rpms/audit
7
0
Fork 0
Code Issues Pull Requests Releases Activity
121 Commits 7 Branches 32 Tags 564 KiB
2ae90f4803
Commit Graph

121 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Steve Grubb
50ab79e79f - ausearch can now search on SE Linux contexts 
- added aureport program to analyse logs
- aureport added report option for each log's start and end time
- increased random number selected for initial seq number in auditd
- add new user space defines to libaudit.h
- add add standard logging functions to libaudit
 2005-10-04 22:04:36 +00:00
Steve Grubb
9e3c7f913a - Rebuilt 2005-09-23 16:20:14 +00:00
Steve Grubb
38342f3405 - Make rate & backlog 32 bit unsigned int in auditctl 
- In auditctl, if -F arch is given with -t option, don't require list
- Update auditd man page
- Add size check to audit_send
- Update message for audit_open failure when kernel doesn't support audit
 2005-09-23 15:15:49 +00:00
Steve Grubb
0978c5b99c New version 2005-08-22 22:47:16 +00:00
Steve Grubb
ec62b1c24d - adjust file perms of newly created log file in auditd 
- fix 2 memory leaks and an out of bounds access in auditd
- fix case where auditd was closing netlink descriptor too early
- fix watch rules not to take field arguments in auditctl
- fix bug where inode, devmajor, devminor, exit, and success fields in
    auditctl rules were not getting the correct value stored
 2005-08-22 21:40:25 +00:00
Steve Grubb
31e817f7dd - Make sure error packets get eaten. 
- Fix a few error messages in auditctl
- Fix handling of unsupported watches when reading rules from file in
    auditctl
 2005-08-08 22:17:06 +00:00
Steve Grubb
286db4872e make adjustments for kern headers 2005-08-03 20:54:08 +00:00
Steve Grubb
0c36f408f1 - Add check for fields that cannot be used with syscall entry in auditctl 
- Make auditctl not tolerate duplicate rule and watches
 2005-08-03 17:40:29 +00:00
Steve Grubb
832892f1d5 fixed problem for new glibc kernheaders 2005-08-03 17:39:11 +00:00
Steve Grubb
79576eb6ce - Add check for fields that cannot be used with syscall entry in auditctl 
- Make auditctl not tolerate duplicate rule and watches
 2005-08-03 17:07:01 +00:00
Steve Grubb
29fca9932c - Update sample CAPP config 
- Remove warning for trimming file path in auditctl
- Make auditctl tolerate duplicate rule and watches
- auditd has new option so it doesn't overwrite log files
- Fixed bug in autrace that was reporting bad descriptor
 2005-08-02 22:20:04 +00:00
Steve Grubb
217f8fcd4b - Fix ausearch to handle no audit log better 
- Fix auditctl blank line handling
- Trim trailing '/' from file system watches in auditctl
- Catch cases where parameter was passed without option being given to
    auditctl
- Add CAPP sample configuration
 2005-07-29 18:11:51 +00:00
Tomáš Mráz
f9356bfa57 - make /usr/lib/libaudit.so point at the right file 2005-07-18 14:56:29 +00:00
Steve Grubb
cc23a33c90 - ausearch remove debug code 2005-07-14 20:25:26 +00:00
Steve Grubb
1be66fe6b3 - auditd message formatter use MAX_AUDIT_MESSAGE_LENGTH to prevent clipping 2005-07-14 13:27:33 +00:00
Steve Grubb
7c06330e80 - Fix ausearch buffers to hold long filenames 
- Make a0 long long for 64 bit kernels & 32 bit ausearch.
