audit-vl.spec 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614
  1. %define sca_version 0.4.10
  2. %define sca_release 2
  3. Summary: User space tools for 2.6 kernel auditing
  4. Name: audit
  5. Version: 1.7.18
  6. Release: 2%{?_dist_release}
  7. License: GPLv2+
  8. Group: System Environment/Daemons
  9. URL: http://people.redhat.com/sgrubb/audit/
  10. Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
  11. Source1: system-config-audit-ja.po
  12. Patch10: audit-1.7.18-pthread.patch
  13. Patch11: audit-1.7.18-krb5.patch
  14. Patch12: audit-1.7.18-libaudit.patch
  15. BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
  16. BuildRequires: gettext intltool libtool swig python-devel
  17. BuildRequires: tcp_wrappers
  18. BuildRequires: krb5-devel
  19. BuildRequires: kernel-headers >= 2.6.18
  20. BuildRequires: automake >= 1.9
  21. BuildRequires: autoconf >= 2.59
  22. Requires: %{name}-libs = %{version}-%{release}
  23. Requires: chkconfig
  24. Requires(pre): coreutils
  25. %description
  26. The audit package contains the user space utilities for
  27. storing and searching the audit records generate by
  28. the audit subsystem in the Linux 2.6 kernel.
  29. %package libs
  30. Summary: Dynamic library for libaudit
  31. License: LGPLv2+
  32. Group: Development/Libraries
  33. %description libs
  34. The audit-libs package contains the dynamic libraries needed for
  35. applications to use the audit framework.
  36. %package libs-devel
  37. Summary: Header files and static library for libaudit
  38. License: LGPLv2+
  39. Group: Development/Libraries
  40. Requires: %{name}-libs = %{version}-%{release}
  41. Requires: kernel-headers >= 2.6.18
  42. %description libs-devel
  43. The audit-libs-devel package contains the static libraries and header
  44. files needed for developing applications that need to use the audit
  45. framework libraries.
  46. %package libs-python
  47. Summary: Python bindings for libaudit
  48. License: LGPLv2+
  49. Group: Development/Libraries
  50. Requires: %{name}-libs = %{version}-%{release}
  51. %description libs-python
  52. The audit-libs-python package contains the bindings so that libaudit
  53. and libauparse can be used by python.
  54. %package -n audispd-plugins
  55. Summary: Plugins for the audit event dispatcher
  56. License: GPLv2+
  57. Group: System Environment/Daemons
  58. BuildRequires: openldap-devel
  59. Requires: %{name} = %{version}-%{release}
  60. Requires: %{name}-libs = %{version}-%{release}
  61. Requires: openldap
  62. %description -n audispd-plugins
  63. The audispd-plugins package provides plugins for the real-time
  64. interface to the audit system, audispd. These plugins can do things
  65. like relay events to remote machines or analyze events for suspicious
  66. behavior.
  67. %package -n system-config-audit
  68. Summary: Utility for editing audit configuration
  69. Version: %{sca_version}
  70. Release: %{sca_release}%{?_dist_release}
  71. License: GPLv2+
  72. Group: Applications/System
  73. BuildRequires: desktop-file-utils
  74. Requires: pygtk2-libglade usermode usermode-gtk
  75. %description -n system-config-audit
  76. A graphical utility for editing audit configuration.
  77. %prep
  78. %setup -q
  79. %patch10 -p1
  80. %patch11 -p1
  81. %patch12 -p1
  82. cp -f %{SOURCE1} system-config-audit/po/ja.po
  83. %build
  84. (cd system-config-audit; %configure)
  85. %configure --sbindir=/sbin --libdir=/%{_lib} --with-libwrap --enable-gssapi-krb5=yes
  86. make %{?_smp_mflags}
  87. %install
  88. rm -rf $RPM_BUILD_ROOT
  89. mkdir -p $RPM_BUILD_ROOT/{sbin,etc/{sysconfig,audispd/plugins.d,rc.d/init.d}}
  90. mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
  91. mkdir -p $RPM_BUILD_ROOT/%{_lib}
  92. mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
  93. mkdir -p $RPM_BUILD_ROOT/%{_var}/log/audit
  94. make DESTDIR=$RPM_BUILD_ROOT %{?_smp_mflags} install
  95. make -C system-config-audit DESTDIR=$RPM_BUILD_ROOT install-fedora
  96. mkdir -p $RPM_BUILD_ROOT/%{_libdir}
  97. # This winds up in the wrong place when libtool is involved
  98. mv $RPM_BUILD_ROOT/%{_lib}/libaudit.a $RPM_BUILD_ROOT%{_libdir}
  99. mv $RPM_BUILD_ROOT/%{_lib}/libauparse.a $RPM_BUILD_ROOT%{_libdir}
  100. curdir=`pwd`
  101. cd $RPM_BUILD_ROOT/%{_libdir}
  102. LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.*.*.*\``
  103. ln -s ../../%{_lib}/$LIBNAME libaudit.so
  104. LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.*.*.*\``
  105. ln -s ../../%{_lib}/$LIBNAME libauparse.so
  106. cd $curdir
  107. # Remove these items so they don't get picked up.
  108. rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
  109. rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
  110. rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.la
  111. rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.la
  112. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_audit.a
  113. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_audit.la
  114. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_auparse.a
  115. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_auparse.la
  116. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/auparse.a
  117. rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/auparse.la
  118. # On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
  119. touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
  120. %find_lang system-config-audit
  121. desktop-file-install \
  122. --dir $RPM_BUILD_ROOT/%{_datadir}/applications \
  123. --delete-original \
  124. system-config-audit/system-config-audit.desktop
  125. #% check
  126. #make check
  127. %clean
  128. rm -rf $RPM_BUILD_ROOT
  129. rm -rf zos-remote-policy
  130. %post libs -p /sbin/ldconfig
  131. %post
  132. /sbin/chkconfig --add auditd
  133. # This is to migrate users from audit-1.0.x installations
  134. if [ -f /etc/auditd.conf ]; then
  135. mv /etc/auditd.conf /etc/audit/auditd.conf
  136. fi
  137. if [ -f /etc/audit.rules ]; then
  138. mv /etc/audit.rules /etc/audit/audit.rules
  139. fi
  140. # This is to enable the dispatcher option which was commented out
  141. if [ -f /etc/audit/auditd.conf ]; then
  142. grep '^dispatcher' /etc/audit/auditd.conf >/dev/null
  143. if [ $? -eq 1 ] ; then
  144. tmp=`mktemp /etc/audit/auditd-post.XXXXXX`
  145. if [ -n $tmp ]; then
  146. sed 's|^#dispatcher|dispatcher|g' /etc/audit/auditd.conf > $tmp && \
  147. cat $tmp > /etc/audit/auditd.conf
  148. rm -f $tmp
  149. fi
  150. fi
  151. fi
  152. %preun
  153. if [ $1 -eq 0 ]; then
  154. /sbin/service auditd stop > /dev/null 2>&1
  155. /sbin/chkconfig --del auditd
  156. fi
  157. %postun libs -p /sbin/ldconfig
  158. %postun
  159. if [ $1 -ge 1 ]; then
  160. /sbin/service auditd condrestart > /dev/null 2>&1 || :
  161. fi
  162. %files libs
  163. %defattr(-,root,root)
  164. %attr(755,root,root) /%{_lib}/libaudit.*
  165. %attr(755,root,root) /%{_lib}/libauparse.*
  166. %config(noreplace) %attr(640,root,root) /etc/libaudit.conf
  167. %files libs-devel
  168. %defattr(-,root,root)
  169. %doc contrib/skeleton.c contrib/plugin
  170. %{_libdir}/libaudit.a
  171. %{_libdir}/libauparse.a
  172. %{_libdir}/libaudit.so
  173. %{_libdir}/libauparse.so
  174. %{_includedir}/libaudit.h
  175. %{_includedir}/auparse.h
  176. %{_includedir}/auparse-defs.h
  177. %{_mandir}/man3/*
  178. %files libs-python
  179. %defattr(-,root,root)
  180. %attr(755,root,root) %{python_sitearch}/_audit.so
  181. %attr(755,root,root) %{python_sitearch}/auparse.so
  182. %{python_sitearch}/audit.py*
  183. %files
  184. %defattr(-,root,root,-)
  185. %doc README COPYING ChangeLog contrib/capp.rules contrib/nispom.rules contrib/lspp.rules contrib/stig.rules init.d/auditd.cron
  186. %attr(644,root,root) %{_mandir}/man8/audispd.8.gz
  187. %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
  188. %attr(644,root,root) %{_mandir}/man8/auditd.8.gz
  189. %attr(644,root,root) %{_mandir}/man8/aureport.8.gz
  190. %attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
  191. %attr(644,root,root) %{_mandir}/man8/autrace.8.gz
