rpms/audit
7
0
Fork 0
Code Issues Pull Requests Releases Activity
31f6a34b35
audit/.cvsignore

77 lines
1.4 KiB
Plaintext
Raw Normal View History

- New version - Add R option to auditctl to allow reading rules from file. - Do not allow task creation list to have syscall auditing - Add D option to allow deleting all rules with 1 command - Added pam_audit man page & sample.rules - Mod initscript to call auditctl to load rules at start-up - Write message to log file for daemon start up - Write message that daemon is shutting down - Modify auditd shutdown to wait until logger thread is finished - Add sample rule file to docs
2005-02-11 19:22:21 +00:00
audit-0.5.tar.gz
audit-0.6.2.tar.gz
Moved the tar.gz files into the lookaside cache. Please refrain from checking tar.gz files into CVS. That is what the lookaside cache is for.
2004-12-12 21:35:14 +00:00
audit-0.5.5.tar.gz
- Change pam install from /lib/security to /%{_lib}/security - Change pam_audit to write loginuid to /proc/pid/loginuid - Add pam_session_close handle - Update to newest kernel headers
2005-02-20 20:33:50 +00:00
audit-0.6.3.tar.gz
- Rename pam_audit to pam_loginuid to reflect what it does - Fix bug in detecting space left on partition - Fix bug in handling of suspended logging
2005-02-23 23:24:19 +00:00
audit-0.6.4.tar.gz
- Lots of code cleanups - Added write_pid function to auditd - Added audit_log to libaudit - Don't check file length in foreground mode of auditd - Added *if_enabled functions to send messages only if audit system is enabled - If syscall name is unknown when printing rules, use the syscall number - Rework the build system to produce singly threaded public libraries - Create a multithreaded version of libaudit for the audit daemon's use
2005-03-03 22:48:44 +00:00
audit-0.6.5.tar.gz
- Fix audit_set_pid to try to read a reply, but its non-fatal if no reply. - Remove the read status during init - Change to using pthreads sync mechanism for stopping system - Worker thread should ignore all signals - Change main loop to use select for inbound event handling - Gave pam_loginuid a "failok" option for testing
2005-03-08 20:46:48 +00:00
audit-0.6.6.tar.gz
- Fixed bug setting loginuid - Added num_logs to configure number of logs when rotating - Added code for rotating logs
2005-03-09 23:50:13 +00:00
audit-0.6.7.tar.gz
- removed the pam_loginuid library - its going to pam
2005-03-14 21:08:53 +00:00
audit-0.6.8.tar.gz
- Added patch for filesystem watch - Added version information to audit start message - Change netlink code to use ack in order to get error notification
2005-03-17 22:58:02 +00:00
audit-0.6.9.tar.gz
- Code cleanups - Support the arch field for auditctl - Add version to auditctl - Documentation updates - Moved default location of the audit log to /var/log/audit
2005-04-01 19:10:36 +00:00
audit-0.6.10.tar.gz
- Check log file size on start up - Added priority_boost config item - Reworked arch support - Reworked how run level is changed - Make allowances for ECONNREFUSED
2005-04-18 20:25:36 +00:00
audit-0.6.11.tar.gz
- Fixed bug where elf type wasn't being set when given numerically - Added autrace program (similar to strace) - Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted
2005-04-20 21:33:07 +00:00
audit-0.6.12.tar.gz
- In auditctl -l, loop until all rules are printed - Update autrace not to run if rules are currently loaded - Added code to switch to single user mode when disk is full - Added the ausearch program
2005-04-23 21:15:11 +00:00
audit-0.7.tar.gz
- Make sure time calc is done using localtime - Raise rlimits for file size & cpu usage - Added new disk_error_action config item to auditd.conf - Rework memory management of event buffer - Handled all errors in event logging thread
