Changelog for audit-debuginfo-1.7.7-6.el5_3.3.i386.rpm :

* Wed Apr 29 2009 Steve Grubb 1.7.7-6.el5.3.3resolves: #497518 Fix tty audit reporting
* Thu Apr 16 2009 Steve Grubb 1.7.7-6.el5.3.2resolves: #495711 Some audit rules will not load even though they are correct
* Thu Apr 09 2009 Steve Grubb 1.7.7-6.el5.3.1resolves: #494924 auditd memory leak when NOLOG option given
* Thu Dec 11 2008 Steve Grubb 1.7.7-6resolves: #476009 Unknown keyword \"enable_krb5\" in audisp-remote.conf
* Wed Oct 29 2008 Steve Grubb 1.7.7-5resolves: #468719 Need to adjust requires for system-config-audit
* Mon Oct 27 2008 Steve Grubb 1.7.7-4resolves: #468668 aureport/ausearch --start recent regression
* Sun Oct 26 2008 Steve Grubb 1.7.7-3resolves: #467930 AVC denials during upgrade of audit pkgs- Disable GSSAPI support until plugin approach is createdresolves: #446080 Fix a couple problems found in update
* Fri Sep 19 2008 Steve Grubb 1.7.7-2resolves: #446080 New upstream version with many updates
* Mon Apr 21 2008 Steve Grubb 1.6.5-9resolves: #442556 audit rules with >= get corruptedresolves: #438844 buffer overflow in audit_log_user_command, better fix
* Thu Apr 03 2008 Peter Vrabec 1.6.5-8resolves: #438844 buffer overflow in audit_log_user_command- adjust ausearch.patch to audit 1.6.5
* Wed Apr 02 2008 Steve Grubb 1.6.5-7resolves: #438844 buffer overflow in audit_log_user_command- Update ausearch with fixes from auparse, 440086
* Thu Mar 27 2008 Steve Grubb 1.6.5-6resolves: #438844 buffer overflow in audit_log_user_command- Also removed lsb headers from init script
* Fri Mar 14 2008 Steve Grubb 1.6.5-4resolves: #435947 system-config-audit does not run- Also revised patch for audispd memory leak
* Tue Mar 04 2008 Steve Grubb 1.6.5-3resolves: #435329 memory leak in audispd
* Wed Feb 20 2008 Steve Grubb 1.6.5-2resolves: #432866- Fix leaked descriptors in audispd- aureport does not work when run from a cron job- ausearch -m ANOM_PROMISCUOUS did not work because of parse error- ausearch recent keyword was searching since midnight instead of last 10 min- man page updates
* Tue Jan 15 2008 Steve Grubb 1.6.5-1resolves: #234663, #244349- auparse library has been updated- system-config-audit has added- auditd now supports group permissions on audit logs- audit by TTY support added- New multi-threaded audit event dispatcher supporting plugins- node/machine field can be added to audit events- RACF zos remote logging plugin from IBM- week-ago keyword added to aureport/ausearch- auditctl supports errno abbreviation as syscall exit code (-F exit=-EPERM)- audit logging can be resumed with SIGUSR2- New aulastlog utility
* Tue Aug 21 2007 Steve Grubb - 1.5.5-7resolves: #251327 swig was incorrectly incoporating a variable in ppc\'spython bindings causing python tracebacks.
* Tue Aug 14 2007 Steve Grubb - 1.5.5-6Resolves: #251911 segfault in aureport when -if option used
* Wed Aug 01 2007 Steve Grubb - 1.5.5-5- Fix some bugs found in 1.5.6 version of auditResolves: #249759
* Mon Jul 02 2007 Miloslav Trmač - 1.5.5-4- Fix a double free when auditd receives SIGHUPRelated: #235321 audit DAEMON_CONFIG record truncated
* Thu Jun 28 2007 Miloslav Trmač - 1.5.5-3- Add Requires: audit-libs-python to the main package for /sbin/audispd
* Thu Jun 28 2007 Miloslav Trmač - 1.5.5-2- Drop system-config-audit again
* Thu Jun 28 2007 Miloslav Trmač - 1.5.5-1- Add system-config-audit- Fix Python binding compilation on ppc- Fix subtree auditing (Patch by Alexander Viro)
* Wed Jun 27 2007 Steve Grubb 1.5.4-1- Update to latest upstreamResolves: #200784 Add audit parsing libraryResolves: #237788 Init script update
* Fri Apr 27 2007 Steve Grubb 1.3.1-6Resolves: #234923: Adjusted the lspp & capp.rules file for evaluation
* Thu Apr 26 2007 Steve Grubb 1.3.1-5Resolves: #234923: update lspp & capp.rules file for evaluation
* Tue Apr 10 2007 Steve Grubb 1.3.1-4Resolves: #235468 parse DAEMON_END records for subjectResolves: #235321 audit DAEMON_CONFIG record truncatedResolves: #234548 audit-libs-python does not require kernel-headersResolves: #232166 service auditd returns status 0 when the service is stopped
* Mon Mar 12 2007 Steve Grubb 1.3.1-3- Add support for OBJ_PID record typeRelated: #228384
* Tue Mar 06 2007 Steve Grubb 1.3.1-2- Added NISPOM sample rules- Fix ausearch -se option to work for obj labels (#230740)- Fix auditd init script for /usr on netdev (#228528)- updated audit_rule_fieldpair_data to handle perm correctly (#226780)Resolves: #230740 #228528 #226780
