audit-3.1 released

audit-3.1 released

[Steve Grubb]

Hello,

I've just released a new version of the audit daemon. It can be
downloaded from http://people.redhat.com/sgrubb/audit. It will also be
in rawhide soon. The ChangeLog is:

- Disable ProtectControlGroups in auditd.service by default
- Fix rule checking for exclude filter
- Make audit_rule_syscallbyname_data work correctly outside of auditctl
- Add new record types
- Add io_uring support
- Add support for new FANOTIFY record fields
- Add keyword, this-hour, to ausearch/report start/end options
- Add Requires.private to audit.pc file
- Try to interpret OPENAT2 fields correctly

ProtectControlGroups in auditd.service was preventing people from placing 
rules on /proc, so it's now off by default. The checks on the exclude filter 
were not matching the checks that kernel does. The checks were updated. 
io_uring support was added as was support for translating the new fields in 
the FANOTIFY record. The interpretation of the mode field in the OPENAT2 
record was broken because it was expected to be in hex format like everywhere 
else, but instead it is decimal. That should be corrected.

SHA256: b5cf3cdabb2786c08b1de3599a3b1a547e55f7a9f9c1eb2078f5b44cf44e8378

Please let me know if you run across any problems with this release.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit