[el5_latest] audispd-plugins-1.8-2.el5.x86_64

The audispd-plugins package provides plugins for the real-time
interface to the audit system, audispd. These plugins can do things
like relay events to remote machines or analyze events for suspicious
behavior.

Changelog (Show File list) (Show related packages)

• Fri Oct 28 2011 Steve Grubb <sgrubb@redhat.com> 1.8-2

  resolves: #667536 Allow setting syslog facility for audisp syslog plugin
  resolves: #697013 audit package rebase
  resolves: #706156 searching on auid = -1 results in all events
  resolves: #654883 service auditd restart output in immutable mode is not clear.
  resolves: #671261 auditctl and audit.rules man pages inconsistent on -a option
  resolves: #702279 autrace -r fails to insert audit rules on 32 bit platforms

• Fri Nov 05 2010 Steve Grubb <sgrubb@redhat.com> 1.7.18-2

  resolves: #649952 audisp-remote leaks memory

• Sun Sep 19 2010 Steve Grubb <sgrubb@redhat.com> 1.7.18-1

  resolves: #554553 filtering a large inode number on i386 doesn't work
  resolves: #568677 aureport help and man page don't show all options
  resolves: #585356 audit updates for virtualization
  resolves: #607823 inodes display incorrectly when listing rules

• Wed Dec 09 2009 Steve Grubb <sgrubb@redhat.com> 1.7.17-3

  resolves: #529851 New upstream version with many updates
  resolves: #519790 Crash interpreting IPC mode fields via libauparse
  resolves: #513974 aureport does not accept dates as given in the man pages

• Wed Apr 22 2009 Steve Grubb <sgrubb@redhat.com> 1.7.13-2

  resolves: #235398 ausearch does not correctly find out of order records
  resolves: #471383 Missing description of '--exact' in ausyscall man page
  resolves: #474466 audispd: plugin /sbin/audisp-remote terminated unexpectedly
  resolves: #476189 audispd activates the same plugin several times
  resolves: #483086 fix tty audit reporting
  resolves: #483608 audit updates for 5.4

• Wed Apr 08 2009 Steve Grubb <sgrubb@redhat.com> 1.7.7-7

  resolves: #487237 auditd memory leak when NOLOG option given

• Thu Dec 11 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-6

  resolves: #476009 Unknown keyword "enable_krb5" in audisp-remote.conf

• Wed Oct 29 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-5

  resolves: #468719 Need to adjust requires for system-config-audit

• Mon Oct 27 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-4

  resolves: #468668 aureport/ausearch --start recent regression

• Sat Oct 25 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-3

  resolves: #467930 AVC denials during upgrade of audit pkgs
  - Disable GSSAPI support until plugin approach is created
  resolves: #446080 Fix a couple problems found in update

• Thu Sep 18 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-2

  resolves: #446080 New upstream version with many updates

• Sun Apr 20 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-9

  resolves: #442556 audit rules with >= get corrupted
  resolves: #438844 buffer overflow in audit_log_user_command, better fix

• Wed Apr 02 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.5-8

  resolves: #438844 buffer overflow in audit_log_user_command
  - adjust ausearch.patch to audit 1.6.5

• Tue Apr 01 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-7

  resolves: #438844 buffer overflow in audit_log_user_command
  - Update ausearch with fixes from auparse, 440086

• Thu Mar 27 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-6

  resolves: #438844 buffer overflow in audit_log_user_command
  - Also removed lsb headers from init script

• Fri Mar 14 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-4

  resolves: #435947 system-config-audit does not run
  - Also revised patch for audispd memory leak

• Tue Mar 04 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-3

  resolves: #435329 memory leak in audispd

• Wed Feb 20 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-2

  resolves: #432866
  - Fix leaked descriptors in audispd
  - aureport does not work when run from a cron job
  - ausearch -m ANOM_PROMISCUOUS did not work because of parse error
  - ausearch recent keyword was searching since midnight instead of last 10 min
  - man page updates