  192. %attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
  193. %attr(644,root,root) %{_mandir}/man8/aulast.8.gz
  194. %attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
  195. %attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
  196. %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
  197. %attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz
  198. %attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
  199. %attr(750,root,root) /sbin/auditctl
  200. %attr(750,root,root) /sbin/auditd
  201. %attr(755,root,root) /sbin/ausearch
  202. %attr(755,root,root) /sbin/aureport
  203. %attr(750,root,root) /sbin/autrace
  204. %attr(750,root,root) /sbin/audispd
  205. %attr(750,root,root) %{_bindir}/aulastlog
  206. %attr(750,root,root) %{_bindir}/aulast
  207. %attr(755,root,root) %{_bindir}/ausyscall
  208. %attr(755,root,root) /etc/rc.d/init.d/auditd
  209. %attr(750,root,root) %{_var}/log/audit
  210. %attr(750,root,root) %dir /etc/audit
  211. %attr(750,root,root) %dir /etc/audisp
  212. %attr(750,root,root) %dir /etc/audisp/plugins.d
  213. %attr(750,root,root) %dir %{_libdir}/audit
  214. %config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
  215. %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
  216. %config(noreplace) %attr(640,root,root) /etc/sysconfig/auditd
  217. %config(noreplace) %attr(640,root,root) /etc/audisp/audispd.conf
  218. %config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/af_unix.conf
  219. %files -n audispd-plugins
  220. %defattr(-,root,root,-)
  221. %attr(640,root,root) /etc/audisp/plugins.d/syslog.conf
  222. %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
  223. %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz
  224. %config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/audispd-zos-remote.conf
  225. %config(noreplace) %attr(640,root,root) /etc/audisp/zos-remote.conf
  226. %attr(750,root,root) /sbin/audispd-zos-remote
  227. %config(noreplace) %attr(640,root,root) /etc/audisp/audisp-remote.conf
  228. %config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/au-remote.conf
  229. %attr(750,root,root) /sbin/audisp-remote
  230. %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
  231. %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
  232. %files -n system-config-audit -f system-config-audit.lang
  233. %defattr(-,root,root,-)
  234. %doc system-config-audit/AUTHORS
  235. %doc system-config-audit/COPYING
  236. %doc system-config-audit/ChangeLog
  237. %doc system-config-audit/NEWS
  238. %doc system-config-audit/README
  239. %{_bindir}/system-config-audit
  240. %{_datadir}/applications/system-config-audit.desktop
  241. %{_datadir}/system-config-audit
  242. %{_libexecdir}/system-config-audit-server-real
  243. %{_libexecdir}/system-config-audit-server
  244. %config(noreplace) %{_sysconfdir}/pam.d/system-config-audit-server
  245. %config(noreplace) %{_sysconfdir}/security/console.apps/system-config-audit-server
  246. %changelog
  247. * Wed Feb 15 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.7.18-2
  248. - rebuild with python-2.7.2
  249. - add Patch12 (audit-1.7.18-libaudit.patch)
  250. * Sun Apr 03 2011 Daisuke SUZUKI <daisuke@linux.or.jp> 1.7.18-1
  251. - new upstream release
  252. - rebuild with krb5-1.8.2
  253. * Fri Feb 12 2010 MATSUBAYASHI Kohji <shaolin@vinelinux.org> - 1.7.6-6
  254. - forgot to increment sca_release macro (why on earth is sca_release
  255. individually defined from main package's release number anyway?)
  256. * Fri Feb 12 2010 MATSUBAYASHI Kohji <shaolin@vinelinux.org> - 1.7.6-5
  257. - rebuilt with gcc-4.4.3-3 on ppc
  258. * Fri Feb 5 2010 MATSUBAYASHI Kohji <shaolin@vinelinux.org> - 1.7.6-4
  259. - rebuilt with rpm-4.8.0-3 (on ppc)
  260. * Tue Feb 02 2010 Shu KONNO <owa@bg.wakwak.com> 1.7.6-3
  261. - rebuild with python-2.6
  262. * Sat Apr 04 2009 Daisuke SUZUKI <daisuke@linux.or.jp> 1.7.6-2
  263. - rebuild with openldap-2.4.11
  264. * Mon Sep 15 2008 Daisuke SUZUKI <daisuke@linux.or.jp> 1.7.6-1
  265. - initial build for Vine Linux
  266. - disable krb5, prelude and selinux
  267. - add ja.po (XXX: minimal)
  268. * Wed Sep 11 2008 Steve Grubb <sgrubb@redhat.com> 1.7.6-1
  269. - Add subject to audit daemon events (Chu Li)
  270. - Add tcp_wrappers support for auditd
  271. - Updated syscall tables for 2.6.27 kernel
  272. - Audit connect/disconnect of remote clients
  273. - Add GSS/Kerberos encryption to the remote protocol (DJ Delorie)
  274. * Mon Aug 25 2008 Steve Grubb <sgrubb@redhat.com> 1.7.5-1
  275. - Update system-config-audit to 0.4.8
  276. - Whole lot of bug fixes - see ChangeLog for details
  277. - Reimplement auditd main loop using libev
  278. - Add TCP listener to auditd to receive remote events
  279. - Fix scheduler problem (#457061)
  280. * Thu Jul 03 2008 Steve Grubb <sgrubb@redhat.com> 1.7.4-2
  281. - Move ausearch-expression to main package (#453437)
  282. * Mon May 19 2008 Steve Grubb <sgrubb@redhat.com> 1.7.4-1
  283. - Fix interpreting of keys in syscall records
  284. - Don't error on name=(null) PATH records in ausearch/report
  285. - Add key report to aureport
  286. - Update system-config-audit to 0.4.7 (Miloslav Trmac)
  287. - Add support for the filetype field option in auditctl new to 2.6.26 kernels
  288. * Fri May 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.3-1
  289. - Fix output of keys in ausearch interpretted mode
  290. - Fix ausearch/report --start now to not be reset to midnight
  291. - audispd now has a priority boost config option
  292. - Look for laddr in avcs reported via prelude
  293. - Detect page 0 mmaps and alert via prelude
  294. * Fri Apr 18 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-6
  295. - Fix overflow in audit_log_user_command, better (#438840)
  296. - ausearch was not matching path in avc records
  297. - audisp-prelude attempt to reposition index after examining each type
  298. - correct building of mls policy
  299. - Fix auparse iterating in auparse_find_field and next_field
  300. - Don't alert on USER_AVC's - they are not quite right
  301. * Tue Apr 08 2008 Steve Grubb <sgrubb@redhat.com> 1.7.1-1
  302. - Fix buffer overflow in audit_log_user_command, again (#438840)
  303. - Fix memory leak in EOE code in auditd (#440075)
  304. - In auditctl, don't use new operators in legacy rule format
  305. - Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
  306. * Fri Apr 04 2008 Steve Grubb <sgrubb@redhat.com> 1.7-3
  307. - Fix memleak in auditd eoe code
  308. * Tue Apr 01 2008 Steve Grubb <sgrubb@redhat.com> 1.7-2
  309. - Remove LSB headers from init scripts
  310. - Fix buffer overflow in audit_log_user_command again
  311. * Sun Mar 30 2008 Steve Grubb <sgrubb@redhat.com> 1.7-1
  312. - Handle user space avcs in prelude plugin
  313. - Fix watched account login detection for some failed login attempts
  314. - Couple fixups in audit logging functions (Miloslav Trmac)
  315. - Add support in auditctl for virtual keys
  316. - auparse_find_field_next was not iterating correctly, fixed it
  317. - Add idmef alerts for access or execution of watched file
  318. - Fix buffer overflow in audit_log_user_command
  319. - Add basic remote logging plugin - only sends & no flow control
  320. - Update ausearch with interpret fixes from auparse
  321. * Sun Mar 09 2008 Steve Grubb <sgrubb@redhat.com> 1.6.9-1
  322. - Apply hidden attribute cleanup patch (Miloslav Trmac)
  323. - Apply auparse expression interface patch (Miloslav Trmac)
  324. - Fix potential memleak in audit event dispatcher
  325. - Update system-config-audit to version 0.4.6 (Miloslav Trmac)
  326. - audisp-prelude alerts now controlled by config file
  327. - Updated syscall table for 2.6.25 kernel
  328. - Apply patch correcting acct field being misencoded (Miloslav Trmac)
  329. - Added watched account login detection for prelude plugin
  330. * Thu Feb 14 2008 Steve Grubb <sgrubb@redhat.com> 1.6.8-1
  331. - Update for gcc 4.3
  332. - Cleanup descriptors in audispd before running plugin
  333. - Fix 'recent' keyword for aureport/search
  334. - Fix SE Linux policy for zos_remote plugin
  335. - Add event type for group password authentication attempts
  336. - Couple of updates to the translation tables
  337. - Add detection of failed group authentication to audisp-prelude
  338. * Thu Jan 31 2008 Steve Grubb <sgrubb@redhat.com> 1.6.7-2
  339. - In ausearch/report, prefer -if to stdin
  340. - In ausearch/report, add new command line option --input-logs (#428860)
  341. - Updated audisp-prelude based on feedback from prelude-devel
  342. - Added prelude alert for promiscuous socket being opened
  343. - Added prelude alert for SE Linux policy enforcement changes
  344. - Added prelude alerts for Forbidden Login Locations and Time
  345. - Applied patch to auparse fixing error handling of searching by
  346. interpreted value (Miloslav Trmac)
  347. * Sat Jan 19 2008 Steve Grubb <sgrubb@redhat.com> 1.6.6-1
  348. - Add prelude IDS plugin for IDMEF alerts
  349. - Add --user option to aulastlog command
  350. - Use desktop-file-install for system-config-audit
  351. - Avoid touching auditd.conf most of the time (#408501)
  352. * Fri Jan 11 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-3
  353. - Updates for spec file review
  354. - Adjust permission on selinux policy file
  355. * Mon Jan 07 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-1
  356. - Fix config parser to allow either 0640 or 0600 for audit logs (#427062)
  357. - Check for audit log being writable by owner in auditd
  358. - If auditd logging was suspended, it can be resumed with SIGUSR2 (#251639)
  359. - Updated CAPP, LSPP, and NISPOM rules for new capabilities
  360. - Added aulastlog utility
  361. * Sun Dec 30 2007 Steve Grubb <sgrubb@redhat.com> 1.6.4-3
  362. - Allow 0600 file perms for audit logs
  363. * Sat Dec 29 2007 Steve Grubb <sgrubb@redhat.com> 1.6.4-1
  364. - fchmod of log file was on wrong variable (#426934)
  365. - Allow use of errno strings for exit codes in audit rules
  366. * Sat Dec 29 2007 Miloslav Trmač <mitr@redhat.com> - 1.6.3-2
  367. - Don't fchmod() /dev/null to mode 0400 (#426934)
  368. * Thu Dec 27 2007 Steve Grubb <sgrubb@redhat.com> 1.6.3-1
  369. - Add kernel release string to DEAMON_START events
  370. - Fix keep_logs when num_logs option disabled (#325561)
  371. - Fix auparse to handle node fields for syscall records
  372. - Update system-config-audit to version 0.4.5 (Miloslav Trmac)
  373. - Add keyword week-ago to aureport & ausearch start/end times
  374. - Fix audit log permissions on rotate. If group is root 0400, otherwise 0440
  375. - Add RACF zos remote audispd plugin (Klaus Kiwi)
  376. - Add event queue overflow action to audispd
  377. * Mon Oct 1 2007 Steve Grubb <sgrubb@redhat.com> 1.6.2-2
  378. - Don't retry if the rt queue is full.
