rpms/audit
7
0
Fork 0
Code Issues Pull Requests Releases Activity
113 Commits 7 Branches 32 Tags 564 KiB
46837eb3a7
Commit Graph

113 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Steve Grubb
832892f1d5 fixed problem for new glibc kernheaders 2005-08-03 17:39:11 +00:00
Steve Grubb
79576eb6ce - Add check for fields that cannot be used with syscall entry in auditctl 
- Make auditctl not tolerate duplicate rule and watches
 2005-08-03 17:07:01 +00:00
Steve Grubb
29fca9932c - Update sample CAPP config 
- Remove warning for trimming file path in auditctl
- Make auditctl tolerate duplicate rule and watches
- auditd has new option so it doesn't overwrite log files
- Fixed bug in autrace that was reporting bad descriptor
 2005-08-02 22:20:04 +00:00
Steve Grubb
217f8fcd4b - Fix ausearch to handle no audit log better 
- Fix auditctl blank line handling
- Trim trailing '/' from file system watches in auditctl
- Catch cases where parameter was passed without option being given to
    auditctl
- Add CAPP sample configuration
 2005-07-29 18:11:51 +00:00
Tomáš Mráz
f9356bfa57 - make /usr/lib/libaudit.so point at the right file 2005-07-18 14:56:29 +00:00
Steve Grubb
cc23a33c90 - ausearch remove debug code 2005-07-14 20:25:26 +00:00
Steve Grubb
1be66fe6b3 - auditd message formatter use MAX_AUDIT_MESSAGE_LENGTH to prevent clipping 2005-07-14 13:27:33 +00:00
Steve Grubb
7c06330e80 - Fix ausearch buffers to hold long filenames 
- Make a0 long long for 64 bit kernels & 32 bit ausearch.
 2005-07-12 14:21:29 +00:00
Steve Grubb
7dfa20a5da - Adjust umask 
- Adjust length of strings for file system watches to not include NUL
- Remove extra error message from audit_send
 2005-07-07 15:59:43 +00:00
Steve Grubb
3fa19caed5 - Update log rotation handling to be more robust 2005-06-28 22:16:42 +00:00
Steve Grubb
7e2f162d05 - make auditctl -s work again 
- make AUDITD_CLEAN_STOP test in init scripts case insensitive
 2005-06-24 21:04:10 +00:00
Steve Grubb
64cb26697f - Remove /lib/libaudit.so & .la from audit-libs package 
- In auditctl, if syscall not given, default to all
 2005-06-23 21:40:32 +00:00
Steve Grubb
812847b7d0 - Add some syslog messages for a couple exits 
- Add some unlinks of the pid file in a couple error exits
- Make some options of auditctl not expect a reply
- Update support for user and watch filter lists
 2005-06-22 20:48:06 +00:00
Steve Grubb
7956d88af6 - Change packet draining to nonblocking 
- Interpret id field in ausearch
- Add error message if not able to create log
- Ignore netlink acks when asking for rule & watch list
 2005-06-21 20:37:11 +00:00
Steve Grubb
5a02a7c51a - Make sure the bad packet is drained when retrying user messages 
- Add support for new user and watch filter lists
- Interpret flags field in ausearch
 2005-06-20 22:47:50 +00:00
Steve Grubb
1deb784224 - Fix user messages for people with older kernels 2005-06-19 19:55:50 +00:00
Steve Grubb
b87507cf6a - Added support for FS_INODE and USYS_CONFIG records 
- More cleanup of user space message functions
 2005-06-17 22:00:10 +00:00
Steve Grubb
34e0a77920 - fixed bug in send_user_message which errored on pam logins 
- Change nanosleeps over to select loops
- Change the 'e' option to auditctl -p to 'x'
 2005-06-16 21:27:57 +00:00
Steve Grubb
f36e94743a reworked some files 2005-06-16 14:26:02 +00:00
Steve Grubb
a2197e2837 - fix bug in incremental flush where is wrongly reported an error 
- ausearch should not do uid check for -if option
- adjust ipc interpretation to not use ipc.h
 2005-06-16 14:17:43 +00:00
Steve Grubb
c6229be999 resync with tarbal signature 2005-06-14 23:33:55 +00:00
Steve Grubb
8d45b16f16 - interpret socketcall & ipc based on a0 in ausearch 
- change call sequence to make user space messages faster
- update return val for auditctl
 2005-06-14 20:58:59 +00:00
Steve Grubb
04d8515f49 - Rule and watch insert no longer automatically dumps list 
- auditctl rules can now use auid instead of loginuid
- Add sighup support for daemon reconfiguration
- Move some functions into private.h
 2005-06-11 16:57:00 +00:00
Steve Grubb
71645f69b5 new version 2005-06-09 17:32:52 +00:00
Steve Grubb
1611412b75 New version 2005-06-02 19:43:35 +00:00
Steve Grubb
da5064c8fd Bump number for RHEL4 2005-05-20 22:43:14 +00:00
Steve Grubb
5e8f09ac4e - Update documentation 
- Handle user space audit events in more uniform way
- Update all parsers for more robustness with new kernel changes
- Create quiet mode for error messages
- Make rotated logs readonly
 2005-05-20 22:25:36 +00:00
David Woodhouse
c832ad1aac remove old sources 2005-05-18 23:32:38 +00:00
Steve Grubb
3dd7e61fb5 - Fix code to "or" uid & gid checks for ausearch -ua & -ga 
- Change msg() to audit_msg() to avoid conflicts
- Parse socket messages for hostname in ausearch
 2005-05-17 21:44:01 +00:00
Steve Grubb
d50bbf5c58 - Make sure ausearch ts & te obey DST. 