• Tue Jan 15 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-1

  resolves: #234663, #244349
  - auparse library has been updated
  - system-config-audit has added
  - auditd now supports group permissions on audit logs
  - audit by TTY support added
  - New multi-threaded audit event dispatcher supporting plugins
  - node/machine field can be added to audit events
  - RACF zos remote logging plugin from IBM
  - week-ago keyword added to aureport/ausearch
  - auditctl supports errno abbreviation as syscall exit code (-F exit=-EPERM)
  - audit logging can be resumed with SIGUSR2
  - New aulastlog utility

• Mon Aug 20 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-7

  resolves: #251327 swig was incorrectly incoporating a variable in ppc's
  python bindings causing python tracebacks.

• Mon Aug 13 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-6

  Resolves: #251911  segfault in aureport when -if option used

• Tue Jul 31 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-5

  - Fix some bugs found in 1.5.6 version of audit
  Resolves: #249759

• Sun Jul 01 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-4

  - Fix a double free when auditd receives SIGHUP
  Related: #235321  audit DAEMON_CONFIG record truncated

• Wed Jun 27 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-3

  - Add Requires: audit-libs-python to the main package for /sbin/audispd

• Wed Jun 27 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-2

  - Drop system-config-audit again

• Wed Jun 27 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-1

  - Add system-config-audit
  - Fix Python binding compilation on ppc
  - Fix subtree auditing (Patch by Alexander Viro)

• Tue Jun 26 2007 Steve Grubb <sgrubb@redhat.com> 1.5.4-1

  - Update to latest upstream
  Resolves: #200784 Add audit parsing library
  Resolves: #237788 Init script update

• Thu Apr 26 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-6

  Resolves: #234923: Adjusted the lspp & capp.rules file for evaluation

• Wed Apr 25 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-5

  Resolves: #234923: update lspp & capp.rules file for evaluation

• Mon Apr 09 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-4

  Resolves: #235468  parse DAEMON_END records for subject
  Resolves: #235321  audit DAEMON_CONFIG record truncated
  Resolves: #234548  audit-libs-python does not require kernel-headers
  Resolves: #232166  service auditd returns status 0 when the service is stopped

• Mon Mar 12 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-3

  - Add support for OBJ_PID record type
  Related: #228384

• Tue Mar 06 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-2

  - Added NISPOM sample rules
  - Fix ausearch -se option to work for obj labels (#230740)
  - Fix auditd init script for /usr on netdev (#228528)
  - updated audit_rule_fieldpair_data to handle perm correctly (#226780)
  Resolves: #230740 #228528 #226780

• Sun Dec 10 2006 Steve Grubb <sgrubb@redhat.com> 1.3.1-1

  - Fix error messages in ausearch/aureport command options
  - Add tgkill to S390* syscall tables
  Resolves: #218484

• Fri Dec 01 2006 Steve Grubb <sgrubb@redhat.com> 1.3-3

  - Sync timestamps of libaudit.conf
  Resolves: #218127

• Thu Nov 30 2006 Steve Grubb <sgrubb@redhat.com> 1.3-2

  - Fix parsing of exit_group syscalls
  Resolves: #217952

• Thu Nov 30 2006 Steve Grubb <sgrubb@redhat.com> 1.3-1

  - Add new msg types
  - ausearch & aureport implement uid/gid caching
  - In ausearch & aureport, extract addr when hostname is unknown
  - In ausearch & aureport, test audit log presence O_RDONLY
  Resolves: #215257
  - New ausearch/aureport time keywords: recent, this-week, this-month, this-year
  - Added --add & --delete option to aureport
  - Update res parsing in config change events
  - Increase the size on audit daemon buffers
  - Parse avc_path records in ausearch/aureport
  - ausearch has new output mode, raw, for extracting events
  - ausearch/aureport can now read stdin
  - Rework AVC processing in ausearch/aureport
  - Added long options to ausearch and aureport
  Resolves: #217870

• Tue Oct 24 2006 Steve Grubb <sgrubb@redhat.com> 1.2.9-1

  - Some auditd config strings were not initialized in aureport (#211443)
  - Updated man pages
  - Add Netlabel event types to libaudit
  - Update aureports to current audit event types
  - Deprecated all the old audit_rule functions from public API
  - Drop auparse library for the moment

