Hi,
I've just released a new version of the audit daemon. It can be downloaded
from
http://people.redhat.com/sgrubb/audit It will also be in rawhide
tomorrow. The Changelog is:
- Fix ausearch buffers to hold long filenames
- Make a0 long long for 64 bit kernels & 32 bit ausearch.
This is a bug fix release. The a0 variable is saved away by ausearch to
identify socketcall's actual multiplexed call. (bind, connect, etc). It was
getting 10 byte long hex numbers rather than 8 byte when 64 bit kernel was
used and user space ausearch was compiled for 32 bits. This caused it to skip
the event as it was considered corrupted.
Please let me know if there are any problems.
-Steve