Which auditd for which kernel?

Which auditd for which kernel?

[Karl Katzke]

[-- Attachment #1.1: Type: text/plain, Size: 409 bytes --]

We¹re on another linux distro, where 2.6.26 is the name of the game, and the
changelog for auditd doesn¹t seem to specify what the required version of
the kernel is for which version of auditd.

What¹s the appropriate response? Step back to the 1.x arch of autid,
although I note that the redhat build is 1.7.18 and the changelog doesn¹t
seem to have been updated since 1.7.13?

Thanks,
Karl Katzke

[-- Attachment #1.2: Type: text/html, Size: 643 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Which auditd for which kernel?

[Steve Grubb]

On Monday, October 25, 2010 10:37:34 am Karl Katzke wrote:
> What¹s the appropriate response?

You can use either 1.7.18 or 2.0.5 on a 2.6.25 kernel. However, note that the 
audit code has been branched. The 1.7 branch is maintenance only, while active 
development and new features are on the 2.x branch.

> Step back to the 1.x arch of autid, although I note that the redhat build is
> 1.7.18 and the changelog doesn¹t seem to have been updated since 1.7.13?

There are 2 changelogs. One for the 2.x branch and one for the 1.8 branch. 
What you are seeing is the branch point where 2.x is progressing in its own 
way. The other changelog is here:

https://fedorahosted.org/audit/browser/branches/1.8/ChangeLog

-Steve

Re: Which auditd for which kernel?

[Steve Grubb]

On Monday, October 25, 2010 10:58:13 am Steve Grubb wrote:
> On Monday, October 25, 2010 10:37:34 am Karl Katzke wrote:
> > What¹s the appropriate response?
> 
> You can use either 1.7.18 or 2.0.5 on a 2.6.25 kernel. However, note that
> the audit code has been branched. The 1.7 branch is maintenance only,
> while active development and new features are on the 2.x branch.

Need to make a clarification here. I realized that there were some cleanups 
made to libaudit.h so that it would be more manageable going forward. I made 
the announcement with the release of 2.0, but forgot about it when answering 
your email:

https://www.redhat.com/archives/linux-audit/2009-August/msg00010.html

The short story is 2.0.x wants 2.6.29 or later. If you want to carry a patch, 
you can probably add back some necessary defines not provided by your kernel 
headers.

-Steve