• Mon Oct 16 2006 Steve Grubb <sgrubb@redhat.com> 1.2.8-2

  - Update to fix libaudit defines
  - Patch to fix (#208834)

• Fri Sep 29 2006 Steve Grubb <sgrubb@redhat.com> 1.2.8-1

  - Add dist tag and bump version (#208532)
  - Make internal auditd buffers bigger for context info
  - Correct address resolving of hostname in logging functions
  - Do not allow multiple msgtypes in same audit rule in auditctl (#207666)
  - Only =, != operators for arch & inode fields in auditctl (#206427)
  - Updated audit message type table
  - Remove watches from aureport since FS_WATCH is deprecated
  - Add audit_log_avc back temporarily (#208152)

• Mon Sep 18 2006 Steve Grubb <sgrubb@redhat.com> 1.2.7-2

  - Fix logging messages to use addr if passed.
  - Apply patches from Tony Jones correcting no kernel support messages
  - Updated syscall tables for 2.6.18 kernel
  - Remove deprecated functions: audit_log, audit_log_avc, audit_log_if_enabled
  - Disallow syscall auditing on exclude list
  - Improve time handling in ausearch and aureport (#191394)
  - Attempt to reconstruct full path from relative for searching

• Wed Aug 30 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-3

  - Rename audit event socket

• Mon Aug 28 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-2

  - Another minor update to auditctl -p option

• Sat Aug 26 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-1

  - Apply updates to dispatcher
  - Fix a couple bugs regarding MLS labels
  - Resurrect -p option
  - Tighten rules with exclude filter
  - Fix parsing issue which lead to segfault in some cases
  - Fix option parsing to ignore malformed lines

• Fri Aug 18 2006 Jesse Keating <jkeating@redhat.com> - 1.2.5-8

  - rebuilt with latest binutils to pick up 64K -z commonpagesize on ppc*
    (#203001)

• Tue Aug 08 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-7

  - Remove debug lines from dispatcher

• Wed Aug 02 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-6

  - Change audisp to use a named pipe

• Fri Jul 21 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-5

  - Fix dispatcher to handle sigchld
  - Fix library location for 64 bit
  - Add Prereq

• Fri Jul 21 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-4

  - Eliminate avc package from audisp

• Wed Jul 19 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-3

  - More fixes for setroubleshoot to handle failing plugin

• Fri Jul 14 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-2

  - Fixes for setroubleshoot

• Thu Jul 13 2006 Steve Grubb <sgrubb@redhat.com> 1.2.5-1

  - Switch out dispatcher
  - Fix bug upgrading rule types

• Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.2.4-1.1

  - rebuild

• Fri Jun 30 2006 Steve Grubb <sgrubb@redhat.com> 1.2.4-1

  - Add support for the new filter key
  - Update syscall tables for 2.6.17
  - Add audit failure query function
  - Switch out gethostbyname call with getaddrinfo
  - Add audit by obj capability for 2.6.18 kernel
  - Ausearch & aureport now fail if no args to -te
  - New auditd.conf option to choose blocking/non-blocking dispatcher comm
  - Ausearch improved search by label

• Thu May 25 2006 Steve Grubb <sgrubb@redhat.com> 1.2.3-1

  - Apply patch to ensure watches only associate with exit filter
  - Apply patch to correctly show new operators when new listing format is used
  - Apply patch to pull kernel's audit.h into python bindings
  - Collect signal sender's context

• Tue May 16 2006 David Woodhouse <dwmw2@redhat.com> 1.2.2-2

  - Require kernel-headers, not glibc-kernheaders. Again.