2005-04-24 21:35:29 +00:00
audit-0.7.1.tar.gz
- Allow ausearch uid & gid to be non-numeric (root, wheel, etc) - Fix problems with changing run level - Added new code for logging shutdown reason credentials - Update DAEMON messages to use better timestamp
2005-04-29 20:43:43 +00:00
audit-0.7.2.tar.gz
- Add code to get watch list to auditctl - Get -f & -hn working in ausearch - Added search by terminal, exe, and syscall to ausearch program - Added -w parameter to match whole word in ausearch
2005-05-03 16:39:50 +00:00
audit-0.7.3.tar.gz
- Make sure ausearch ts & te obey DST. - Code cleanups to make file system watches work correctly
2005-05-08 21:26:43 +00:00
audit-0.7.4.tar.gz
- Fix code to "or" uid & gid checks for ausearch -ua & -ga - Change msg() to audit_msg() to avoid conflicts - Parse socket messages for hostname in ausearch
2005-05-17 21:44:01 +00:00
audit-0.8.1.tar.gz
- Update documentation - Handle user space audit events in more uniform way - Update all parsers for more robustness with new kernel changes - Create quiet mode for error messages - Make rotated logs readonly
2005-05-20 22:25:36 +00:00
audit-0.8.2.tar.gz
New version
2005-06-02 19:43:35 +00:00
audit-0.9.2.tar.gz
new version
2005-06-09 17:32:52 +00:00
audit-0.9.3.tar.gz
- Rule and watch insert no longer automatically dumps list - auditctl rules can now use auid instead of loginuid - Add sighup support for daemon reconfiguration - Move some functions into private.h
2005-06-11 16:57:00 +00:00
audit-0.9.4.tar.gz
- interpret socketcall & ipc based on a0 in ausearch - change call sequence to make user space messages faster - update return val for auditctl
2005-06-14 20:58:59 +00:00
audit-0.9.5.tar.gz
reworked some files
2005-06-16 14:26:02 +00:00
audit-0.9.6.tar.gz
- fixed bug in send_user_message which errored on pam logins - Change nanosleeps over to select loops - Change the 'e' option to auditctl -p to 'x'
2005-06-16 21:27:57 +00:00
audit-0.9.7.tar.gz
- Added support for FS_INODE and USYS_CONFIG records - More cleanup of user space message functions
2005-06-17 22:00:10 +00:00
audit-0.9.8.tar.gz
- Fix user messages for people with older kernels
2005-06-19 19:55:50 +00:00
audit-0.9.9.tar.gz
- Make sure the bad packet is drained when retrying user messages - Add support for new user and watch filter lists - Interpret flags field in ausearch
2005-06-20 22:47:50 +00:00
audit-0.9.10.tar.gz
- Change packet draining to nonblocking - Interpret id field in ausearch - Add error message if not able to create log - Ignore netlink acks when asking for rule & watch list
2005-06-21 20:37:11 +00:00
audit-0.9.11.tar.gz
- Add some syslog messages for a couple exits - Add some unlinks of the pid file in a couple error exits - Make some options of auditctl not expect a reply - Update support for user and watch filter lists
2005-06-22 20:48:06 +00:00
audit-0.9.12.tar.gz
- Remove /lib/libaudit.so & .la from audit-libs package - In auditctl, if syscall not given, default to all
2005-06-23 21:40:32 +00:00
audit-0.9.13.tar.gz
- make auditctl -s work again - make AUDITD_CLEAN_STOP test in init scripts case insensitive
2005-06-24 21:04:10 +00:00
audit-0.9.14.tar.gz
- Update log rotation handling to be more robust
2005-06-28 22:16:42 +00:00
audit-0.9.15.tar.gz
- Adjust umask - Adjust length of strings for file system watches to not include NUL - Remove extra error message from audit_send
2005-07-07 15:59:43 +00:00
audit-0.9.16.tar.gz
- Fix ausearch buffers to hold long filenames - Make a0 long long for 64 bit kernels & 32 bit ausearch.
2005-07-12 14:21:29 +00:00
audit-0.9.17.tar.gz
- auditd message formatter use MAX_AUDIT_MESSAGE_LENGTH to prevent clipping
2005-07-14 13:27:33 +00:00
audit-0.9.18.tar.gz
- ausearch remove debug code
2005-07-14 20:25:26 +00:00
audit-0.9.19.tar.gz
- Fix ausearch to handle no audit log better - Fix auditctl blank line handling - Trim trailing '/' from file system watches in auditctl - Catch cases where parameter was passed without option being given to auditctl - Add CAPP sample configuration
2005-07-29 18:11:51 +00:00
audit-0.9.20.tar.gz
- Update sample CAPP config - Remove warning for trimming file path in auditctl - Make auditctl tolerate duplicate rule and watches - auditd has new option so it doesn't overwrite log files - Fixed bug in autrace that was reporting bad descriptor
2005-08-02 22:20:04 +00:00
audit-1.0.tar.gz
- Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches
2005-08-03 17:40:29 +00:00
audit-1.0.1.tar.gz
- Make sure error packets get eaten. - Fix a few error messages in auditctl - Fix handling of unsupported watches when reading rules from file in auditctl
2005-08-08 22:17:06 +00:00
audit-1.0.2.tar.gz
- adjust file perms of newly created log file in auditd - fix 2 memory leaks and an out of bounds access in auditd - fix case where auditd was closing netlink descriptor too early - fix watch rules not to take field arguments in auditctl - fix bug where inode, devmajor, devminor, exit, and success fields in auditctl rules were not getting the correct value stored
2005-08-22 21:40:25 +00:00
audit-1.0.3.tar.gz
- Make rate & backlog 32 bit unsigned int in auditctl - In auditctl, if -F arch is given with -t option, don't require list - Update auditd man page - Add size check to audit_send - Update message for audit_open failure when kernel doesn't support audit
2005-09-23 15:15:49 +00:00
audit-1.0.4.tar.gz
- ausearch can now search on SE Linux contexts - added aureport program to analyse logs - aureport added report option for each log's start and end time - increased random number selected for initial seq number in auditd - add new user space defines to libaudit.h - add add standard logging functions to libaudit
2005-10-04 22:04:36 +00:00
audit-1.0.5.tar.gz
- in aureport, add column labels to reports - added watch report to aureport - added interpreting mode to aureport - added user space avc standard message to libaudit - aureport & ausearch now use builtin log locations when bad config file - add email alert to low disk space warning actions in auditd
2005-10-10 21:56:42 +00:00
audit-1.0.6.tar.gz
- Update reports - Add new message types - Bug fixes
2005-10-19 20:12:04 +00:00
audit-1.0.7.tar.gz
- Update man pages - Add email alert for admin_space_left in auditd - Aureport cleanups - Add anomaly & response to anomaly reports to aureport - Summary report runs by default in aureport - Updated syscall number tables
2005-10-24 19:01:56 +00:00
audit-1.0.8.tar.gz
- Updated message types that auditd recognizes - Added a couple more message types - Added new standard logging format function - Update default config - Make ausearch -m take a list of message types
2005-11-02 22:55:27 +00:00
audit-1.0.9.tar.gz
- Add --failed/success flags to aureport to select specific events for reports - Add --summary to get totals of reported objects - Add ability to force log rotation by sending sigusr1 to auditd - Add -i flag to auditctl to ignore errors when reading rules from a file - Reformat aureports so date & time are always given - Add cron script for log rotation to docs
2005-11-04 19:37:26 +00:00
audit-1.0.10.tar.gz
- Add 2 more summary reports - Add 2 more message types
2005-11-07 22:58:52 +00:00
audit-1.0.12.tar.gz
- Add initial version of audisp. Just a placeholder at this point - Remove -t from auditctl
2005-11-09 22:48:47 +00:00
audit-1.1.tar.gz
- Add support for alpha processors - Update the audisp code - Add locale code in ausearch and aureport - Add new rule operator patch - Add exclude filter patch - Cleanup make files - Add python bindings
