From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: audit-1.8 released Date: Thu, 27 Oct 2011 10:35:55 -0400 Message-ID: <201110271035.55535.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from x2.localnet (vpn-239-214.phx2.redhat.com [10.3.239.214]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p9REaZWr007311 for ; Thu, 27 Oct 2011 10:36:35 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com Hi, I've just released a new version of the (old) audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. The ChangeLog is: - Performance improvements for ausearch/report - Fix debug output resolving numeric address - Fix spelling error in audit.rules (#667845) - Improve warning in auditctl regarding immutable mode (#654883) - In ausearch, allow searching for auid -1 - Fix memory leak in aureport - Fix parsing state problem in libauparse - Update prelude support - Add new event types - Update syscall tables - On i386, audit rules do not work on inode's with a large number - Improve the robustness of libaudit field encoding functions - Add optional ARM processor support - Fix autrace to use correct syscalls on i386 systems (Peng Haitao) - In auparse, add ability to interpret session and capabilities - Add ability for audispd syslog plugin to choose facility local0-7 - Report server issues to remote client - Update ausearch parsing - Update auparse to handle virt events - Make audisp-remote robust - Add 2 error returns to python bindings - Update the man pages a little - Add some debug info to audidp-remote startup and shutdown - In auditd, if disk_error_action is ignore, limit syslog messages to 5 - Fix some memory leaks This does not even really capture all the updates to this branch. This is intended to be the final release of the 1.x series. This release backports everything I possibly can from trunk to the old daemon. With all these fixes, its a big update. Please test it if you use the 1.x series. Please let me know if you run across any problems with this release. -Steve