[el5_latest] audispd-plugins-1.8-2.0.1.el5.x86_64

The audispd-plugins package provides plugins for the real-time
interface to the audit system, audispd. These plugins can do things
like relay events to remote machines or analyze events for suspicious
behavior.

Changelog (Show File list) (Show related packages)

• Thu Nov 01 2012 Guangyu Sun <guangyu.sun@oracle.com> 1.8-2.0.1

  - replace using oom_adj with oom_score_adj for newer kernel [bug 13790163]

• Sat Oct 29 2011 Steve Grubb <sgrubb@redhat.com> 1.8-2

  resolves: #667536 Allow setting syslog facility for audisp syslog plugin
  resolves: #697013 audit package rebase
  resolves: #706156 searching on auid = -1 results in all events
  resolves: #654883 service auditd restart output in immutable mode is not clear.
  resolves: #671261 auditctl and audit.rules man pages inconsistent on -a option
  resolves: #702279 autrace -r fails to insert audit rules on 32 bit platforms

• Sat Nov 06 2010 Steve Grubb <sgrubb@redhat.com> 1.7.18-2

  resolves: #649952 audisp-remote leaks memory

• Mon Sep 20 2010 Steve Grubb <sgrubb@redhat.com> 1.7.18-1

  resolves: #554553 filtering a large inode number on i386 doesn't work
  resolves: #568677 aureport help and man page don't show all options
  resolves: #585356 audit updates for virtualization
  resolves: #607823 inodes display incorrectly when listing rules

• Thu Dec 10 2009 Steve Grubb <sgrubb@redhat.com> 1.7.17-3

  resolves: #529851 New upstream version with many updates
  resolves: #519790 Crash interpreting IPC mode fields via libauparse
  resolves: #513974 aureport does not accept dates as given in the man pages

• Thu Apr 23 2009 Steve Grubb <sgrubb@redhat.com> 1.7.13-2

  resolves: #235398 ausearch does not correctly find out of order records
  resolves: #471383 Missing description of '--exact' in ausyscall man page
  resolves: #474466 audispd: plugin /sbin/audisp-remote terminated unexpectedly
  resolves: #476189 audispd activates the same plugin several times
  resolves: #483086 fix tty audit reporting
  resolves: #483608 audit updates for 5.4

• Thu Apr 09 2009 Steve Grubb <sgrubb@redhat.com> 1.7.7-7

  resolves: #487237 auditd memory leak when NOLOG option given

• Fri Dec 12 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-6

  resolves: #476009 Unknown keyword "enable_krb5" in audisp-remote.conf

• Thu Oct 30 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-5

  resolves: #468719 Need to adjust requires for system-config-audit

• Tue Oct 28 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-4

  resolves: #468668 aureport/ausearch --start recent regression

• Sun Oct 26 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-3

  resolves: #467930 AVC denials during upgrade of audit pkgs
  - Disable GSSAPI support until plugin approach is created
  resolves: #446080 Fix a couple problems found in update

• Fri Sep 19 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-2

  resolves: #446080 New upstream version with many updates

• Mon Apr 21 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-9

  resolves: #442556 audit rules with >= get corrupted
  resolves: #438844 buffer overflow in audit_log_user_command, better fix

• Thu Apr 03 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.5-8

  resolves: #438844 buffer overflow in audit_log_user_command
  - adjust ausearch.patch to audit 1.6.5

• Wed Apr 02 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-7

  resolves: #438844 buffer overflow in audit_log_user_command
  - Update ausearch with fixes from auparse, 440086

• Fri Mar 28 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-6

  resolves: #438844 buffer overflow in audit_log_user_command
  - Also removed lsb headers from init script

• Sat Mar 15 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-4

  resolves: #435947 system-config-audit does not run
  - Also revised patch for audispd memory leak

• Wed Mar 05 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-3

  resolves: #435329 memory leak in audispd

• Thu Feb 21 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-2

  resolves: #432866
  - Fix leaked descriptors in audispd
  - aureport does not work when run from a cron job
  - ausearch -m ANOM_PROMISCUOUS did not work because of parse error
  - ausearch recent keyword was searching since midnight instead of last 10 min
  - man page updates

• Wed Jan 16 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-1

  resolves: #234663, #244349
  - auparse library has been updated
  - system-config-audit has added
  - auditd now supports group permissions on audit logs
  - audit by TTY support added
  - New multi-threaded audit event dispatcher supporting plugins
  - node/machine field can be added to audit events
  - RACF zos remote logging plugin from IBM
  - week-ago keyword added to aureport/ausearch
  - auditctl supports errno abbreviation as syscall exit code (-F exit=-EPERM)
  - audit logging can be resumed with SIGUSR2
  - New aulastlog utility

• Tue Aug 21 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-7

  resolves: #251327 swig was incorrectly incoporating a variable in ppc's
  python bindings causing python tracebacks.

• Tue Aug 14 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-6

  Resolves: #251911  segfault in aureport when -if option used

• Wed Aug 01 2007 Steve Grubb <sgrubb@redhat.com> - 1.5.5-5

  - Fix some bugs found in 1.5.6 version of audit
  Resolves: #249759

• Mon Jul 02 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-4

  - Fix a double free when auditd receives SIGHUP
  Related: #235321  audit DAEMON_CONFIG record truncated

• Thu Jun 28 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-3

  - Add Requires: audit-libs-python to the main package for /sbin/audispd

• Thu Jun 28 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-2

  - Drop system-config-audit again

• Thu Jun 28 2007 Miloslav Trmač <mitr@redhat.com> - 1.5.5-1

  - Add system-config-audit
  - Fix Python binding compilation on ppc
  - Fix subtree auditing (Patch by Alexander Viro)

• Wed Jun 27 2007 Steve Grubb <sgrubb@redhat.com> 1.5.4-1

  - Update to latest upstream
  Resolves: #200784 Add audit parsing library
  Resolves: #237788 Init script update

• Fri Apr 27 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-6

  Resolves: #234923: Adjusted the lspp & capp.rules file for evaluation

• Thu Apr 26 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-5

  Resolves: #234923: update lspp & capp.rules file for evaluation

• Tue Apr 10 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-4

  Resolves: #235468  parse DAEMON_END records for subject
  Resolves: #235321  audit DAEMON_CONFIG record truncated
  Resolves: #234548  audit-libs-python does not require kernel-headers
  Resolves: #232166  service auditd returns status 0 when the service is stopped

• Tue Mar 13 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-3

  - Add support for OBJ_PID record type
  Related: #228384

• Wed Mar 07 2007 Steve Grubb <sgrubb@redhat.com> 1.3.1-2

  - Added NISPOM sample rules
  - Fix ausearch -se option to work for obj labels (#230740)
  - Fix auditd init script for /usr on netdev (#228528)
  - updated audit_rule_fieldpair_data to handle perm correctly (#226780)
  Resolves: #230740 #228528 #226780

• Mon Dec 11 2006 Steve Grubb <sgrubb@redhat.com> 1.3.1-1

  - Fix error messages in ausearch/aureport command options
  - Add tgkill to S390* syscall tables
  Resolves: #218484

• Sat Dec 02 2006 Steve Grubb <sgrubb@redhat.com> 1.3-3

  - Sync timestamps of libaudit.conf
  Resolves: #218127

• Fri Dec 01 2006 Steve Grubb <sgrubb@redhat.com> 1.3-2

  - Fix parsing of exit_group syscalls
  Resolves: #217952

• Fri Dec 01 2006 Steve Grubb <sgrubb@redhat.com> 1.3-1

  - Add new msg types
  - ausearch & aureport implement uid/gid caching
  - In ausearch & aureport, extract addr when hostname is unknown
  - In ausearch & aureport, test audit log presence O_RDONLY
  Resolves: #215257
  - New ausearch/aureport time keywords: recent, this-week, this-month, this-year
  - Added --add & --delete option to aureport
  - Update res parsing in config change events
  - Increase the size on audit daemon buffers
  - Parse avc_path records in ausearch/aureport
  - ausearch has new output mode, raw, for extracting events
  - ausearch/aureport can now read stdin
  - Rework AVC processing in ausearch/aureport
  - Added long options to ausearch and aureport
  Resolves: #217870

• Wed Oct 25 2006 Steve Grubb <sgrubb@redhat.com> 1.2.9-1

  - Some auditd config strings were not initialized in aureport (#211443)
  - Updated man pages
  - Add Netlabel event types to libaudit
  - Update aureports to current audit event types
  - Deprecated all the old audit_rule functions from public API
  - Drop auparse library for the moment

