994c362576Update for kernel headers changes
David Woodhouse
2006-04-28 15:39:53 +0000
1fe1de1d67Require kernel-headers, not glibc-kernheaders
David Woodhouse
2006-04-26 16:17:04 +0000
948327f352- New message type for trusted apps - Add new keywords today, yesterday, now for ausearch and aureport - Make audit_log_user_avc_message really send to syslog on error - Updated syscall tables in auditctl - Deprecated the 'possible' action for syscall rules in auditctl - Update watch code to use file syscalls instead of 'all' in auditctl
Steve Grubb
2006-04-16 20:33:48 +0000
69c5a160ca- Add support for new file system auditing kernel subsystem
Steve Grubb
2006-04-07 21:06:18 +0000
42d612f4c7- New message types - Support new rule format found in 2.6.17 and later kernels - Add support for audit by role, clearance, type, sensitivity
Steve Grubb
2006-04-07 01:33:11 +0000
364ae9db02remove 1.1.4 from source file
Steve Grubb
2006-03-06 22:18:51 +0000
7f66efebc1- Changed audit_log_semanage_message to take new params - In aureport, add class between syscall and permission in avc report - Fix bug where fsync is called in debug mode - Add optional support for tty in SYSCALL records for ausearch/aureport - Reinstate legacy rule operator support - Add man pages - Auditd ignore most signals
Steve Grubb
2006-03-06 22:18:21 +0000
e8cdd41fd9bump for bug in double-long on ppc(64)
Jesse Keating
2006-02-11 01:59:34 +0000
e37b110a23- Change audit_log_semanage_message to check strlen as well as NULL.
Steve Grubb
2006-02-10 22:42:34 +0000
b26a2c9eef- Change audit_log_semanage_message to check strlen as well as NULL.
Steve Grubb
2006-02-10 18:39:57 +0000
6a7f689980- Change audit_log_semanage_message to take new params.
Steve Grubb
2006-02-09 22:21:09 +0000
cab4872cd7- Change audit_log_semanage_message to take new params.
Steve Grubb
2006-02-09 21:18:22 +0000
4a74d3aca2- Fix bug in autrace where it didn't run on kernels without file watch support - Add syslog message to auditd saying what program was started for dispatcher - Remove audit_send_user from public api - Fix bug in USER_LOGIN messages where ausearch does not translate msg='uid=500: into acct name (#178102). - Change comm with dispatcher to socketpair from pipe - Change auditd to use custom daemonize to avoid race in init scripts - Update error message when deleting a rule that doesn't exist (#176239) - Call shutdown_dispatcher when auditd stops - Add new logging function audit_log_semanage_message
Steve Grubb
2006-02-08 23:08:01 +0000
162646c439bump for new gcc/glibc
Jesse Keating
2006-02-07 11:02:55 +0000
22affea5bd- Add timestamp to daemon_config messages (#174865) - Add error checking of year for aureport & ausearh - Treat af_unix sockets as files for searching and reporting - Update capp & lspp rules to combine syscalls for higher performance - Adjusted the chkconfig line for auditd to start a little earlier - Added skeleton program to docs for people to write their own dispatcher with - Apply patch from Ulrich Drepper that optimizes resource utilization - Change ausearch and aureport to unlocked IO
Steve Grubb
2006-01-05 23:37:48 +0000
8d49e2745a- Add more message types
Steve Grubb
2005-12-05 23:10:00 +0000
9fb9401f3d- Add support for alpha processors - Update the audisp code - Add locale code in ausearch and aureport - Add new rule operator patch - Add exclude filter patch - Cleanup make files - Add python bindings
Steve Grubb
2005-11-30 22:08:32 +0000
ef69199f9b- Add initial version of audisp. Just a placeholder at this point - Remove -t from auditctl
Steve Grubb
2005-11-09 22:48:47 +0000
c170a2650f- Add 2 more summary reports - Add 2 more message types
Steve Grubb
2005-11-07 22:58:52 +0000
79bf594d73- Fix memory leaks in aureport & ausearch - Fix auditd reconfig to change mail accts, too - Fix stray pointer in sorting of aureport - Added new message type - Add results to all DAEMON messages
Steve Grubb
2005-11-06 21:07:46 +0000
