Linux-audit Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: audit 2.7.8 released
Date: Mon, 18 Sep 2017 14:31:04 -0400	[thread overview]
Message-ID: <27889481.qdMS4ukpkm@x2> (raw)

Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Add config option to auditd to not verify email addr domain (#1406887)
- When auditd forwards events to disptcher, calculate protocol each event
- In auditd, restore umask after creating log file (Avi Yeger)
- Add a realpath interpretation function that resolves whole path in auparse
- In audispd, strip out EOE events for syslog plugin
- In python 2 bindings, fix AUSOURCE_FILE_POINTER to use new FILE * (#1475998)
- In python bindings, check NULL return for auparse_get_type_name (#1482121)
- Make auparse more robust against misuse of the API (#1482121)
- Add USER_DEVICE record type
- In auditd, do not use '?' for auid when signal sender is unknown
- In ausearch, write checkpoint inode in decimal to be easier to use
- In auparse-normalizer, correct attr's collected for mount object

This update fixes a number of bugs reported through bugzilla. There was a 
problem doing aggregated logging when in a mixed environment. This has been 
corrected to calculate the protocol being used on a per event basis. A 
realpath resolving option has been added to auparse. This does require root 
privileges to fully use. In audispd, strip out EOE events for syslog plugin. 
Fixed an issue where auparse python biindings was causing a crash when a FILE 
* was passed to auparse_init. Another python binding bug was fixed where it 
was not checking the returned string of auparse_get_type_name() for NULL. And 
some code cleanups were done.

SHA256: 57b5ae5697f288b8e53286eacd1c6c2e88bd65db18df3d855332fc63b302fdae

Please let me know if you run across any problems with this release.

-Steve

             reply	other threads:[~2017-09-18 18:31 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-18 18:31 Steve Grubb [this message]
2017-09-19 12:34 ` audit 2.7.8 released Ryan Sawhill

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=27889481.qdMS4ukpkm@x2 \
    --to=sgrubb@redhat.com \
    --cc=linux-audit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox