audit-3.1.1 released

audit-3.1.1 released

[Steve Grubb]

Hello,

I've just released a new version of the audit daemon. It can be
downloaded from http://people.redhat.com/sgrubb/audit. It will also be
in rawhide soon. The ChangeLog is:

- Add user friendly keywords for signals to auditctl
- In ausearch, parse up URINGOP and DM_CTRL records
- Harden auparse to better handle corrupt logs
- Fix a CFLAGS propogation problem in the common directory
- Move the audispd af_unix plugin to a standalone program

The most relevant thing to packagers is to know about the last item above. 
Due to a timing race in the af_unix plugin, it was possible to get auditd to 
not accept any more af_unix connections. You have to be root to connect, so 
this is nothing a normal user could trigger. The fix was to pull the af_unix 
plugin out of auditd to be a standalone program.

auditctl --signal can now use: stop, reload, rotate, resume, and state. This 
can be used where people want to stop using the service command.

One last thing to mention, ausearch/auparse have been hardened to better deal 
with corrupted logs.

SHA256: 46e46b37623cce09e6ee134e78d668afc34f4e1c870c853ef12e4193078cfe87

Please let me know if you run across any problems with this release.

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit