26677d9499- Fix overflow in audit_log_user_command, better (#438840) - ausearch was not matching path in avc records - audisp-prelude attempt to reposition index after examining each type - correct building of mls policy - Fix auparse iterating in auparse_find_field and next_field - Don't alert on USER_AVC's - they are not quite right
Steve Grubb
2008-04-18 19:47:43 +0000
d0505052ce- Fix overflow in audit_log_user_command, better (#438840) - ausearch was not matching path in avc records - audisp-prelude attempt to reposition index after examining each type - correct building of mls policy
Steve Grubb
2008-04-17 21:14:24 +0000
0553dafd8aAdd directory to locate rules
Steve Grubb
2008-04-08 17:28:30 +0000
e32261e9ddGet rid of old patches
Steve Grubb
2008-04-08 17:14:57 +0000
0a9ab60e01- Fix buffer overflow in audit_log_user_command, again (#438840) - Fix memory leak in EOE code in auditd (#440075) - In auditctl, don't use new operators in legacy rule format - Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
Steve Grubb
2008-04-08 17:11:19 +0000
66fff58cc0- Fix buffer overflow in audit_log_user_command, again (#438840) - Fix memory leak in EOE code in auditd (#440075) - In auditctl, don't use new operators in legacy rule format - Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
Steve Grubb
2008-04-08 17:10:03 +0000
13e2090eff- Fix memleak in auditd eoe code
Steve Grubb
2008-04-05 01:38:01 +0000
5676baffd9- Remove LSB headers from init scripts - Fix buffer overflow in audit_log_user_command again
Steve Grubb
2008-04-01 16:33:34 +0000
bae85f8737Fixed Makefile.am of remote logger
Steve Grubb
2008-03-30 19:36:34 +0000
89ca632558update sc-audit release
Steve Grubb
2008-03-30 19:18:35 +0000
8efb1f0ace- Handle user space avcs in prelude plugin - Fix watched account login detection for some failed login attempts - Couple fixups in audit logging functions (Miloslav Trmac) - Add support in auditctl for virtual keys - auparse_find_field_next was not iterating correctly, fixed it - Add idmef alerts for access or execution of watched file - Fix buffer overflow in audit_log_user_command - Add basic remote logging plugin - only sends & no flow control - Update ausearch with interpret fixes from auparse
Steve Grubb
2008-03-30 19:17:17 +0000
44f663a360- Apply hidden attribute cleanup patch (Miloslav Trmac) - Apply auparse expression interface patch (Miloslav Trmac) - Fix potential memleak in audit event dispatcher - Update system-config-audit to version 0.4.6 (Miloslav Trmac) - audisp-prelude alerts now controlled by config file - Updated syscall table for 2.6.25 kernel - Apply patch correcting acct field being misencoded (Miloslav Trmac) - Added watched account login detection for prelude plugin
Steve Grubb
2008-03-09 23:29:28 +0000
379ed2602aupdated spec file for merge review
Steve Grubb
2008-02-25 11:27:40 +0000
a37b944f0b- Update for gcc 4.3 - Cleanup descriptors in audispd before running plugin - Fix 'recent' keyword for aureport/search - Fix SE Linux policy for zos_remote plugin - Add event type for group password authentication attempts - Couple of updates to the translation tables - Add detection of failed group authentication to audisp-prelude
Steve Grubb
2008-02-14 19:51:04 +0000
f4110fe9a8bump release number
Steve Grubb
2008-01-31 22:27:40 +0000
5ccda98dc4- In ausearch/report, prefer -if to stdin - In ausearch/report, add new command line option --input-logs (#428860) - Updated audisp-prelude based on feedback from prelude-devel - Added prelude alert for promiscuous socket being opened - Added prelude alert for SE Linux policy enforcement changes - Added prelude alerts for Forbidden Login Locations and Time - Applied patch to auparse fixing error handling of searching by interpreted value (Miloslav Trmac)
Steve Grubb
2008-01-31 22:17:06 +0000
7307aa51db- In ausearch/report, prefer -if to stdin - In ausearch/report, add new command line option --input-logs (#428860) - Updated audisp-prelude based on feedback from prelude-devel - Added prelude alert for promiscuous socket being opened - Added prelude alert for SE Linux policy enforcement changes - Added prelude alerts for Forbidden Login Locations and Time - Applied patch to auparse fixing error handling of searching by interpreted value (Miloslav Trmac)
Steve Grubb
2008-01-31 22:07:21 +0000
adf781ee8dFix bug in tarball
Steve Grubb
2008-01-19 21:24:21 +0000
9893d2d877- Add prelude IDS plugin for IDMEF alerts - Add --user option to aulastlog command - Use desktop-file-install for system-config-audit - Avoid touching auditd.conf most of the time (#408501)
Steve Grubb
2008-01-19 20:59:34 +0000
597b4aeb16- Updates for spec file review - Adjust permission on selinux policy file
Steve Grubb
2008-01-11 20:42:03 +0000
7b5bbccaae- Adjust permission on selinux policy file
Steve Grubb
2008-01-11 16:14:53 +0000
61abc7b01e- Fix config parser to allow either 0640 or 0600 for audit logs (#427062) - Check for audit log being writable by owner in auditd - If auditd logging was suspended, it can be resumed with SIGUSR2 (#251639) - Updated CAPP, LSPP, and NISPOM rules for new capabilities - Added aulastlog utility
Steve Grubb
2008-01-07 20:11:15 +0000
1d5ece1ce9- Allow 0600 file perms for audit logs
Steve Grubb
2007-12-31 03:48:17 +0000
1a7594d87f- Allow 0600 file perms for audit logs
Steve Grubb
2007-12-31 03:29:57 +0000
e8486e1e33- fchmod of log file was on wrong variable (#426934) - Allow use of errno strings for exit codes in audit rules
Steve Grubb
2007-12-29 15:51:09 +0000
597027a35e- Add kernel release string to DEAMON_START events - Fix keep_logs when num_logs option disabled (#325561) - Fix auparse to handle node fields for syscall records - Update system-config-audit to version 0.4.5 (Miloslav Trmac) - Add keyword week-ago to aureport & ausearch start/end times - Fix audit log permissions on rotate. If group is root 0400, otherwise 0440 - Add RACF zos remote audispd plugin (Klaus Kiwi) - Add event queue overflow action to audispd
Steve Grubb
2007-12-27 21:50:31 +0000
fed3183375- Fix race between threads accessing common data in auditd - Fix double free in event dispatcher.
Steve Grubb
2007-10-17 18:21:53 +0000
8192911e93makefile update to properly grab makefile.common
Bill Nottingham
2007-10-15 18:37:38 +0000
0a1d445d1c- Fix syscall name to number conversion in libaudit.
Steve Grubb
2007-10-05 15:42:18 +0000
eadd98d61f- Don't retry if the rt queue is full.
Steve Grubb
2007-10-01 18:43:37 +0000
559824bd5d- Add support for searching by posix regular expressions in auparse - Route DEAMON events into rt interface - If event pipe is full, try again after doing local logging - Optionally add node/machine name to records in audit daemon - Update ausearch/aureport to specify nodes to search on - Fix segfault interpretting saddr fields in avcs
Steve Grubb
2007-09-25 15:56:34 +0000
b62f29eb75- Fix uninitialized variable in auparse (John Dennis)
Steve Grubb
2007-09-06 18:16:57 +0000
862b73deea- External plugin support in place - Fix reference counting in auparse python bindings (#263961) - Moved default af_unix plugin socket to /var/run/audispd_events
Steve Grubb
2007-09-02 16:49:22 +0000
114d2589bb- Add newline to audispd string formatted events
Steve Grubb
2007-08-29 17:18:22 +0000
7e0621586cMinor update to spec file
Steve Grubb
2007-08-28 23:38:25 +0000
d3e971a156- spec file cleanups - Update to s-c-audit 0.4.3
Steve Grubb
2007-08-28 18:34:17 +0000
7c6e7fc655- Update Licence tags - Adding perm field should not set syscall added flag in auditctl - Fix segfault when aureport -if option is used - Fix auditctl to better check keys on rule lines - Add support for audit by TTY and other new event types - Auditd config option for group permission of audit logs - Swig messed up a variable in ppc's python bindings causing crashes. (#251327) - New audit event dispatcher - Update syscall tables for 2.6.23 kernel
Steve Grubb
2007-08-27 20:29:41 +0000
6fd670045bMore release version adjustment
Steve Grubb
2007-07-25 20:39:21 +0000
70c6124734change sc-audit parameters
Steve Grubb
2007-07-25 20:25:48 +0000
2837477064- Fix potential buffer overflow in print clone flags of auparse - Fix python traceback parsing watches without perm statement (Miloslav Trmac) - Update auditctl to handle legacy kernels when putting a watch on a dir - Fix acct interpretation in auparse
Steve Grubb
2007-07-25 20:09:50 +0000
be93e36052- Fix a double free when auditd receives SIGHUP - Move the system-config-audit menu entry to the Administration menu
Miloslav Trmac
2007-07-16 23:30:49 +0000
c56912826f- Add system-config-audit (Miloslav Trmac) - Correct bug in audit_make_equivalent function (Al Viro)
Steve Grubb
2007-07-10 23:22:14 +0000
35912257bdupdate sources file
Steve Grubb
2007-05-01 22:09:23 +0000
96307145e6update sources file
Steve Grubb
2007-05-01 22:02:30 +0000
3c13e309e1update sources file
Steve Grubb
2007-05-01 21:52:52 +0000
b78816560fupdate sources
Steve Grubb
2007-05-01 21:43:33 +0000
551486a79f- Change buffer size to prevent truncation of DAEMON events with large labels - Fix memory leaks in auparse (John Dennis) - Update syscall tables for 2.6.21 kernel - Update capp & lspp rules - New python bindings for libauparse (John Dennis)
Steve Grubb
2007-05-01 21:43:06 +0000
43821aee16fix build error
Steve Grubb
2007-04-05 23:11:05 +0000
31f6a34b35- New event dispatcher (James Antill) - Apply patches fixing man pages and Makefile.am (Philipp Hahn) - Apply patch correcting python libs permissions (Philipp Hahn) - Fix auditd segfault on reload - Fix bug in auparse library for file pointers and descriptors - Extract subject information out of daemon events for ausearch
Steve Grubb
2007-04-05 22:44:18 +0000
8564164f19- Remove requires kernel-headers for python-libs - Apply patch to prevent segfaults on auditd reload
Steve Grubb
2007-03-29 12:19:50 +0000
7044bd306e- Updated autrace to monitor *at syscalls - Add support in libaudit for AUDIT_BIT_TEST(^) and AUDIT_MASK_TEST (&) - Finish reworking auditd config parser - In auparse, interpret open, fcntl, and clone flags - In auparse, when interpreting execve record types, run args through unencode - Add support for OBJ_PID message type - Event dispatcher updates
Steve Grubb
2007-03-20 16:34:48 +0000
9404d1e9db- rebuild
Steve Grubb
2007-03-02 23:40:38 +0000
dbe1b8311b- NEW audit dispatcher program & plugin framework - Correct hidden variables in libauparse - Added NISPOM sample rules - Verify accessibility of files passed in auparse_init - Fix bug in parser library interpreting socketcalls - Add support for stdio FILE pointer in auparse_init - Adjust init script to allow anyone to status auditd (#230626)
Steve Grubb
2007-03-02 22:26:36 +0000
56bff5dac8Add new build requirement
Steve Grubb
2007-02-21 02:49:15 +0000
f3a943762f- NEW audit dispatcher program & plugin framework
Steve Grubb
2007-02-21 02:43:37 +0000
d57251a50cTake smp_flags away for troubleshooting
Steve Grubb
2007-02-21 00:20:25 +0000
cfd7264394- Add man pages - Reduce text relocations in parser library - Add -n option to auditd for no fork - Add exec option to space_left, admin_space_left, disk_full, and disk_error - eg EXEC /usr/local/script
Steve Grubb
2007-02-21 00:11:20 +0000
adb0e1befa- updated audit_rule_fieldpair_data to handle perm correctly (#226780) - Finished search options for audit parsing library - Fix ausearch -se to work correctly - Fix auditd init script for /usr on netdev (#228528) - Parse avc seperms better when there are more than one
Steve Grubb
2007-02-16 22:20:43 +0000
e3b8e4d5efFix another bug in tarball
Steve Grubb
2007-02-04 22:54:01 +0000
1bcf1fbc93Another change to tarball
Steve Grubb
2007-02-04 22:42:45 +0000
bf68c21a4eupdate tarball
Steve Grubb
2007-02-04 22:24:16 +0000
7ea7611737- New report about authentication attempts - Updates for python 2.5 - update autrace to have resource usage mode - update auditctl to support immutable config - added audit_log_user_command function to libaudit api - interpret capabilities - added audit event parsing library - updates for 2.6.20 kernel
Steve Grubb
2007-02-04 22:11:48 +0000
1dbd164cdbmake ausearch/report available to more users
Steve Grubb
2006-12-22 16:42:02 +0000
22f12f8fb1Update for python and buggy kernel headers
Steve Grubb
2006-12-22 01:14:20 +0000
7af722908frevert a change in specfile
Steve Grubb
2006-12-22 00:33:14 +0000
3022af8ca9updating python patch
Steve Grubb
2006-12-22 00:26:48 +0000
3c6db7500eupdate fixes for python
Steve Grubb
2006-12-22 00:15:07 +0000
e85f917301- rebuild again for python 2.5
Steve Grubb
2006-12-21 21:05:10 +0000
9323477d67- Fix a couple parsing problems (#217952) - Add tgkill to S390* syscall tables (#218484) - Fix error messages in ausearch/aureport
Steve Grubb
2006-12-10 22:51:00 +0000
cb7d8f4b57- rebuild against python 2.5
Jeremy Katz
2006-12-06 23:05:00 +0000
0b8b4aaa9b- Fix timestamp for libaudit.conf (#218053)
Steve Grubb
2006-12-01 16:34:07 +0000
cbb5dedfa7- Fix minor parsing problem and add new msg types
Steve Grubb
2006-11-30 13:26:36 +0000
b7fc0db233- ausearch & aureport implement uid/gid caching - In ausearch & aureport, extract addr when hostname is unknown - In ausearch & aureport, test audit log presence O_RDONLY - New ausearch/aureport time keywords: recent, this-week, this-month, this-year - Added --add & --delete option to aureport - Update res parsing in config change events - Increase the size on audit daemon buffers - Parse avc_path records in ausearch/aureport - ausearch has new output mode, raw, for extracting events - ausearch/aureport can now read stdin - Rework AVC processing in ausearch/aureport - Added long options to ausearch and aureport
Steve Grubb
2006-11-28 22:34:26 +0000
81b218677a- In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834) - Fix some defines in libaudit.h - Some auditd config strings were not initialized in aureport (#211443) - Updated man pages - Add Netlabel event types to libaudit - Update aureports to current audit event types - Update autrace a little - Deprecated all the old audit_rule functions from public API - Drop auparse library for the moment
Steve Grubb
2006-10-24 18:16:19 +0000
dd1a104375another attempt to fix ia64
Steve Grubb
2006-09-29 21:30:51 +0000
2ae90f4803adjustment for ia64
Steve Grubb
2006-09-29 21:22:26 +0000
c02ad9a6db- Add dist tag and bump version (#208532) - Make internal auditd buffers bigger for context info - Correct address resolving of hostname in logging functions - Do not allow multiple msgtypes in same audit rule in auditctl (#207666) - Only =, != operators for arch & inode fields in auditctl (#206427) - Updated audit message type table - Remove watches from aureport since FS_WATCH is deprecated - Add audit_log_avc back temporarily (#208152)
Steve Grubb
2006-09-29 20:48:53 +0000
82a277c60b- Fix logging messages to use addr if passed. - Apply patches from Tony Jones correcting no kernel support messages - Updated syscall tables for 2.6.18 kernel - Remove deprecated functions: audit_log, audit_log_avc, audit_log_if_enabled - Disallow syscall auditing on exclude list - Improve time handling in ausearch and aureport (#191394) - Attempt to reconstruct full path from relative for searching
Steve Grubb
2006-09-19 00:04:08 +0000
329251008e- Rename audit event socket
Steve Grubb
2006-08-30 20:58:41 +0000
8b804cd322- Another minor update to auditctl -p option
Steve Grubb
2006-08-28 23:03:50 +0000
3dec9bc74e- Apply updates to dispatcher - Fix a couple bugs regarding MLS labels - Resurrect -p option - Tighten rules with exclude filter - Fix parsing issue which lead to segfault in some cases - Fix option parsing to ignore malformed lines
Steve Grubb
2006-08-26 19:57:03 +0000
50c84f0839rebuilt with latest binutils
Jesse Keating
2006-08-18 20:10:47 +0000
e4fd4c2eea- Remove debug lines from dispatcher
Daniel J Walsh
2006-08-08 17:26:37 +0000
46837eb3a7- Change audisp to use a named pipe
Daniel J Walsh
2006-08-06 00:03:41 +0000
979da90c90- Fix dispatcher to handle sigchld - Fix library location for 64 bit - Add Prereq
Steve Grubb
2006-07-27 21:34:08 +0000
965e81bc28Update to fix 64 bit platform
Daniel J Walsh
2006-07-27 20:56:59 +0000
cb2a3832b6- Eliminate avc package from audisp
Daniel J Walsh
2006-07-21 13:27:22 +0000
61d4080ded- More fixes for setroubleshoot to handle failing plugin
Daniel J Walsh
2006-07-19 13:12:02 +0000
25f2ae95dc- Fixes for setroubleshoot
Daniel J Walsh
2006-07-14 18:49:02 +0000
cb9ea2d589- Switch out dispatcher - Fix bug upgrading rule types
Steve Grubb
2006-07-13 20:38:11 +0000
bcf52d7fa0bumped for rebuild
Jesse Keating
2006-07-12 05:23:20 +0000
ca97ebc206- Add support for the new filter key - Update syscall tables for 2.6.17 - Add audit failure query function - Switch out gethostbyname call with getaddrinfo - Add audit by obj capability for 2.6.18 kernel - Ausearch & aureport now fail if no args to -te - New auditd.conf option to choose blocking/non-blocking dispatcher comm - Ausearch improved search by label
Steve Grubb
2006-06-30 20:30:02 +0000
170d0eae07release number was wrong
Steve Grubb
2006-05-25 16:24:12 +0000
d6587396da- Apply patch to ensure watches only associate with exit filter - Apply patch to correctly show new operators when new listing format is used - Apply patch to pull kernel's audit.h into python bindings - Collect signal sender's context
Steve Grubb
2006-05-25 16:22:33 +0000
db346efb41fix kernel-headers requirement, again
David Woodhouse
2006-05-16 15:02:36 +0000
835c1962e5minor adjustment to directory permission
Steve Grubb
2006-05-12 21:09:26 +0000
ca188de775- Updates for new glibc-kernheaders - Change auditctl to collect list of rules then delete them on -D - Update capp.rules and lspp.rules to comment out rules for the possible list - Add new message types - Support sigusr1 sender identity of newer kernels - Add support for ppid in auditctl and ausearch - fix auditctl to trim the '/' from watches - Move audit daemon config files to /etc/audit for better SE Linux protection
Steve Grubb
2006-05-12 21:04:25 +0000
e147a719cdFix typo. Harder.
David Woodhouse
2006-04-28 17:09:58 +0000
c06e8d738aFir type in patch name
David Woodhouse
2006-04-28 17:06:18 +0000
Steve Grubb
Miloslav Trmac
Bill Nottingham
Jeremy Katz
Jesse Keating
Daniel J Walsh
David Woodhouse