• Fri May 12 2006 Steve Grubb <sgrubb@redhat.com> 1.2.2-1

  - Updates for new glibc-kernheaders
  - Change auditctl to collect list of rules then delete them on -D
  - Update capp.rules and lspp.rules to comment out rules for the possible list
  - Add new message types
  - Support sigusr1 sender identity of newer kernels
  - Add support for ppid in auditctl and ausearch
  - fix auditctl to trim the '/' from watches
  - Move audit daemon config files to /etc/audit for better SE Linux protection

• Tue Apr 25 2006 David Woodhouse <dwmw2@redhat.com> 1.2.1-2

  - Require kernel-headers, not glibc-kernheaders
  - Fix redefinition of audit_rule_data with new kernel headers
  - Remove abuse of __KERNEL__ in lookup_table.c

• Sun Apr 16 2006 Steve Grubb <sgrubb@redhat.com> 1.2.1-1

  - New message type for trusted apps
  - Add new keywords today, yesterday, now for ausearch and aureport
  - Make audit_log_user_avc_message really send to syslog on error
  - Updated syscall tables in auditctl
  - Deprecated the 'possible' action for syscall rules in auditctl
  - Update watch code to use file syscalls instead of 'all' in auditctl

• Fri Apr 07 2006 Steve Grubb <sgrubb@redhat.com> 1.2-1

  - Add support for new file system auditing kernel subsystem

• Thu Apr 06 2006 Steve Grubb <sgrubb@redhat.com> 1.1.6-1

  - New message types
  - Support new rule format found in 2.6.17 and later kernels
  - Add support for audit by role, clearance, type, sensitivity

• Mon Mar 06 2006 Steve Grubb <sgrubb@redhat.com> 1.1.5-1

  - Changed audit_log_semanage_message to take new params
  - In aureport, add class between syscall and permission in avc report
  - Fix bug where fsync is called in debug mode
  - Add optional support for tty in SYSCALL records for ausearch/aureport
  - Reinstate legacy rule operator support
  - Add man pages
  - Auditd ignore most signals

• Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.1.4-5.1

  - bump again for double-long bug on ppc(64)

• Fri Feb 10 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-5

  - Change audit_log_semanage_message to check strlen as well as NULL.

• Thu Feb 09 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-3

  - Change audit_log_semanage_message to take new params.

• Wed Feb 08 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-1

  - Fix bug in autrace where it didn't run on kernels without file watch support
  - Add syslog message to auditd saying what program was started for dispatcher
  - Remove audit_send_user from public api
  - Fix bug in USER_LOGIN messages where ausearch does not translate
    msg='uid=500: into acct name (#178102).
  - Change comm with dispatcher to socketpair from pipe
  - Change auditd to use custom daemonize to avoid race in init scripts
  - Update error message when deleting a rule that doesn't exist (#176239)
  - Call shutdown_dispatcher when auditd stops
  - Add new logging function audit_log_semanage_message

• Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.1.3-1.1

  - rebuilt for new gcc4.1 snapshot and glibc changes

• Thu Jan 05 2006 Steve Grubb <sgrubb@redhat.com> 1.1.3-1

  - Add timestamp to daemon_config messages (#174865)
  - Add error checking of year for aureport & ausearch
  - Treat af_unix sockets as files for searching and reporting
  - Update capp & lspp rules to combine syscalls for higher performance
  - Adjusted the chkconfig line for auditd to start a little earlier
  - Added skeleton program to docs for people to write their own dispatcher with
  - Apply patch from Ulrich Drepper that optimizes resource utilization
  - Change ausearch and aureport to unlocked IO

• Mon Dec 05 2005 Steve Grubb <sgrubb@redhat.com> 1.1.2-1

  - Add more message types

• Wed Nov 30 2005 Steve Grubb <sgrubb@redhat.com> 1.1.1-1

  - Add support for alpha processors
  - Update the audisp code
  - Add locale code in ausearch and aureport
  - Add new rule operator patch
  - Add exclude filter patch
  - Cleanup make files
  - Add python bindings

• Wed Nov 09 2005 Steve Grubb <sgrubb@redhat.com> 1.1-1

  - Add initial version of audisp. Just a placeholder at this point
  - Remove -t from auditctl

• Mon Nov 07 2005 Steve Grubb <sgrubb@redhat.com> 1.0.12-1

  - Add 2 more summary reports
  - Add 2 more message types