2005-11-30 22:08:32 +00:00
audit-1.1.1.tar.gz
- Add more message types
2005-12-05 23:10:00 +00:00
audit-1.1.2.tar.gz
- Add timestamp to daemon_config messages (#174865) - Add error checking of year for aureport & ausearh - Treat af_unix sockets as files for searching and reporting - Update capp & lspp rules to combine syscalls for higher performance - Adjusted the chkconfig line for auditd to start a little earlier - Added skeleton program to docs for people to write their own dispatcher with - Apply patch from Ulrich Drepper that optimizes resource utilization - Change ausearch and aureport to unlocked IO
2006-01-05 23:37:48 +00:00
audit-1.1.3.tar.gz
- Fix bug in autrace where it didn't run on kernels without file watch support - Add syslog message to auditd saying what program was started for dispatcher - Remove audit_send_user from public api - Fix bug in USER_LOGIN messages where ausearch does not translate msg='uid=500: into acct name (#178102). - Change comm with dispatcher to socketpair from pipe - Change auditd to use custom daemonize to avoid race in init scripts - Update error message when deleting a rule that doesn't exist (#176239) - Call shutdown_dispatcher when auditd stops - Add new logging function audit_log_semanage_message
2006-02-08 23:08:01 +00:00
audit-1.1.4.tar.gz
- Changed audit_log_semanage_message to take new params - In aureport, add class between syscall and permission in avc report - Fix bug where fsync is called in debug mode - Add optional support for tty in SYSCALL records for ausearch/aureport - Reinstate legacy rule operator support - Add man pages - Auditd ignore most signals
2006-03-06 22:18:21 +00:00
audit-1.1.5.tar.gz
- New message types - Support new rule format found in 2.6.17 and later kernels - Add support for audit by role, clearance, type, sensitivity
2006-04-07 01:33:11 +00:00
audit-1.1.6.tar.gz
- Add support for new file system auditing kernel subsystem
2006-04-07 21:06:18 +00:00
audit-1.2.tar.gz
- New message type for trusted apps - Add new keywords today, yesterday, now for ausearch and aureport - Make audit_log_user_avc_message really send to syslog on error - Updated syscall tables in auditctl - Deprecated the 'possible' action for syscall rules in auditctl - Update watch code to use file syscalls instead of 'all' in auditctl
2006-04-16 20:33:48 +00:00
audit-1.2.1.tar.gz
- Updates for new glibc-kernheaders - Change auditctl to collect list of rules then delete them on -D - Update capp.rules and lspp.rules to comment out rules for the possible list - Add new message types - Support sigusr1 sender identity of newer kernels - Add support for ppid in auditctl and ausearch - fix auditctl to trim the '/' from watches - Move audit daemon config files to /etc/audit for better SE Linux protection
2006-05-12 21:04:25 +00:00
audit-1.2.2.tar.gz
- Apply patch to ensure watches only associate with exit filter - Apply patch to correctly show new operators when new listing format is used - Apply patch to pull kernel's audit.h into python bindings - Collect signal sender's context
2006-05-25 16:22:33 +00:00
audit-1.2.3.tar.gz
- Add support for the new filter key - Update syscall tables for 2.6.17 - Add audit failure query function - Switch out gethostbyname call with getaddrinfo - Add audit by obj capability for 2.6.18 kernel - Ausearch & aureport now fail if no args to -te - New auditd.conf option to choose blocking/non-blocking dispatcher comm - Ausearch improved search by label
2006-06-30 20:30:02 +00:00
audit-1.2.4.tar.gz
- Switch out dispatcher - Fix bug upgrading rule types
2006-07-13 20:38:11 +00:00
audit-1.2.5.tar.gz
- Apply updates to dispatcher - Fix a couple bugs regarding MLS labels - Resurrect -p option - Tighten rules with exclude filter - Fix parsing issue which lead to segfault in some cases - Fix option parsing to ignore malformed lines
2006-08-26 19:57:03 +00:00
audit-1.2.6.tar.gz
