Hi,
Just wanted to let everyone know that the next version of the Linux audit
daemon is available. You can get it from
http://people.redhat.com/sgrubb/audit. Or rawhide tomorrow (Monday the
21st).
This release is mostly a bug fix release. There were some issues with the
library files being in the wrong directory on 64bit machines.
Pam_audit was updated to write loginuid to /proc/pid/loginuid. Because of the
way pam works, this is done in the parent process and the login uid is
inherited by the child. This does not work for sshd because of privilege
separation. I'll have to patch that directly.
Added pam_session_close to handle logout messaging.
Update to kernel headers in 2.6.11rc3.
Let me know if there are any problems.
-Steve Grubb