* Sun Dec 10 2006 Steve Grubb 1.3.1-1- Fix error messages in ausearch/aureport command options- Add tgkill to S390
* syscall tablesResolves: #218484
* Fri Dec 01 2006 Steve Grubb 1.3-3- Sync timestamps of libaudit.confResolves: #218127
* Thu Nov 30 2006 Steve Grubb 1.3-2- Fix parsing of exit_group syscallsResolves: #217952
* Thu Nov 30 2006 Steve Grubb 1.3-1- Add new msg types- ausearch & aureport implement uid/gid caching- In ausearch & aureport, extract addr when hostname is unknown- In ausearch & aureport, test audit log presence O_RDONLYResolves: #215257- New ausearch/aureport time keywords: recent, this-week, this-month, this-year- Added --add & --delete option to aureport- Update res parsing in config change events- Increase the size on audit daemon buffers- Parse avc_path records in ausearch/aureport- ausearch has new output mode, raw, for extracting events- ausearch/aureport can now read stdin- Rework AVC processing in ausearch/aureport- Added long options to ausearch and aureportResolves: #217870
* Wed Oct 25 2006 Steve Grubb 1.2.9-1- Some auditd config strings were not initialized in aureport (#211443)- Updated man pages- Add Netlabel event types to libaudit- Update aureports to current audit event types- Deprecated all the old audit_rule functions from public API- Drop auparse library for the moment
* Tue Oct 17 2006 Steve Grubb 1.2.8-2- Update to fix libaudit defines- Patch to fix (#208834)
* Sat Sep 30 2006 Steve Grubb 1.2.8-1- Add dist tag and bump version (#208532)- Make internal auditd buffers bigger for context info- Correct address resolving of hostname in logging functions- Do not allow multiple msgtypes in same audit rule in auditctl (#207666)- Only =, != operators for arch & inode fields in auditctl (#206427)- Updated audit message type table- Remove watches from aureport since FS_WATCH is deprecated- Add audit_log_avc back temporarily (#208152)
* Tue Sep 19 2006 Steve Grubb 1.2.7-2- Fix logging messages to use addr if passed.- Apply patches from Tony Jones correcting no kernel support messages- Updated syscall tables for 2.6.18 kernel- Remove deprecated functions: audit_log, audit_log_avc, audit_log_if_enabled- Disallow syscall auditing on exclude list- Improve time handling in ausearch and aureport (#191394)- Attempt to reconstruct full path from relative for searching
* Thu Aug 31 2006 Steve Grubb 1.2.6-3- Rename audit event socket
* Tue Aug 29 2006 Steve Grubb 1.2.6-2- Another minor update to auditctl -p option
* Sun Aug 27 2006 Steve Grubb 1.2.6-1- Apply updates to dispatcher- Fix a couple bugs regarding MLS labels- Resurrect -p option- Tighten rules with exclude filter- Fix parsing issue which lead to segfault in some cases- Fix option parsing to ignore malformed lines
* Sat Aug 19 2006 Jesse Keating - 1.2.5-8- rebuilt with latest binutils to pick up 64K -z commonpagesize on ppc
* (#203001)
* Wed Aug 09 2006 Dan Walsh 1.2.5-7- Remove debug lines from dispatcher
* Thu Aug 03 2006 Dan Walsh 1.2.5-6- Change audisp to use a named pipe
* Sat Jul 22 2006 Dan Walsh 1.2.5-5- Fix dispatcher to handle sigchld- Fix library location for 64 bit- Add Prereq
* Sat Jul 22 2006 Dan Walsh 1.2.5-4- Eliminate avc package from audisp
* Thu Jul 20 2006 Dan Walsh 1.2.5-3- More fixes for setroubleshoot to handle failing plugin
* Sat Jul 15 2006 Dan Walsh 1.2.5-2- Fixes for setroubleshoot
* Fri Jul 14 2006 Steve Grubb 1.2.5-1- Switch out dispatcher- Fix bug upgrading rule types
* Thu Jul 13 2006 Jesse Keating - 1.2.4-1.1- rebuild
* Sat Jul 01 2006 Steve Grubb 1.2.4-1- Add support for the new filter key- Update syscall tables for 2.6.17- Add audit failure query function- Switch out gethostbyname call with getaddrinfo- Add audit by obj capability for 2.6.18 kernel- Ausearch & aureport now fail if no args to -te- New auditd.conf option to choose blocking/non-blocking dispatcher comm- Ausearch improved search by label
* Fri May 26 2006 Steve Grubb 1.2.3-1- Apply patch to ensure watches only associate with exit filter- Apply patch to correctly show new operators when new listing format is used- Apply patch to pull kernel\'s audit.h into python bindings- Collect signal sender\'s context
* Wed May 17 2006 David Woodhouse 1.2.2-2- Require kernel-headers, not glibc-kernheaders. Again.