- Fix logging messages to use addr if passed. - Apply patches from Tony Jones correcting no kernel support messages - Updated syscall tables for 2.6.18 kernel - Remove deprecated functions: audit_log, audit_log_avc, audit_log_if_enabled - Disallow syscall auditing on exclude list - Improve time handling in ausearch and aureport (#191394) - Attempt to reconstruct full path from relative for searching
2006-09-19 00:04:08 +00:00
audit-1.2.7.tar.gz
- Add dist tag and bump version (#208532) - Make internal auditd buffers bigger for context info - Correct address resolving of hostname in logging functions - Do not allow multiple msgtypes in same audit rule in auditctl (#207666) - Only =, != operators for arch & inode fields in auditctl (#206427) - Updated audit message type table - Remove watches from aureport since FS_WATCH is deprecated - Add audit_log_avc back temporarily (#208152)
2006-09-29 20:48:53 +00:00
audit-1.2.8.tar.gz
- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834) - Fix some defines in libaudit.h - Some auditd config strings were not initialized in aureport (#211443) - Updated man pages - Add Netlabel event types to libaudit - Update aureports to current audit event types - Update autrace a little - Deprecated all the old audit_rule functions from public API - Drop auparse library for the moment
2006-10-24 18:16:19 +00:00
audit-1.2.9.tar.gz
- ausearch & aureport implement uid/gid caching - In ausearch & aureport, extract addr when hostname is unknown - In ausearch & aureport, test audit log presence O_RDONLY - New ausearch/aureport time keywords: recent, this-week, this-month, this-year - Added --add & --delete option to aureport - Update res parsing in config change events - Increase the size on audit daemon buffers - Parse avc_path records in ausearch/aureport - ausearch has new output mode, raw, for extracting events - ausearch/aureport can now read stdin - Rework AVC processing in ausearch/aureport - Added long options to ausearch and aureport
2006-11-28 22:34:26 +00:00
audit-1.3.tar.gz
- Fix a couple parsing problems (#217952) - Add tgkill to S390* syscall tables (#218484) - Fix error messages in ausearch/aureport
2006-12-10 22:51:00 +00:00
audit-1.3.1.tar.gz
- New report about authentication attempts - Updates for python 2.5 - update autrace to have resource usage mode - update auditctl to support immutable config - added audit_log_user_command function to libaudit api - interpret capabilities - added audit event parsing library - updates for 2.6.20 kernel
2007-02-04 22:11:48 +00:00
audit-1.4.tar.gz
- updated audit_rule_fieldpair_data to handle perm correctly (#226780) - Finished search options for audit parsing library - Fix ausearch -se to work correctly - Fix auditd init script for /usr on netdev (#228528) - Parse avc seperms better when there are more than one
2007-02-16 22:20:43 +00:00
audit-1.4.1.tar.gz
- Add man pages - Reduce text relocations in parser library - Add -n option to auditd for no fork - Add exec option to space_left, admin_space_left, disk_full, and disk_error - eg EXEC /usr/local/script
2007-02-21 00:11:20 +00:00
audit-1.4.2.tar.gz
- NEW audit dispatcher program & plugin framework
2007-02-21 02:43:37 +00:00
audit-1.5.tar.gz
- Updated autrace to monitor *at syscalls - Add support in libaudit for AUDIT_BIT_TEST(^) and AUDIT_MASK_TEST (&) - Finish reworking auditd config parser - In auparse, interpret open, fcntl, and clone flags - In auparse, when interpreting execve record types, run args through unencode - Add support for OBJ_PID message type - Event dispatcher updates
2007-03-20 16:34:48 +00:00
audit-1.5.1.tar.gz
- New event dispatcher (James Antill) - Apply patches fixing man pages and Makefile.am (Philipp Hahn) - Apply patch correcting python libs permissions (Philipp Hahn) - Fix auditd segfault on reload - Fix bug in auparse library for file pointers and descriptors - Extract subject information out of daemon events for ausearch
2007-04-05 22:44:18 +00:00
audit-1.5.2.tar.gz
Reference in New Issue Copy Permalink