Al used to send pull requests every couple of years but he told me to just start pushing them to you directly. The following changes since commit 19f949f52599ba7c3f67a5897ac6be14bfcb1200: Linux 3.8 (2013-02-18 15:58:34 -0800) are available in the git repository at: git://git.infradead.org/users/eparis/audit.git master for you to fetch changes up to 2a0b4be6dd655e24990da1d0811e28b9277f8b12: audit: fix message spacing printing auid (2013-05-08 00:02:19 -0400) Most of the changes are in audit* files so you shouldn't much care. Our touching outside of core audit code is pretty straight forward. A couple of interface changes which hit net/. A simple argument bug calling audit functions in namei.c and the removal of some assembly branch prediction code on ppc. Looks like you are going to have 2 merge failures due to patches which came in through akpm. The first in kernel/audit.c is a simple resolution. My tree is correct deleting those 3 lines. The second in kernel/audit.h is a little worse. You want to take my tree. Remove the #ifdef CONFIG_AUDIT and #endif towards the end of the new code. Then you want to remove the line declaring extern int audit_enabled; I'm attaching my merge resolution commit as a reference. ---------------------------------------------------------------- Andrew Morton (1): auditsc: remove audit_set_context() altogether - fold it into its caller Anton Blanchard (2): audit: Syscall rules are not applied to existing processes on non-x86 powerpc: Remove static branch prediction in 64bit traced syscall path Chen Gang (1): kernel: audit: beautify code, for extern function, better to check its parameters by itself Dmitry Monakhov (1): audit: destroy long filenames correctly Eric Paris (17): audit: use data= not msg= for AUDIT_USER_TTY messages Audit: do not print error when LSMs disabled audit: fix build break when AUDIT_DEBUG == 2 audit: allow checking the type of audit message in the user filter audit: make validity checking generic audit: remove the old depricated kernel interface audit: stop pushing loginid, uid, sessionid as arguments audit: push loginuid and sessionid processing down audit: use a consistent audit helper to log lsm information helper for some session id stuff audit: use spin_lock_irqsave/restore in audit tty code audit: do not needlessly take a spinlock in copy_signal audit: do not needlessly take a lock in tty_audit_exit audit: use spin_lock in audit_receive_msg to process tty logging audit: fix event coverage of AUDIT_ANOM_LINK Revert "audit: move kaudit thread start from auditd registration to kaudit init" audit: fix message spacing printing auid Eric W. Biederman (1): audit: Make testing for a valid loginuid explicit. Gao feng (1): audit: remove duplicate export of audit_enabled Jeff Layton (1): audit: vfs: fix audit_inode call in O_CREAT case of do_last Matvejchikov Ilya (1): audit: improve GID/EGID comparation logic Rakib Mullick (1): auditsc: Use kzalloc instead of kmalloc+memset. Richard Guy Briggs (4): audit: refactor hold queue flush audit: flatten kauditd_thread wait queue code audit: move kaudit thread start from auditd registration to kaudit init audit: add an option to control logging of passwords with pam_tty_audit arch/powerpc/kernel/entry_64.S | 2 +- drivers/tty/tty_audit.c | 104 +++++++++++++++-------------------- fs/namei.c | 2 +- include/linux/audit.h | 48 ++++++++++------ include/linux/sched.h | 1 + include/linux/tty.h | 6 +- include/uapi/linux/audit.h | 4 +- kernel/audit.c | 516 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------------------------------------- kernel/audit.h | 156 ++++++++++++++++++++++++++++++++++++++++++++++++++++ kernel/auditfilter.c | 360 +++++++++++++++++++++++++++++++++++++----------------------------------------------------------------------------------- kernel/auditsc.c | 421 +++++++++++++++----------------------------------------------------------------------------------------------------------------------------- net/socket.c | 6 +- 12 files changed, 749 insertions(+), 877 deletions(-)