* Sat May 13 2006 Steve Grubb 1.2.2-1- Updates for new glibc-kernheaders- Change auditctl to collect list of rules then delete them on -D- Update capp.rules and lspp.rules to comment out rules for the possible list- Add new message types- Support sigusr1 sender identity of newer kernels- Add support for ppid in auditctl and ausearch- fix auditctl to trim the \'/\' from watches- Move audit daemon config files to /etc/audit for better SE Linux protection
* Wed Apr 26 2006 David Woodhouse 1.2.1-2- Require kernel-headers, not glibc-kernheaders- Fix redefinition of audit_rule_data with new kernel headers- Remove abuse of __KERNEL__ in lookup_table.c
* Mon Apr 17 2006 Steve Grubb 1.2.1-1- New message type for trusted apps- Add new keywords today, yesterday, now for ausearch and aureport- Make audit_log_user_avc_message really send to syslog on error- Updated syscall tables in auditctl- Deprecated the \'possible\' action for syscall rules in auditctl- Update watch code to use file syscalls instead of \'all\' in auditctl
* Sat Apr 08 2006 Steve Grubb 1.2-1- Add support for new file system auditing kernel subsystem
* Fri Apr 07 2006 Steve Grubb 1.1.6-1- New message types- Support new rule format found in 2.6.17 and later kernels- Add support for audit by role, clearance, type, sensitivity
* Mon Mar 06 2006 Steve Grubb 1.1.5-1- Changed audit_log_semanage_message to take new params- In aureport, add class between syscall and permission in avc report- Fix bug where fsync is called in debug mode- Add optional support for tty in SYSCALL records for ausearch/aureport- Reinstate legacy rule operator support- Add man pages- Auditd ignore most signals
* Fri Feb 10 2006 Jesse Keating - 1.1.4-5.1- bump again for double-long bug on ppc(64)
* Fri Feb 10 2006 Steve Grubb 1.1.4-5- Change audit_log_semanage_message to check strlen as well as NULL.
* Thu Feb 09 2006 Steve Grubb 1.1.4-3- Change audit_log_semanage_message to take new params.
* Wed Feb 08 2006 Steve Grubb 1.1.4-1- Fix bug in autrace where it didn\'t run on kernels without file watch support- Add syslog message to auditd saying what program was started for dispatcher- Remove audit_send_user from public api- Fix bug in USER_LOGIN messages where ausearch does not translate msg=\'uid=500: into acct name (#178102).- Change comm with dispatcher to socketpair from pipe- Change auditd to use custom daemonize to avoid race in init scripts- Update error message when deleting a rule that doesn\'t exist (#176239)- Call shutdown_dispatcher when auditd stops- Add new logging function audit_log_semanage_message
* Tue Feb 07 2006 Jesse Keating - 1.1.3-1.1- rebuilt for new gcc4.1 snapshot and glibc changes
* Thu Jan 05 2006 Steve Grubb 1.1.3-1- Add timestamp to daemon_config messages (#174865)- Add error checking of year for aureport & ausearch- Treat af_unix sockets as files for searching and reporting- Update capp & lspp rules to combine syscalls for higher performance- Adjusted the chkconfig line for auditd to start a little earlier- Added skeleton program to docs for people to write their own dispatcher with- Apply patch from Ulrich Drepper that optimizes resource utilization- Change ausearch and aureport to unlocked IO
* Mon Dec 05 2005 Steve Grubb 1.1.2-1- Add more message types
* Wed Nov 30 2005 Steve Grubb 1.1.1-1- Add support for alpha processors- Update the audisp code- Add locale code in ausearch and aureport- Add new rule operator patch- Add exclude filter patch- Cleanup make files- Add python bindings
* Wed Nov 09 2005 Steve Grubb 1.1-1- Add initial version of audisp. Just a placeholder at this point- Remove -t from auditctl
* Mon Nov 07 2005 Steve Grubb 1.0.12-1- Add 2 more summary reports- Add 2 more message types