux Audit Subject: audit-3.0.6 released Date: Fri, 01 Oct 2021 13:21:28 -0400 Message-ID: <1709058.VLH7GnMWUR@x2> Organization: Red Hat MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 191HLYY8000308 X-loop: linux-audit@redhat.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Fixed various issues when dealing with corrupted logs - Make IPX packet interpretation dependent on the ipx header file existing - Add b32/b64 support to ausyscall (Egor Ignatov) - Add support for armv8l (Egor Ignatov) - Fix auditctl list of syscalls in PPC (Egor Ignatov) - auditd.service now restarts auditd under some conditions (Timoth=E9e Ravi= er) The main driver for this release is that there are a scattering of bug=20 reports of segfaults on the previous release. The auparse library has been= =20 documented for years to fabricate 2 non-existing fields, seresult and seper= m.=20 Somehow, seresult was added to SELINUX_ERR over the years and this was not= =20 noticed. So, when auparse is done with an event and is cleaning up, it thin= ks=20 it owns the seresult field and frees it. On the SELINUX_ERR record, it's a= =20 real field that can't be freed and that leads to the segfault. The code doi= ng=20 cleanup was refactored to not make the decision based on the field's name. = The=20 resulting code should be slightly faster. SHA256: c3e44d77513a42401d417dd0ceb203cf23886cb89402dea7b9494faa3f4fcc5e Please let me know if you run across any problems with this release. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit