On Thursday 19 May 2005 10:20, David Woodhouse wrote:
I seem to be building them faster than I can announce them.
When testing socketcall code I observed that auditd was logging its own
actions, which soon descended into insanity as it generated two more log
entries for every one that it read from the socket. I have added code to
auditsc.c to exempt the audit_pid from being audited -- see attached
patch. The rest of it is just getting the skb queueing via kernel dæmon
working properly...
* Thu May 19 2005 David Woodhouse <dwmw2(a)redhat.com> audit.44
- Honour audit_backlog_limit again
- Reorder patches to reflect upstream status
* Thu May 19 2005 David Woodhouse <dwmw2(a)redhat.com> audit.43
- printk in audit_log_end() when no auditd
- Don't audit auditd itself
* Wed May 18 2005 David Woodhouse <dwmw2(a)redhat.com> audit.42
- Restore Chris' third audit-to-skb patch
test-booting a .39 kernel with the sleep and hook fixes (quit moving my damned
audit_notify_watch() hook out of permission(), it needs to be there =))
-tim