 2005-07-12 14:21:29 +00:00
Steve Grubb
7dfa20a5da - Adjust umask 
- Adjust length of strings for file system watches to not include NUL
- Remove extra error message from audit_send
 2005-07-07 15:59:43 +00:00
Steve Grubb
3fa19caed5 - Update log rotation handling to be more robust 2005-06-28 22:16:42 +00:00
Steve Grubb
7e2f162d05 - make auditctl -s work again 
- make AUDITD_CLEAN_STOP test in init scripts case insensitive
 2005-06-24 21:04:10 +00:00
Steve Grubb
64cb26697f - Remove /lib/libaudit.so & .la from audit-libs package 
- In auditctl, if syscall not given, default to all
 2005-06-23 21:40:32 +00:00
Steve Grubb
812847b7d0 - Add some syslog messages for a couple exits 
- Add some unlinks of the pid file in a couple error exits
- Make some options of auditctl not expect a reply
- Update support for user and watch filter lists
 2005-06-22 20:48:06 +00:00
Steve Grubb
7956d88af6 - Change packet draining to nonblocking 
- Interpret id field in ausearch
- Add error message if not able to create log
- Ignore netlink acks when asking for rule & watch list
 2005-06-21 20:37:11 +00:00
Steve Grubb
5a02a7c51a - Make sure the bad packet is drained when retrying user messages 
- Add support for new user and watch filter lists
- Interpret flags field in ausearch
 2005-06-20 22:47:50 +00:00
Steve Grubb
1deb784224 - Fix user messages for people with older kernels 2005-06-19 19:55:50 +00:00
Steve Grubb
b87507cf6a - Added support for FS_INODE and USYS_CONFIG records 
- More cleanup of user space message functions
 2005-06-17 22:00:10 +00:00
Steve Grubb
34e0a77920 - fixed bug in send_user_message which errored on pam logins 
- Change nanosleeps over to select loops
- Change the 'e' option to auditctl -p to 'x'
 2005-06-16 21:27:57 +00:00
Steve Grubb
f36e94743a reworked some files 2005-06-16 14:26:02 +00:00
Steve Grubb
a2197e2837 - fix bug in incremental flush where is wrongly reported an error 
- ausearch should not do uid check for -if option
- adjust ipc interpretation to not use ipc.h
 2005-06-16 14:17:43 +00:00
Steve Grubb
c6229be999 resync with tarbal signature 2005-06-14 23:33:55 +00:00
Steve Grubb
8d45b16f16 - interpret socketcall & ipc based on a0 in ausearch 
- change call sequence to make user space messages faster
- update return val for auditctl
 2005-06-14 20:58:59 +00:00
Steve Grubb
04d8515f49 - Rule and watch insert no longer automatically dumps list 
- auditctl rules can now use auid instead of loginuid
- Add sighup support for daemon reconfiguration
- Move some functions into private.h
 2005-06-11 16:57:00 +00:00
Steve Grubb
71645f69b5 new version 2005-06-09 17:32:52 +00:00
Steve Grubb
1611412b75 New version 2005-06-02 19:43:35 +00:00
Steve Grubb
da5064c8fd Bump number for RHEL4 2005-05-20 22:43:14 +00:00
Steve Grubb
5e8f09ac4e - Update documentation 
- Handle user space audit events in more uniform way
- Update all parsers for more robustness with new kernel changes
- Create quiet mode for error messages
- Make rotated logs readonly
 2005-05-20 22:25:36 +00:00
David Woodhouse
c832ad1aac remove old sources 2005-05-18 23:32:38 +00:00
Steve Grubb
3dd7e61fb5 - Fix code to "or" uid & gid checks for ausearch -ua & -ga 
- Change msg() to audit_msg() to avoid conflicts
- Parse socket messages for hostname in ausearch
 2005-05-17 21:44:01 +00:00
Steve Grubb
d50bbf5c58 - Make sure ausearch ts & te obey DST. 
- Code cleanups to make file system watches work correctly
 2005-05-08 21:26:43 +00:00
Steve Grubb
d4ac8c010f Bump release since beehive terminated previous build 2005-05-03 16:54:12 +00:00
Steve Grubb
2aa10d8e7a - Add code to get watch list to auditctl 
- Get -f & -hn working in ausearch
- Added search by terminal, exe, and syscall to ausearch program
- Added -w parameter to match whole word in ausearch
 2005-05-03 16:39:50 +00:00
Steve Grubb
54f52bb971 Bump release 2005-04-29 20:54:31 +00:00
Steve Grubb
ab03ec591d - Allow ausearch uid & gid to be non-numeric (root, wheel, etc) 
- Fix problems with changing run level
- Added new code for logging shutdown reason credentials
- Update DAEMON messages to use better timestamp
 2005-04-29 20:43:43 +00:00
Steve Grubb
c49002eb08 - Make sure time calc is done using localtime 
- Raise rlimits for file size & cpu usage
- Added new disk_error_action config item to auditd.conf
- Rework memory management of event buffer
- Handled all errors in event logging thread
 2005-04-24 21:35:29 +00:00
Steve Grubb
e7cf9793b2 - In auditctl -l, loop until all rules are printed 
- Update autrace not to run if rules are currently loaded
- Added code to switch to single user mode when disk is full
- Added the ausearch program
 2005-04-23 21:15:11 +00:00
Steve Grubb
7a408f5f07 - Fixed bug where elf type wasn't being set when given numerically 
- Added autrace program (similar to strace)
- Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted
 2005-04-20 21:33:07 +00:00
Steve Grubb
d236fb124a - Check log file size on start up 
- Added priority_boost config item
- Reworked arch support
- Reworked how run level is changed
- Make allowances for ECONNREFUSED
 2005-04-18 20:25:36 +00:00
Steve Grubb
d1e22d79c2 - Code cleanups 
- Support the arch field for auditctl
- Add version to auditctl
- Documentation updates
- Moved default location of the audit log to /var/log/audit
 2005-04-01 19:10:36 +00:00
Steve Grubb
ffb4908089 Bump release number 2005-03-24 20:31:24 +00:00
Steve Grubb
5187974472 - Added patch for filesystem watch 
- Added version information to audit start message
- Change netlink code to use ack in order to get error notification
 2005-03-17 22:58:02 +00:00
Steve Grubb
57646a87b5 - removed the pam_loginuid library - its going to pam 2005-03-14 21:08:53 +00:00