[RFC] audit support for BPF notification
by Jiri Olsa
hi,
I posted initial change that allows auditd to log BPF program
load/unload events, it's in here:
https://github.com/linux-audit/audit-userspace/pull/104
We tried to push pure AUDIT interface for BPF program notification,
but it was denied, the discussion is in here:
https://marc.info/?t=153866123200003&r=1&w=2
The outcome of the discussion was to use perf event interface
for BPF notification and use it in some deamon.. audit was our
first choice.
thoughts?
thanks,
jirka
5 years, 1 month
- 5
- 11
Audit-3.0 alpha9 available
by Steve Grubb
Hello,
This is to let everyone know that another audit-3.0 pre-release was made.
This rolls up a lot more fixes in the master branch since the last pre-release
was announced. Despite the designation of alpha, I feel that this is a
production quality release and can be treated that way. It has been pushed
into all supported releases of Fedora to indicate that I feel it's a good
release with significant fixes/features that people would want. The release is
based off of the tree as of commit 1c2f876.
You can find the release here:
http://people.redhat.com/sgrubb/audit/audit-3.0-alpha9.tar.gz
Changelog is here:
https://github.com/linux-audit/audit-userspace/blob/
1c2f876512dee3450230a9d79743e9fa01c2eb19/ChangeLog
* One thing to note to distro packagers. The location where the shipped rules
are installed to has changed. Previously they went into an area that is
associated with documentation. Now the location is /usr/share/audit/sample-
rules/
The reason this has not been declared a stable 3.0 release is simply because
we are still waiting for container support to land. In any event, if you find
any problems with this "release", please email this list or file an issue in
github.
Thanks,
-Steve
5 years, 1 month
- 1
- 0