6989ec57ad- Add --failed/success flags to aureport to select specific events for reports - Add --summary to get totals of reported objects - Add ability to force log rotation by sending sigusr1 to auditd - Add -i flag to auditctl to ignore errors when reading rules from a file - Reformat aureports so date & time are always given - Add cron script for log rotation to docs
Steve Grubb
2005-11-04 19:37:26 +0000
5a1a4f0cf5- Updated message types that auditd recognizes - Added a couple more message types - Added new standard logging format function - Update default config - Make ausearch -m take a list of message types
Steve Grubb
2005-11-02 22:55:27 +0000
3a535d7d2a- Update man pages - Add email alert for admin_space_left in auditd - Aureport cleanups - Add anomaly & response to anomaly reports to aureport - Summary report runs by default in aureport - Updated syscall number tables
Steve Grubb
2005-10-24 19:01:56 +0000
f553a5af1e- Update reports - Add new message types - Bug fixes
Steve Grubb
2005-10-19 20:12:04 +0000
afb1389978- in aureport, add column labels to reports - added watch report to aureport - added interpreting mode to aureport - added user space avc standard message to libaudit - aureport & ausearch now use builtin log locations when bad config file - add email alert to low disk space warning actions in auditd
Steve Grubb
2005-10-10 21:56:42 +0000
50ab79e79f- ausearch can now search on SE Linux contexts - added aureport program to analyse logs - aureport added report option for each log's start and end time - increased random number selected for initial seq number in auditd - add new user space defines to libaudit.h - add add standard logging functions to libaudit
Steve Grubb
2005-10-04 22:04:36 +0000
9e3c7f913a- Rebuilt
Steve Grubb
2005-09-23 16:20:14 +0000
38342f3405- Make rate & backlog 32 bit unsigned int in auditctl - In auditctl, if -F arch is given with -t option, don't require list - Update auditd man page - Add size check to audit_send - Update message for audit_open failure when kernel doesn't support audit
Steve Grubb
2005-09-23 15:15:49 +0000
0978c5b99cNew version
Steve Grubb
2005-08-22 22:47:16 +0000
ec62b1c24d- adjust file perms of newly created log file in auditd - fix 2 memory leaks and an out of bounds access in auditd - fix case where auditd was closing netlink descriptor too early - fix watch rules not to take field arguments in auditctl - fix bug where inode, devmajor, devminor, exit, and success fields in auditctl rules were not getting the correct value stored
Steve Grubb
2005-08-22 21:40:25 +0000
31e817f7dd- Make sure error packets get eaten. - Fix a few error messages in auditctl - Fix handling of unsupported watches when reading rules from file in auditctl
Steve Grubb
2005-08-08 22:17:06 +0000
286db4872emake adjustments for kern headers
Steve Grubb
2005-08-03 20:54:08 +0000
0c36f408f1- Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches
Steve Grubb
2005-08-03 17:40:29 +0000
832892f1d5fixed problem for new glibc kernheaders
Steve Grubb
2005-08-03 17:39:11 +0000
79576eb6ce- Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches
Steve Grubb
2005-08-03 17:07:01 +0000
29fca9932c- Update sample CAPP config - Remove warning for trimming file path in auditctl - Make auditctl tolerate duplicate rule and watches - auditd has new option so it doesn't overwrite log files - Fixed bug in autrace that was reporting bad descriptor
Steve Grubb
2005-08-02 22:20:04 +0000
217f8fcd4b- Fix ausearch to handle no audit log better - Fix auditctl blank line handling - Trim trailing '/' from file system watches in auditctl - Catch cases where parameter was passed without option being given to auditctl - Add CAPP sample configuration
Steve Grubb
2005-07-29 18:11:51 +0000
f9356bfa57- make /usr/lib/libaudit.so point at the right file
Tomáš Mráz
2005-07-18 14:56:29 +0000
cc23a33c90- ausearch remove debug code
Steve Grubb
2005-07-14 20:25:26 +0000
1be66fe6b3- auditd message formatter use MAX_AUDIT_MESSAGE_LENGTH to prevent clipping
Steve Grubb
2005-07-14 13:27:33 +0000
7c06330e80- Fix ausearch buffers to hold long filenames - Make a0 long long for 64 bit kernels & 32 bit ausearch.