• Tue Oct 17 2006 Steve Grubb <sgrubb@redhat.com> 1.2.8-2

  - Update to fix libaudit defines
  - Patch to fix (#208834)

• Sat Sep 30 2006 Steve Grubb <sgrubb@redhat.com> 1.2.8-1

  - Add dist tag and bump version (#208532)
  - Make internal auditd buffers bigger for context info
  - Correct address resolving of hostname in logging functions
  - Do not allow multiple msgtypes in same audit rule in auditctl (#207666)
  - Only =, != operators for arch & inode fields in auditctl (#206427)
  - Updated audit message type table
  - Remove watches from aureport since FS_WATCH is deprecated
  - Add audit_log_avc back temporarily (#208152)

• Tue Sep 19 2006 Steve Grubb <sgrubb@redhat.com> 1.2.7-2

  - Fix logging messages to use addr if passed.
  - Apply patches from Tony Jones correcting no kernel support messages
  - Updated syscall tables for 2.6.18 kernel
  - Remove deprecated functions: audit_log, audit_log_avc, audit_log_if_enabled
  - Disallow syscall auditing on exclude list
  - Improve time handling in ausearch and aureport (#191394)
  - Attempt to reconstruct full path from relative for searching

• Thu Aug 31 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-3

  - Rename audit event socket

• Tue Aug 29 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-2

  - Another minor update to auditctl -p option

• Sun Aug 27 2006 Steve Grubb <sgrubb@redhat.com> 1.2.6-1

  - Apply updates to dispatcher
  - Fix a couple bugs regarding MLS labels
  - Resurrect -p option
  - Tighten rules with exclude filter
  - Fix parsing issue which lead to segfault in some cases
  - Fix option parsing to ignore malformed lines

• Sat Aug 19 2006 Jesse Keating <jkeating@redhat.com> - 1.2.5-8

  - rebuilt with latest binutils to pick up 64K -z commonpagesize on ppc*
    (#203001)

• Wed Aug 09 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-7

  - Remove debug lines from dispatcher

• Thu Aug 03 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-6

  - Change audisp to use a named pipe

• Sat Jul 22 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-5

  - Fix dispatcher to handle sigchld
  - Fix library location for 64 bit
  - Add Prereq

• Sat Jul 22 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-4

  - Eliminate avc package from audisp

• Thu Jul 20 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-3

  - More fixes for setroubleshoot to handle failing plugin

• Sat Jul 15 2006 Dan Walsh <dwalsh@redhat.com> 1.2.5-2

  - Fixes for setroubleshoot

• Fri Jul 14 2006 Steve Grubb <sgrubb@redhat.com> 1.2.5-1

  - Switch out dispatcher
  - Fix bug upgrading rule types

• Thu Jul 13 2006 Jesse Keating <jkeating@redhat.com> - 1.2.4-1.1

  - rebuild

• Sat Jul 01 2006 Steve Grubb <sgrubb@redhat.com> 1.2.4-1

  - Add support for the new filter key
  - Update syscall tables for 2.6.17
  - Add audit failure query function
  - Switch out gethostbyname call with getaddrinfo
  - Add audit by obj capability for 2.6.18 kernel
  - Ausearch & aureport now fail if no args to -te
  - New auditd.conf option to choose blocking/non-blocking dispatcher comm
  - Ausearch improved search by label

• Fri May 26 2006 Steve Grubb <sgrubb@redhat.com> 1.2.3-1

  - Apply patch to ensure watches only associate with exit filter
  - Apply patch to correctly show new operators when new listing format is used
  - Apply patch to pull kernel's audit.h into python bindings
  - Collect signal sender's context

• Wed May 17 2006 David Woodhouse <dwmw2@redhat.com> 1.2.2-2

  - Require kernel-headers, not glibc-kernheaders. Again.