  379. * Tue Sep 25 2007 Steve Grubb <sgrubb@redhat.com> 1.6.2-1
  380. - Add support for searching by posix regular expressions in auparse
  381. - Route DEAMON events into rt interface
  382. - If event pipe is full, try again after doing local logging
  383. - Optionally add node/machine name to records in audit daemon
  384. - Update ausearch/aureport to specify nodes to search on
  385. - Fix segfault interpretting saddr fields in avcs
  386. * Thu Sep 6 2007 Steve Grubb <sgrubb@redhat.com> 1.6.1-2
  387. - Fix uninitialized variable in auparse (John Dennis)
  388. * Sun Sep 2 2007 Steve Grubb <sgrubb@redhat.com> 1.6.1-1
  389. - External plugin support in place
  390. - Fix reference counting in auparse python bindings (#263961)
  391. - Moved default af_unix plugin socket to /var/run/audispd_events
  392. * Wed Aug 29 2007 Steve Grubb <sgrubb@redhat.com> 1.6-3
  393. - Add newline to audispd string formatted events
  394. * Tue Aug 28 2007 Steve Grubb <sgrubb@redhat.com> 1.6-2
  395. - spec file cleanups
  396. - Update to s-c-audit 0.4.3
  397. * Mon Aug 27 2007 Steve Grubb <sgrubb@redhat.com> 1.6-1
  398. - Update Licence tags
  399. - Adding perm field should not set syscall added flag in auditctl
  400. - Fix segfault when aureport -if option is used
  401. - Fix auditctl to better check keys on rule lines
  402. - Add support for audit by TTY and other new event types
  403. - Auditd config option for group permission of audit logs
  404. - Swig messed up a variable in ppc's python bindings causing crashes. (#251327)
  405. - New audit event dispatcher
  406. - Update syscall tables for 2.6.23 kernel
  407. * Wed Jul 25 2007 Steve Grubb <sgrubb@redhat.com> 1.5.6-1
  408. - Fix potential buffer overflow in print clone flags of auparse
  409. - Fix python traceback parsing watches without perm statement (Miloslav Trmac)
  410. - Update auditctl to handle legacy kernels when putting a watch on a dir
  411. - Fix acct interpretation in auparse
  412. * Tue Jul 17 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-5
  413. - Fix a double free when auditd receives SIGHUP
  414. - Move the system-config-audit menu entry to the Administration menu
  415. * Tue Jul 10 2007 Steve Grubb <sgrubb@redhat.com> 1.5.5-1
  416. - Add system-config-audit (Miloslav Trmac)
  417. - Correct bug in audit_make_equivalent function (Al Viro)
  418. * Tue Jun 26 2007 Steve Grubb <sgrubb@redhat.com> 1.5.4-1
  419. - Add feed interface to auparse library (John Dennis)
  420. - Apply patch to libauparse for unresolved symbols (#241178)
  421. - Apply patch to add line numbers for file events in libauparse (John Dennis)
  422. - Change seresults to seresult in libauparse (John Dennis)
  423. - Add unit32_t definition to swig (#244210)
  424. - Add support for directory auditing
  425. - Update acct field to be escaped
  426. * Tue May 01 2007 Steve Grubb <sgrubb@redhat.com> 1.5.3-1
  427. - Change buffer size to prevent truncation of DAEMON events with large labels
  428. - Fix memory leaks in auparse (John Dennis)
  429. - Update syscall tables for 2.6.21 kernel
  430. - Update capp & lspp rules
  431. - New python bindings for libauparse (John Dennis)
  432. * Thu Apr 04 2007 Steve Grubb <sgrubb@redhat.com> 1.5.2-1
  433. - New event dispatcher (James Antill)
  434. - Apply patches fixing man pages and Makefile.am (Philipp Hahn)
  435. - Apply patch correcting python libs permissions (Philipp Hahn)
  436. - Fix auditd segfault on reload
  437. - Fix bug in auparse library for file pointers and descriptors
  438. - Extract subject information out of daemon events for ausearch
  439. * Thu Mar 29 2007 Steve Grubb <sgrubb@redhat.com> 1.5.1-2
  440. - Remove requires kernel-headers for python-libs
  441. - Apply patch to prevent segfaults on auditd reload
  442. * Tue Mar 20 2007 Steve Grubb <sgrubb@redhat.com> 1.5.1-1
  443. - Updated autrace to monitor *at syscalls
  444. - Add support in libaudit for AUDIT_BIT_TEST(^) and AUDIT_MASK_TEST (&)
  445. - Finish reworking auditd config parser
  446. - In auparse, interpret open, fcntl, and clone flags
  447. - In auparse, when interpreting execve record types, run args through unencode