Steve Grubb
2005-07-12 14:21:29 +0000
7dfa20a5da- Adjust umask - Adjust length of strings for file system watches to not include NUL - Remove extra error message from audit_send
Steve Grubb
2005-07-07 15:59:43 +0000
3fa19caed5- Update log rotation handling to be more robust
Steve Grubb
2005-06-28 22:16:42 +0000
7e2f162d05- make auditctl -s work again - make AUDITD_CLEAN_STOP test in init scripts case insensitive
Steve Grubb
2005-06-24 21:04:10 +0000
64cb26697f- Remove /lib/libaudit.so & .la from audit-libs package - In auditctl, if syscall not given, default to all
Steve Grubb
2005-06-23 21:40:32 +0000
812847b7d0- Add some syslog messages for a couple exits - Add some unlinks of the pid file in a couple error exits - Make some options of auditctl not expect a reply - Update support for user and watch filter lists
Steve Grubb
2005-06-22 20:48:06 +0000
7956d88af6- Change packet draining to nonblocking - Interpret id field in ausearch - Add error message if not able to create log - Ignore netlink acks when asking for rule & watch list
Steve Grubb
2005-06-21 20:37:11 +0000
5a02a7c51a- Make sure the bad packet is drained when retrying user messages - Add support for new user and watch filter lists - Interpret flags field in ausearch
Steve Grubb
2005-06-20 22:47:50 +0000
1deb784224- Fix user messages for people with older kernels
Steve Grubb
2005-06-19 19:55:50 +0000
b87507cf6a- Added support for FS_INODE and USYS_CONFIG records - More cleanup of user space message functions
Steve Grubb
2005-06-17 22:00:10 +0000
34e0a77920- fixed bug in send_user_message which errored on pam logins - Change nanosleeps over to select loops - Change the 'e' option to auditctl -p to 'x'
Steve Grubb
2005-06-16 21:27:57 +0000
f36e94743areworked some files
Steve Grubb
2005-06-16 14:26:02 +0000
a2197e2837- fix bug in incremental flush where is wrongly reported an error - ausearch should not do uid check for -if option - adjust ipc interpretation to not use ipc.h
Steve Grubb
2005-06-16 14:17:43 +0000
c6229be999resync with tarbal signature
Steve Grubb
2005-06-14 23:33:55 +0000
8d45b16f16- interpret socketcall & ipc based on a0 in ausearch - change call sequence to make user space messages faster - update return val for auditctl
Steve Grubb
2005-06-14 20:58:59 +0000
04d8515f49- Rule and watch insert no longer automatically dumps list - auditctl rules can now use auid instead of loginuid - Add sighup support for daemon reconfiguration - Move some functions into private.h
Steve Grubb
2005-06-11 16:57:00 +0000
71645f69b5new version
Steve Grubb
2005-06-09 17:32:52 +0000
1611412b75New version
Steve Grubb
2005-06-02 19:43:35 +0000
da5064c8fdBump number for RHEL4
Steve Grubb
2005-05-20 22:43:14 +0000
5e8f09ac4e- Update documentation - Handle user space audit events in more uniform way - Update all parsers for more robustness with new kernel changes - Create quiet mode for error messages - Make rotated logs readonly
Steve Grubb
2005-05-20 22:25:36 +0000
c832ad1aacremove old sources
David Woodhouse
2005-05-18 23:32:38 +0000
3dd7e61fb5- Fix code to "or" uid & gid checks for ausearch -ua & -ga - Change msg() to audit_msg() to avoid conflicts - Parse socket messages for hostname in ausearch
Steve Grubb
2005-05-17 21:44:01 +0000
d50bbf5c58- Make sure ausearch ts & te obey DST. - Code cleanups to make file system watches work correctly
Steve Grubb
2005-05-08 21:26:43 +0000
d4ac8c010fBump release since beehive terminated previous build
Steve Grubb
2005-05-03 16:54:12 +0000
2aa10d8e7a- Add code to get watch list to auditctl - Get -f & -hn working in ausearch - Added search by terminal, exe, and syscall to ausearch program - Added -w parameter to match whole word in ausearch
Steve Grubb
2005-05-03 16:39:50 +0000
54f52bb971Bump release
Steve Grubb
2005-04-29 20:54:31 +0000
ab03ec591d- Allow ausearch uid & gid to be non-numeric (root, wheel, etc) - Fix problems with changing run level - Added new code for logging shutdown reason credentials - Update DAEMON messages to use better timestamp
Steve Grubb
2005-04-29 20:43:43 +0000
c49002eb08- Make sure time calc is done using localtime - Raise rlimits for file size & cpu usage - Added new disk_error_action config item to auditd.conf - Rework memory management of event buffer - Handled all errors in event logging thread
Steve Grubb
2005-04-24 21:35:29 +0000
e7cf9793b2- In auditctl -l, loop until all rules are printed - Update autrace not to run if rules are currently loaded - Added code to switch to single user mode when disk is full - Added the ausearch program
Steve Grubb
2005-04-23 21:15:11 +0000
7a408f5f07- Fixed bug where elf type wasn't being set when given numerically - Added autrace program (similar to strace) - Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted
Steve Grubb
2005-04-20 21:33:07 +0000
d236fb124a- Check log file size on start up - Added priority_boost config item - Reworked arch support - Reworked how run level is changed - Make allowances for ECONNREFUSED
Steve Grubb
2005-04-18 20:25:36 +0000
d1e22d79c2- Code cleanups - Support the arch field for auditctl - Add version to auditctl - Documentation updates - Moved default location of the audit log to /var/log/audit
Steve Grubb
2005-04-01 19:10:36 +0000
ffb4908089Bump release number
Steve Grubb
2005-03-24 20:31:24 +0000
5187974472- Added patch for filesystem watch - Added version information to audit start message - Change netlink code to use ack in order to get error notification
Steve Grubb
2005-03-17 22:58:02 +0000
57646a87b5- removed the pam_loginuid library - its going to pam
Steve Grubb
2005-03-14 21:08:53 +0000
ac64680d21- Fixed bug setting loginuid - Added num_logs to configure number of logs when rotating - Added code for rotating logs
Steve Grubb
2005-03-09 23:50:13 +0000
0ff90d0747- Fix audit_set_pid to try to read a reply, but its non-fatal if no reply. - Remove the read status during init - Change to using pthreads sync mechanism for stopping system - Worker thread should ignore all signals - Change main loop to use select for inbound event handling - Gave pam_loginuid a "failok" option for testing
Steve Grubb
2005-03-08 20:46:48 +0000
21c8b70346- Lots of code cleanups - Added write_pid function to auditd - Added audit_log to libaudit - Don't check file length in foreground mode of auditd - Added *if_enabled functions to send messages only if audit system is enabled - If syscall name is unknown when printing rules, use the syscall number - Rework the build system to produce singly threaded public libraries - Create a multithreaded version of libaudit for the audit daemon's use
Steve Grubb
2005-03-03 22:48:44 +0000
78412f0335- Rename pam_audit to pam_loginuid to reflect what it does - Fix bug in detecting space left on partition - Fix bug in handling of suspended logging
Steve Grubb
2005-02-23 23:24:19 +0000
668644befbFix headers
David Woodhouse
2005-02-23 13:57:24 +0000
19531ff754- Another lib64 correction
Steve Grubb
2005-02-20 20:43:49 +0000
56b158ae01- Change pam install from /lib/security to /%{_lib}/security - Change pam_audit to write loginuid to /proc/pid/loginuid - Add pam_session_close handle - Update to newest kernel headers
Steve Grubb
2005-02-20 20:33:50 +0000
8fd9fa294a- New version - Add R option to auditctl to allow reading rules from file. - Do not allow task creation list to have syscall auditing - Add D option to allow deleting all rules with 1 command - Added pam_audit man page & sample.rules - Mod initscript to call auditctl to load rules at start-up - Write message to log file for daemon start up - Write message that daemon is shutting down - Modify auditd shutdown to wait until logger thread is finished - Add sample rule file to docs
Steve Grubb
2005-02-11 19:22:21 +0000
e88a3e096fReworked auditctl and its man pages. Added admin_space_left option for last chance before running out of disk space.
Steve Grubb
2005-01-08 23:20:29 +0000
75f48032cc- Add disk full and low disk space detection and handling routines - Add max log file size detection and handling routines - Add raw log format routine - Many code cleanups, reorgs, and bug fixing.
Steve Grubb
2005-01-05 19:13:59 +0000
aad93127c6Changed project over to generate .so libs and added man page for auditd.conf
Steve Grubb
2004-12-13 19:27:06 +0000
fb052c51f4Moved the tar.gz files into the lookaside cache. Please refrain from checking tar.gz files into CVS. That is what the lookaside cache is for.
gafton
2004-12-12 21:35:14 +0000
01be97fdb1Updated to new version. Now has config file and outputs a log file.
Steve Grubb
2004-12-10 22:13:10 +0000
72b1292f70Updated to new release.
Steve Grubb
2004-12-03 20:58:39 +0000
c5201dccfbNew version
Steve Grubb
2004-11-19 22:18:07 +0000
bcb2c57a1dFixed an x86_64 PIC code problem.
Steve Grubb
2004-11-15 23:39:57 +0000
2308b460ffCorrected a build bug for IA64.
Steve Grubb
2004-11-15 23:23:40 +0000
5a5010c7f5New version. Reworked makefile, specs, added man pages, daemonized it.
Steve Grubb
2004-11-15 23:03:35 +0000
654a5c922eNew version of audit. Reworked makefile & spec file.
Steve Grubb
2004-11-15 22:58:29 +0000
2c6ba58c1aauto-import changelog data from audit-0.5-1.src.rpm Wed Sep 01 2004 root <root@redhat.com> - - Initial build.
cvsdist
2004-09-09 03:16:50 +0000
5adf4af9f5Setup of module audit
cvsdist
2004-09-09 03:16:45 +0000
David Woodhouse
Steve Grubb
Jesse Keating
Tomáš Mráz
gafton
cvsdist