Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - When processing a run level change, make auditd exit - In auditd, fix return code when rules added in immutable mode - In auparse, when files are given, also consider EUID for access - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya) - Disable Python bindings from setting rules due to swig bug (S. Trofimovich) - Update all lookup tables for the 6.5 kernel - Don't be as paranoid about auditctl -R file permissions - In ausearch, correct subject/object search to be an and if both are given - Adjust formats for 64 bit time_t - Fix segfault in python bindings around the feed API - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings There are various bugfixes, a refresh of the lookup tables for the 6.5 kernel, and some sprucing up of the python bindings. Speaking of which, this release removes the ability to set audit rules via the python bindings. That means no more workaround patch is needed for the swig issue. SHA256: c0b1792d1f0a88c6f1828710509cbb987059fc68712c97669ca90eae103d287d Please let me know if you run across any problems with this release. -Steve