audit 1.0.15 released

audit 1.0.15 released

[Steve Grubb]

Hi,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit  The srpm is aimed at FC-4. A 
slightly different srpm is required for RHEL4.
The Changelog is:

- Correct address resolving of hostname in logging functions
- Fix logging messages to use addr if passed
- Add TRUSTED_APP message type
- Fix netlink errno return
- Auditd ignore most signals
- Add audit dispatcher interface to auditd
- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834)
- Cleanup file descriptor handling in auditd
- Improve time handling in ausearch and aureport (#191394)
- Attempt to reconstruct full path from relative for searching
- Ausearch & aureport now fail if no args to -te
- In aureport, add class between syscall and permission in avc report
- Fix bug where fsync is called in debug mode
- ausearch & aureport implement uid/gid caching
- In ausearch & aureport, extract addr when hostname is unknown
- In ausearch & aureport, test audit log presence O_RDONLY
- Updated man pages (#213328, #213330)

Please let me if there are any issues with this.

-Steve

RE: audit 1.0.15 released

[Todd, Charles]

[-- Attachment #1.1: Type: text/plain, Size: 1982 bytes --]

In order to get the tarball mentioned below to compile for RHEL4u3, I had to modify the SPEC file to allow glibc-kernheaders >= 2.6.9.1.94, whereas before it was an exact match only.  RHEL4u3 ships with 2.6.9.1.98, and I hoped the changes between -94 and -98 were minor.  All I've done to this point is compile the package.  I ran out of time to actually perform any tests.

Thanks for posting this.  Hopefully it passes the final wickets at RedHat without a lot of grief.

Charlie Todd
Ball Aerospace & Technologies Corp.


-----Original Message-----
From: linux-audit-bounces@redhat.com on behalf of Steve Grubb
Sent: Tue 11/14/2006 5:01 PM
To: Linux Audit Discussion
Subject: audit 1.0.15 released
 
Hi,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit  The srpm is aimed at FC-4. A 
slightly different srpm is required for RHEL4.
The Changelog is:

- Correct address resolving of hostname in logging functions
- Fix logging messages to use addr if passed
- Add TRUSTED_APP message type
- Fix netlink errno return
- Auditd ignore most signals
- Add audit dispatcher interface to auditd
- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834)
- Cleanup file descriptor handling in auditd
- Improve time handling in ausearch and aureport (#191394)
- Attempt to reconstruct full path from relative for searching
- Ausearch & aureport now fail if no args to -te
- In aureport, add class between syscall and permission in avc report
- Fix bug where fsync is called in debug mode
- ausearch & aureport implement uid/gid caching
- In ausearch & aureport, extract addr when hostname is unknown
- In ausearch & aureport, test audit log presence O_RDONLY
- Updated man pages (#213328, #213330)

Please let me if there are any issues with this.

-Steve

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit



[-- Attachment #1.2: Type: text/html, Size: 2708 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: audit 1.0.15 released

[Steve Grubb]

On Friday 17 November 2006 23:00, Todd, Charles wrote:
> In order to get the tarball mentioned below to compile for RHEL4u3, I had
> to modify the SPEC file to allow glibc-kernheaders >= 2.6.9.1.94, whereas
> before it was an exact match only.  

What I'd suggest is taking the RHEL4 audit 1.0.14 srpm and changing the 
version number to 1.0.15 and then rebuilding. There are differences between 
FC4 and RHEL4 spec files.

> Thanks for posting this.  Hopefully it passes the final wickets at RedHat
> without a lot of grief.

I'm seeing a couple things, so probably -2 file will be final.

-Steve