From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: audit 2.4.5 released
Date: Fri, 18 Dec 2015 14:49:25 -0500 [thread overview]
Message-ID: <1929164.Q9DeV9IFDj@x2> (raw)
Hello,
I've just released a new version of the audit daemon. It can be downloaded
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:
- Fix auditd disk flushing for data and sync modes
- Fix auditctl to not show options not supported on older OS
- Add audit.m4 file to aid adding support to other projects
- Fix C99 inline function build issue
- Add account lock and unlock event types
- Change logging loophole check to geteuid()
- Fix ausearch to not consider AUDIT_PROCTITLE events malformed (Burn Alting)
- Fix ausearch to parse FEATURE_CHANGE events
This release fixes disk flushing to work as it was intended. If you use either
the data or sync mode, you might notice a performance change.
This release also fixes a build issue when using a new compiler.
The loophole that we allow for a process to continue when it should fail was
changed to use the euid rather than the uid. This should be more correct based
on the capabilities man page.
Ausearch was having problems parsing AUDIT_PROCTITLE and FEATURE_CHANGE
events. This was cleaned up and now passed the ausearch-test test suite.
This release will also be the beginning point of a new branch, audit-2.4, that
will be lightly maintained for a while. At this point I don't think there will
be a 2.4.6 release, but you never know.
Going forward to the 2.5 release, I would like to make a lot of changes to the
rules and break them up into small ones that can be assembled by augenrules. I
will also restructure a few of the directories and get things ready to start
doing more with the data format. The audit by process name patch will be
applied real soon since a kernel with that work should be landing soon.
Please let me know if you run across any problems with this release.
-Steve
next reply other threads:[~2015-12-18 19:49 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-18 19:49 Steve Grubb [this message]
2015-12-18 21:08 ` audit 2.4.5 released Paul Moore
2015-12-18 21:20 ` Steve Grubb
2015-12-18 23:32 ` Paul Moore
2016-01-01 5:41 ` Burn Alting
2016-01-02 17:27 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1929164.Q9DeV9IFDj@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).