From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Which auditd for which kernel? Date: Tue, 26 Oct 2010 09:34:10 -0400 Message-ID: <201010260934.11189.sgrubb@redhat.com> References: <201010251058.14207.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <201010251058.14207.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Karl Katzke List-Id: linux-audit@redhat.com On Monday, October 25, 2010 10:58:13 am Steve Grubb wrote: > On Monday, October 25, 2010 10:37:34 am Karl Katzke wrote: > > What=B9s the appropriate response? > = > You can use either 1.7.18 or 2.0.5 on a 2.6.25 kernel. However, note that > the audit code has been branched. The 1.7 branch is maintenance only, > while active development and new features are on the 2.x branch. Need to make a clarification here. I realized that there were some cleanups = made to libaudit.h so that it would be more manageable going forward. I mad= e = the announcement with the release of 2.0, but forgot about it when answerin= g = your email: https://www.redhat.com/archives/linux-audit/2009-August/msg00010.html The short story is 2.0.x wants 2.6.29 or later. If you want to carry a patc= h, = you can probably add back some necessary defines not provided by your kerne= l = headers. -Steve