Hello,
We just released a new version of the audit package. It can be downloaded
from:
https://github.com/linux-audit/audit-userspace/releases/
The ChangeLog is:
- Put the bash completions in /usr/share/bash-completion/completions/
- Add KillMode=mixed to the auditd unit file (Issue 272)
- Update perm table to add recent syscalls to it
- Auditd - prevent netlink congestion
- Propogate feed consumption errors into auparse_feed and auparse_flush_feed
- Add TLS support for remote logging (Sergio Correia)
- Add IPv6 support to IDS plugin
- Many code cleanups
First, if you are packaging this, note that the bash completions moved to a
more correct location. Second, if you are a distribution, you probably want
to backport commit abea35d2 "prevent netlink congestion" to all stable or
long term releases. It prevents the kernel from entering into state that is
hard to recover from when the backlog fills.
The big feature of this release is TLS protected remote logging. Thanks to
Sergio Correia for this. It's designed to work with pre-shared keys and
supports PQC ciphers. It does not support certificates.
Otherwise, this was a big bug fix release with around 170 total commits and
probably 100 of those fixing things found by static analysis and code review.
If you notice any problems with this release, please let us know.
SHA256: 5c275e80dd96c1e55dc0f850f63568a73b678acc502963a7926cfdb5ea505eae
-Steve