2
- Fix interpreting of keys in syscall records
3
- Interpret audit rule config change list fields
4
- Don't error on name=(null) PATH records in ausearch/report
5
- Add key report to aureport
6
- Fix --end today to be now
7
- Added python bindings for auparse_goto_record_num
8
- Update system-config-audit to 0.4.7 (Miloslav Trmac)
9
- Add support for the filetype field option in auditctl
10
- In audispd boost priority after starting children
13
- Fix path processing in AVC records.
14
- auparse_find_field_next() wasn't resetting field ptr going to next record.
15
- auparse_find_field() wasn't checking current field before iterating
16
- cleanup some string handling in audisp-prelude plugin
17
- Update auditctl man page
18
- Fix output of keys in ausearch interpretted mode
19
- Fix ausearch/report --start now to not be reset to midnight
20
- Added auparse_goto_record_num function
21
- Prelude plugin now uses auparse_goto_record_num to avoid skipping a record
22
- audispd now has a priority boost config option
23
- Look for laddr in avcs reported via prelude
24
- Detect page 0 mmaps and alert via prelude
27
- gen_table.c now includes IPC defines to avoid kernel headers wild goose chase
28
- ausyscall program added for cross referencing syscall name and number info
29
- Add login session ID search capability to ausearch
32
- Remove LSB headers info for init scripts
33
- Fix buffer overflow in audit_log_user_command, again (#438840)
34
- Fix memory leak in EOE code in auditd (#440075)
35
- In auditctl, don't use new operators in legacy rule format
36
- Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
37
- Add example STIG rules file
38
- Add string table lookup performance improvement patch (Miloslav Trmac)
39
- auparse_find_field_next performance improvement
42
- Improve input error handling in audispd
43
- Improve end of event detection in auparse library
44
- Improve handling of abstract namespaces
45
- Add test mode for prelude plugin
46
- Handle user space avcs in prelude plugin
47
- Audit event serial number now recorded in idmef alert
48
- Add --just-one option to ausearch
49
- Fix watched account login detection for some failed login attempts
50
- Couple fixups in audit logging functions (Miloslav Trmac)
51
- Add support in auditctl for virtual keys
52
- Added new type for user space MAC policy load events
53
- auparse_find_field_next was not iterating correctly, fixed it
54
- Add idmef alerts for access or execution of watched file
55
- Fix buffer overflow in audit_log_user_command
56
- Add basic remote logging plugin - only sends & no flow control
57
- Update ausearch with interpret fixes from auparse
60
- Apply hidden attribute cleanup patch (Miloslav Trmac)
61
- Apply auparse expression interface patch (Miloslav Trmac)
62
- Fix potential memleak in audit event dispatcher
63
- Change default audispd queue depth to 80
64
- Update system-config-audit to version 0.4.6 (Miloslav Trmac)
65
- audisp-prelude alerts now controlled by config file
66
- Updated syscall table for 2.6.25 kernel
67
- Apply patch correcting acct field being misencoded (Miloslav Trmac)
68
- Added watched account login detection for prelude plugin
72
- Cleanup descriptors in audispd before running plugin
73
- Fix 'recent' keyword for aureport/search
74
- Fix SE Linux policy for zos_remote plugin
75
- Add event type for group password authentication attempts
76
- Couple of updates to the translation tables
77
- Add detection of failed group authentication to audisp-prelude
80
- In ausearch/report, prefer -if to stdin
81
- In ausearch/report, add new command line option --input-logs (#428860)
82
- Updated audisp-prelude based on feedback from prelude-devel
83
- Added prelude alert for promiscuous socket being opened
84
- Added prelude alert for SE Linux policy enforcement changes
85
- Added prelude alerts for Forbidden Login Locations and Time
86
- Applied patch to auparse fixing error handling of searching by
87
interpreted value (Miloslav Trmac)
90
- Add prelude IDS plugin for IDMEF alerts
91
- Add --user option to aulastlog command
2
95
- Add more errno strings
3
96
- Fix config parser to allow either 0640 or 0600 for audit logs (#427062)
added
removed
ChangeLog
