Hi,
Another thought for the next major release is to drop support for the old
audit rules API in libaudit. A long time ago, the function prototypes for:
extern int audit_request_rules_list(int fd);
extern int audit_add_rule(int fd, struct audit_rule *rule,
int flags, int action);
extern int audit_delete_rule(int fd, struct audit_rule *rule,
int flags, int action);
extern int audit_rule_syscall(struct audit_rule *rule, int scall);
extern int audit_rule_syscallbyname(struct audit_rule *rule,
const char *scall);
extern int audit_rule_fieldpair(struct audit_rule *rule, const char *pair,
int flags);
extern void audit_rule_free(struct audit_rule *rule);
Were moved to a private internal header. This was to encourage any external
apps from using them, but if they had been previously compiled to know about
the API, they would still be able to link and run.
As far as I know, auditctl & autrace are the only apps that would be affected.
There very well may be some 3rd party apps I don't know about that this could
impact. Hopefully they are on this list or moved their function calls when
the prototype disappeared.
The proposal is to drop the above mentioned functions and bump the soname
number so that anything linking against libaudit has to be recompiled to make
sure they have no old function calls. At some point in the future, we can
also remove the kernel's support for the old rule format.
Let's discuss....
-Steve