Here's the userspace patch for audit-0.6.5 -- It doesn't work as is.
To get this working I had to make a directory audit-0.6.5/linux and cp
/ ln -s audit.h into it. The patch should do this for you. However,
you will have to 'install -m 0644 lib/libaudit.h audit-0.6.5/'
yourself.
cd audit-0.6.5/
autoreconf -fv --install
./configure --sbindir=/path/to/sbin --libdir=/lib --with-pam=yes/no
install -m 0644 lib/libaudit.h .
make
It's probably just best to not "make install" and just cd src/ and run
auditctl from there for testing the auditfs kernel piece. I'm hoping
that some form of this code will eventually be integrated into the
userspace tool.
So please break..er test my code :)
--
- Timothy R. Chavez