From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: audit 1.6.4 released Date: Sat, 29 Dec 2007 10:44:10 -0500 Message-ID: <200712291044.10368.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from vpn-248-42.boston.redhat.com (vpn-248-42.boston.redhat.com [10.13.248.42]) by mail.boston.redhat.com (8.13.1/8.13.1) with ESMTP id lBTFkpxL002154 for ; Sat, 29 Dec 2007 10:46:51 -0500 Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide soon. The Changelog is: - fchmod of log file was on wrong variable - Allow use of errno strings for exit codes in audit rules This release fixes a major bug that got introduced in the last release. The code that fixes a permission problem was using the wrong variable. It happens that the result was applied to /dev/null instead of the audit log. If you had selinux in enforcing mode - nothing happened, for everyone else.../dev/null probably got messed up. Oopsie. This release also lets you express audit rules with slightly more readable exits codes. This means you can now do things like: auditctl -a always,exit -S open -F exit=-EPERM Please let me know if you run across any problems with this release. -Steve