So this is just a fix to the already patched kernel. I'll come up with a new
patch against the entire RH 2.6.9 tree momentarily. When patching by hand I
forgot to include the function that initializes the auditfs caches.
--- audit.c~orig 2005-04-20 14:52:30.000000000 +0000
+++ audit.c 2005-04-20 14:52:16.000000000 +0000
@@ -574,6 +574,7 @@ int __init audit_init(void)
audit_initialized = 1;
audit_enabled = audit_default;
+ audit_filesystem_init();
audit_log(NULL, "initialized");
return 0;
}
-tim