audit 1.0.15 released

Hi,

I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit The srpm is aimed at FC-4. A slightly different srpm is required for RHEL4.
The Changelog is:

- Correct address resolving of hostname in logging functions
- Fix logging messages to use addr if passed
- Add TRUSTED_APP message type
- Fix netlink errno return
- Auditd ignore most signals
- Add audit dispatcher interface to auditd
- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834)
- Cleanup file descriptor handling in auditd
- Improve time handling in ausearch and aureport (#191394)
- Attempt to reconstruct full path from relative for searching
- Ausearch & aureport now fail if no args to -te
- In aureport, add class between syscall and permission in avc report
- Fix bug where fsync is called in debug mode
- ausearch & aureport implement uid/gid caching
- In ausearch & aureport, extract addr when hostname is unknown
- In ausearch & aureport, test audit log presence O_RDONLY
- Updated man pages (#213328, #213330)

Please let me if there are any issues with this.

-Steve

In order to get the tarball mentioned below to compile for RHEL4u3, I had to modify the SPEC file to allow glibc-kernheaders >= 2.6.9.1.94, whereas before it was an exact match only. RHEL4u3 ships with 2.6.9.1.98, and I hoped the changes between -94 and -98 were minor. All I've done to this point is compile the package. I ran out of time to actually perform any tests.

Thanks for posting this. Hopefully it passes the final wickets at RedHat without a lot of grief.

Charlie Todd
Ball Aerospace & Technologies Corp.

-----Original Message-----
From: [email protected] on behalf of Steve Grubb
Sent: Tue 11/14/2006 5:01 PM
To: Linux Audit Discussion
Subject: audit 1.0.15 released

Hi,

I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit The srpm is aimed at FC-4. A slightly different srpm is required for RHEL4.
The Changelog is:

- Correct address resolving of hostname in logging functions
- Fix logging messages to use addr if passed
- Add TRUSTED_APP message type
- Fix netlink errno return
- Auditd ignore most signals
- Add audit dispatcher interface to auditd
- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834)
- Cleanup file descriptor handling in auditd
- Improve time handling in ausearch and aureport (#191394)
- Attempt to reconstruct full path from relative for searching
- Ausearch & aureport now fail if no args to -te
- In aureport, add class between syscall and permission in avc report
- Fix bug where fsync is called in debug mode
- ausearch & aureport implement uid/gid caching
- In ausearch & aureport, extract addr when hostname is unknown
- In ausearch & aureport, test audit log presence O_RDONLY
- Updated man pages (#213328, #213330)

Please let me if there are any issues with this.

-Steve

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

What I'd suggest is taking the RHEL4 audit 1.0.14 srpm and changing the version number to 1.0.15 and then rebuilding. There are differences between FC4 and RHEL4 spec files.

I'm seeing a couple things, so probably -2 file will be final.

-Steve