  448. - Add support for OBJ_PID message type
  449. - Event dispatcher updates
  450. * Fri Mar 2 2007 Steve Grubb <sgrubb@redhat.com> 1.5-2
  451. - rebuild
  452. * Fri Mar 2 2007 Steve Grubb <sgrubb@redhat.com> 1.5-1
  453. - NEW audit dispatcher program & plugin framework
  454. - Correct hidden variables in libauparse
  455. - Added NISPOM sample rules
  456. - Verify accessibility of files passed in auparse_init
  457. - Fix bug in parser library interpreting socketcalls
  458. - Add support for stdio FILE pointer in auparse_init
  459. - Adjust init script to allow anyone to status auditd (#230626)
  460. * Tue Feb 20 2007 Steve Grubb <sgrubb@redhat.com> 1.4.2-1
  461. - Add man pages
  462. - Reduce text relocations in parser library
  463. - Add -n option to auditd for no fork
  464. - Add exec option to space_left, admin_space_left, disk_full,
  465. and disk_error - eg EXEC /usr/local/script
  466. * Fri Feb 16 2007 Steve Grubb <sgrubb@redhat.com> 1.4.1-1
  467. - updated audit_rule_fieldpair_data to handle perm correctly (#226780)
  468. - Finished search options for audit parsing library
  469. - Fix ausearch -se to work correctly
  470. - Fix auditd init script for /usr on netdev (#228528)
  471. - Parse avc seperms better when there are more than one
  472. * Sun Feb 04 2007 Steve Grubb <sgrubb@redhat.com> 1.4-1
  473. - New report about authentication attempts
  474. - Updates for python 2.5
  475. - update autrace to have resource usage mode
  476. - update auditctl to support immutable config
  477. - added audit_log_user_command function to libaudit api
  478. - interpret capabilities
  479. - added audit event parsing library
  480. - updates for 2.6.20 kernel
  481. * Sun Dec 10 2006 Steve Grubb <sgrubb@redhat.com> 1.3.1-2
  482. - Make more adjustments for python 2.5
  483. * Sun Dec 10 2006 Steve Grubb <sgrubb@redhat.com> 1.3.1-1
  484. - Fix a couple parsing problems (#217952)
  485. - Add tgkill to S390* syscall tables (#218484)
  486. - Fix error messages in ausearch/aureport
  487. * Wed Dec 6 2006 Jeremy Katz <katzj@redhat.com> - 1.3-4
  488. - rebuild against python 2.5
  489. * Thu Nov 30 2006 Steve Grubb <sgrubb@redhat.com> 1.3-3
  490. - Fix timestamp for libaudit.conf (#218053)
  491. * Thu Nov 30 2006 Steve Grubb <sgrubb@redhat.com> 1.3-2
  492. - Fix minor parsing problem and add new msg types
  493. * Tue Nov 28 2006 Steve Grubb <sgrubb@redhat.com> 1.3-1
  494. - ausearch & aureport implement uid/gid caching
  495. - In ausearch & aureport, extract addr when hostname is unknown
  496. - In ausearch & aureport, test audit log presence O_RDONLY
  497. - New ausearch/aureport time keywords: recent, this-week, this-month, this-year
  498. - Added --add & --delete option to aureport
  499. - Update res parsing in config change events
  500. - Increase the size on audit daemon buffers
  501. - Parse avc_path records in ausearch/aureport
  502. - ausearch has new output mode, raw, for extracting events
  503. - ausearch/aureport can now read stdin
  504. - Rework AVC processing in ausearch/aureport
  505. - Added long options to ausearch and aureport
  506. * Tue Oct 24 2006 Steve Grubb <sgrubb@redhat.com> 1.2.9-1
  507. - In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834)
  508. - Fix some defines in libaudit.h
  509. - Some auditd config strings were not initialized in aureport (#211443)
  510. - Updated man pages
  511. - Add Netlabel event types to libaudit
  512. - Update aureports to current audit event types
  513. - Update autrace a little
  514. - Deprecated all the old audit_rule functions from public API
  515. - Drop auparse library for the moment
  516. * Fri Sep 29 2006 Steve Grubb <sgrubb@redhat.com> 1.2.8-1
  517. - Add dist tag and bump version (#208532)
  518. - Make internal auditd buffers bigger for context info
  519. - Correct address resolving of hostname in logging functions
  520. - Do not allow multiple msgtypes in same audit rule in auditctl (#207666)
  521. - Only =, != operators for arch & inode fields in auditctl (#206427)
  522. - Updated audit message type table
  523. - Remove watches from aureport since FS_WATCH is deprecated
  524. - Add audit_log_avc back temporarily (#208152)