Hello,
I've just released a new version of the audit daemon. It can be downloaded
from
http://people.redhat.com/sgrubb/audit It will also be in rawhide
tomorrow. The Changelog is:
- adjust file perms of newly created log file in auditd
- fix 2 memory leaks and an out of bounds access in auditd
- fix case where auditd was closing netlink descriptor too early
- fix watch rules not to take field arguments in auditctl
- fix bug where inode, devmajor, devminor, exit, and success fields in
auditctl rules were not getting the correct value stored
This is a bug fix release. There was a big bug found by Amy Griffis of HP
where several fields values are set to 0 before being sent into the kernel.
The fields affected are: inode, devmajor, devminor, exit, and success. Thanks
for reporting it!
Please let me know if there are any problems.
-Steve