• Sat May 13 2006 Steve Grubb <sgrubb@redhat.com> 1.2.2-1

  - Updates for new glibc-kernheaders
  - Change auditctl to collect list of rules then delete them on -D
  - Update capp.rules and lspp.rules to comment out rules for the possible list
  - Add new message types
  - Support sigusr1 sender identity of newer kernels
  - Add support for ppid in auditctl and ausearch
  - fix auditctl to trim the '/' from watches
  - Move audit daemon config files to /etc/audit for better SE Linux protection

• Wed Apr 26 2006 David Woodhouse <dwmw2@redhat.com> 1.2.1-2

  - Require kernel-headers, not glibc-kernheaders
  - Fix redefinition of audit_rule_data with new kernel headers
  - Remove abuse of __KERNEL__ in lookup_table.c

• Mon Apr 17 2006 Steve Grubb <sgrubb@redhat.com> 1.2.1-1

  - New message type for trusted apps
  - Add new keywords today, yesterday, now for ausearch and aureport
  - Make audit_log_user_avc_message really send to syslog on error
  - Updated syscall tables in auditctl
  - Deprecated the 'possible' action for syscall rules in auditctl
  - Update watch code to use file syscalls instead of 'all' in auditctl

• Sat Apr 08 2006 Steve Grubb <sgrubb@redhat.com> 1.2-1

  - Add support for new file system auditing kernel subsystem

• Fri Apr 07 2006 Steve Grubb <sgrubb@redhat.com> 1.1.6-1

  - New message types
  - Support new rule format found in 2.6.17 and later kernels
  - Add support for audit by role, clearance, type, sensitivity

• Tue Mar 07 2006 Steve Grubb <sgrubb@redhat.com> 1.1.5-1

  - Changed audit_log_semanage_message to take new params
  - In aureport, add class between syscall and permission in avc report
  - Fix bug where fsync is called in debug mode
  - Add optional support for tty in SYSCALL records for ausearch/aureport
  - Reinstate legacy rule operator support
  - Add man pages
  - Auditd ignore most signals

• Sat Feb 11 2006 Jesse Keating <jkeating@redhat.com> - 1.1.4-5.1

  - bump again for double-long bug on ppc(64)

• Sat Feb 11 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-5

  - Change audit_log_semanage_message to check strlen as well as NULL.

• Fri Feb 10 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-3

  - Change audit_log_semanage_message to take new params.

• Thu Feb 09 2006 Steve Grubb <sgrubb@redhat.com> 1.1.4-1

  - Fix bug in autrace where it didn't run on kernels without file watch support
  - Add syslog message to auditd saying what program was started for dispatcher
  - Remove audit_send_user from public api
  - Fix bug in USER_LOGIN messages where ausearch does not translate
    msg='uid=500: into acct name (#178102).
  - Change comm with dispatcher to socketpair from pipe
  - Change auditd to use custom daemonize to avoid race in init scripts
  - Update error message when deleting a rule that doesn't exist (#176239)
  - Call shutdown_dispatcher when auditd stops
  - Add new logging function audit_log_semanage_message

• Wed Feb 08 2006 Jesse Keating <jkeating@redhat.com> - 1.1.3-1.1

  - rebuilt for new gcc4.1 snapshot and glibc changes

• Fri Jan 06 2006 Steve Grubb <sgrubb@redhat.com> 1.1.3-1

  - Add timestamp to daemon_config messages (#174865)
  - Add error checking of year for aureport & ausearch
  - Treat af_unix sockets as files for searching and reporting
  - Update capp & lspp rules to combine syscalls for higher performance
  - Adjusted the chkconfig line for auditd to start a little earlier
  - Added skeleton program to docs for people to write their own dispatcher with
  - Apply patch from Ulrich Drepper that optimizes resource utilization
  - Change ausearch and aureport to unlocked IO

• Tue Dec 06 2005 Steve Grubb <sgrubb@redhat.com> 1.1.2-1

  - Add more message types

• Thu Dec 01 2005 Steve Grubb <sgrubb@redhat.com> 1.1.1-1

  - Add support for alpha processors
  - Update the audisp code
  - Add locale code in ausearch and aureport
  - Add new rule operator patch
  - Add exclude filter patch
  - Cleanup make files
  - Add python bindings

• Thu Nov 10 2005 Steve Grubb <sgrubb@redhat.com> 1.1-1

  - Add initial version of audisp. Just a placeholder at this point
  - Remove -t from auditctl

• Tue Nov 08 2005 Steve Grubb <sgrubb@redhat.com> 1.0.12-1

  - Add 2 more summary reports
  - Add 2 more message types