- Code cleanups to make file system watches work correctly
 2005-05-08 21:26:43 +00:00
Steve Grubb
d4ac8c010f Bump release since beehive terminated previous build 2005-05-03 16:54:12 +00:00
Steve Grubb
2aa10d8e7a - Add code to get watch list to auditctl 
- Get -f & -hn working in ausearch
- Added search by terminal, exe, and syscall to ausearch program
- Added -w parameter to match whole word in ausearch
 2005-05-03 16:39:50 +00:00
Steve Grubb
54f52bb971 Bump release 2005-04-29 20:54:31 +00:00
Steve Grubb
ab03ec591d - Allow ausearch uid & gid to be non-numeric (root, wheel, etc) 
- Fix problems with changing run level
- Added new code for logging shutdown reason credentials
- Update DAEMON messages to use better timestamp
 2005-04-29 20:43:43 +00:00
Steve Grubb
c49002eb08 - Make sure time calc is done using localtime 
- Raise rlimits for file size & cpu usage
- Added new disk_error_action config item to auditd.conf
- Rework memory management of event buffer
- Handled all errors in event logging thread
 2005-04-24 21:35:29 +00:00
Steve Grubb
e7cf9793b2 - In auditctl -l, loop until all rules are printed 
- Update autrace not to run if rules are currently loaded
- Added code to switch to single user mode when disk is full
- Added the ausearch program
 2005-04-23 21:15:11 +00:00
Steve Grubb
7a408f5f07 - Fixed bug where elf type wasn't being set when given numerically 
- Added autrace program (similar to strace)
- Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted
 2005-04-20 21:33:07 +00:00
Steve Grubb
d236fb124a - Check log file size on start up 
- Added priority_boost config item
- Reworked arch support
- Reworked how run level is changed
- Make allowances for ECONNREFUSED
 2005-04-18 20:25:36 +00:00
Steve Grubb
d1e22d79c2 - Code cleanups 
- Support the arch field for auditctl
- Add version to auditctl
- Documentation updates
- Moved default location of the audit log to /var/log/audit
 2005-04-01 19:10:36 +00:00
Steve Grubb
ffb4908089 Bump release number 2005-03-24 20:31:24 +00:00
Steve Grubb
5187974472 - Added patch for filesystem watch 
- Added version information to audit start message
- Change netlink code to use ack in order to get error notification
 2005-03-17 22:58:02 +00:00
Steve Grubb
57646a87b5 - removed the pam_loginuid library - its going to pam 2005-03-14 21:08:53 +00:00
Steve Grubb
ac64680d21 - Fixed bug setting loginuid 
- Added num_logs to configure number of logs when rotating
- Added code for rotating logs
 2005-03-09 23:50:13 +00:00
Steve Grubb
0ff90d0747 - Fix audit_set_pid to try to read a reply, but its non-fatal if no reply. 
- Remove the read status during init
- Change to using pthreads sync mechanism for stopping system
- Worker thread should ignore all signals
- Change main loop to use select for inbound event handling
- Gave pam_loginuid a "failok" option for testing
 2005-03-08 20:46:48 +00:00
Steve Grubb
21c8b70346 - Lots of code cleanups 
- Added write_pid function to auditd
- Added audit_log to libaudit
- Don't check file length in foreground mode of auditd
- Added *if_enabled functions to send messages only if audit system is
    enabled
- If syscall name is unknown when printing rules, use the syscall number
- Rework the build system to produce singly threaded public libraries
- Create a multithreaded version of libaudit for the audit daemon's use
 2005-03-03 22:48:44 +00:00
Steve Grubb
78412f0335 - Rename pam_audit to pam_loginuid to reflect what it does 
- Fix bug in detecting space left on partition
- Fix bug in handling of suspended logging
 2005-02-23 23:24:19 +00:00
David Woodhouse
668644befb Fix headers 2005-02-23 13:57:24 +00:00
Steve Grubb
19531ff754 - Another lib64 correction 2005-02-20 20:43:49 +00:00
Steve Grubb
56b158ae01 - Change pam install from /lib/security to /%{_lib}/security 
- Change pam_audit to write loginuid to /proc/pid/loginuid
- Add pam_session_close handle
- Update to newest kernel headers
 2005-02-20 20:33:50 +00:00
Steve Grubb
8fd9fa294a - New version 
- Add R option to auditctl to allow reading rules from file.
- Do not allow task creation list to have syscall auditing
- Add D option to allow deleting all rules with 1 command
- Added pam_audit man page & sample.rules
- Mod initscript to call auditctl to load rules at start-up
- Write message to log file for daemon start up
- Write message that daemon is shutting down
- Modify auditd shutdown to wait until logger thread is finished
- Add sample rule file to docs
 2005-02-11 19:22:21 +00:00