From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: audit 2.7 released Date: Thu, 15 Dec 2016 22:22:24 -0500 Message-ID: <2763711.lXAhFyIeRV@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from x2.localnet (vpn-62-87.rdu2.redhat.com [10.10.62.87]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uBG3ML9m006369 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 15 Dec 2016 22:22:21 -0500 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Remove config file permission checks in auparse - Audisp-remote should detect normal socket close and mark remote_ended - Allow auditctl to list rules if no capabilities but root euid - In libaudit, use the last word of the syscall bit mask - In auditd, write_logs option was not correctly handled (#1382397) - In libaudit, allow filtering on new exclude filter fields (Richard Guy Briggs) - In auditd, fix looping when checking active connections - In auparse, the auparse_state_t pointer to keep escape_mode information - In libaudit, add support for rules using sessionid (Richard Guy Briggs) - Remove entry filter support - Add auparse_destroy_ext function - Improve ENRICHED logging format performance in auditd - Fix regex rule file matching in augenrules (#1396792) - Add numeric field/record accessors to auparse - Fix auditd freeing in middle of reply buffer when nolog is used - Switch auparse uid/gid cache to lru to limit growth - Prevent ausearch from clobbering type field on loginuid search - Add audit_get_session function to libaudit - Add session and uid to most audit events - Add auparse_classify code interface for subj, obj, action, results The main goal of this update is to land the auparse_classify interface to auparse. This will unlock many new capabilities in subsequent releases of the 2.7 series. If you are a programmer and do stuff with R or machine learning, let me know. This is aimed squarely at transforming data into knowledge. Aside from that, this fixes remote logging, and logging with the nolog and write_logs = no option, it allows audit rules on the new exclude filter fields and rules that use sessionid. The entry filter support has been dropped. It was deprecated a couple years ago. There are performance enhancements and correctness fixes. Please let me know if you run across any problems with this release. -Steve