linux-audit.redhat.com archive mirror
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: audit 2.4.5 released
Date: Fri, 18 Dec 2015 14:49:25 -0500	[thread overview]
Message-ID: <1929164.Q9DeV9IFDj@x2> (raw)

Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Fix auditd disk flushing for data and sync modes
- Fix auditctl to not show options not supported on older OS
- Add audit.m4 file to aid adding support to other projects
- Fix C99 inline function build issue
- Add account lock and unlock event types
- Change logging loophole check to geteuid()
- Fix ausearch to not consider AUDIT_PROCTITLE events malformed (Burn Alting)
- Fix ausearch to parse FEATURE_CHANGE events

This release fixes disk flushing to work as it was intended. If you use either 
the data or sync mode, you might notice a performance change.

This release also fixes a build issue when using a new compiler.

The loophole that we allow for a process to continue when it should fail was 
changed to use the euid rather than the uid. This should be more correct based 
on the capabilities man page.

Ausearch was having problems parsing AUDIT_PROCTITLE and  FEATURE_CHANGE 
events. This was cleaned up and now passed the ausearch-test test suite.

This release will also be the beginning point of a new branch, audit-2.4, that 
will be lightly maintained for a while. At this point I don't think there will 
be a 2.4.6 release, but you never know.

Going forward to the 2.5 release, I would like to make a lot of changes to the 
rules and break them up into small ones that can be assembled by augenrules. I 
will also restructure a few of the directories and get things ready to start 
doing more with the data format. The audit by process name patch will be 
applied real soon since a kernel with that work should be landing soon.

Please let me know if you run across any problems with this release.

-Steve

             reply	other threads:[~2015-12-18 19:49 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-12-18 19:49 Steve Grubb [this message]
2015-12-18 21:08 ` audit 2.4.5 released Paul Moore
2015-12-18 21:20   ` Steve Grubb
2015-12-18 23:32     ` Paul Moore
2016-01-01  5:41 ` Burn Alting
2016-01-02 17:27   ` Steve Grubb

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1929164.Q9DeV9IFDj@x2 \
    --to=sgrubb@redhat.com \
    --cc=linux-audit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).