When support for avoiding in-band signals to indicate an unset loginuid
was added to the kernel, userspace was neglected, so add them here as a
prerequisite to enable their use in the exclude filter:
See upstream kernel commits:
780a7654cee8d61819512385e778e4827db4bfbc
041d7b98ffe59c59fdd639931dea7d74f9aa9a59
The rest to support additional fields for the exclude filter is in the
second patch.
RFE: add additional fields for use in audit filter exclude rules
https://github.com/linux-audit/audit-kernel/issues/5
Richard Guy Briggs (2):
add support for loginuid_set using macro AUDIT_LOGINUID_SET
exclude filter: add support for user filter fields
docs/auditctl.8 | 2 +-
lib/fieldtab.h | 2 ++
lib/libaudit.c | 21 ++++++++++++++++++---
3 files changed, 21 insertions(+), 4 deletions(-)