From: Steve Grubb <sgrubb@redhat.com>
To: Linux Audit <linux-audit@redhat.com>
Subject: audit-3.1 released
Date: Thu, 09 Feb 2023 11:40:12 -0500 [thread overview]
Message-ID: <5997264.lOV4Wx5bFT@x2> (raw)
Hello,
I've just released a new version of the audit daemon. It can be
downloaded from http://people.redhat.com/sgrubb/audit. It will also be
in rawhide soon. The ChangeLog is:
- Disable ProtectControlGroups in auditd.service by default
- Fix rule checking for exclude filter
- Make audit_rule_syscallbyname_data work correctly outside of auditctl
- Add new record types
- Add io_uring support
- Add support for new FANOTIFY record fields
- Add keyword, this-hour, to ausearch/report start/end options
- Add Requires.private to audit.pc file
- Try to interpret OPENAT2 fields correctly
ProtectControlGroups in auditd.service was preventing people from placing
rules on /proc, so it's now off by default. The checks on the exclude filter
were not matching the checks that kernel does. The checks were updated.
io_uring support was added as was support for translating the new fields in
the FANOTIFY record. The interpretation of the mode field in the OPENAT2
record was broken because it was expected to be in hex format like everywhere
else, but instead it is decimal. That should be corrected.
SHA256: b5cf3cdabb2786c08b1de3599a3b1a547e55f7a9f9c1eb2078f5b44cf44e8378
Please let me know if you run across any problems with this release.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
reply other threads:[~2023-02-09 16:51 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5997264.lOV4Wx5bFT@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).