Hello,
On Thursday, July 23, 2026 2:04:38 PM Eastern Daylight Time Steve Grubb via
Linux-audit wrote:
We just released a new version of the audit package. It can be
downloaded
from:
https://github.com/linux-audit/audit-userspace/releases/
The ChangeLog is:
- Put the bash completions in /usr/share/bash-completion/completions/
- Add KillMode=mixed to the auditd unit file (Issue 272)
- Update perm table to add recent syscalls to it
- Auditd - prevent netlink congestion
- Propogate feed consumption errors into auparse_feed and
auparse_flush_feed
- Add TLS support for remote logging (Sergio Correia)
- Add IPv6 support to IDS plugin
- Many code cleanups
First, if you are packaging this, note that the bash completions moved to a
more correct location. Second, if you are a distribution, you probably
want to backport commit abea35d2 "prevent netlink congestion" to all
stable or long term releases. It prevents the kernel from entering into
state that is hard to recover from when the backlog fills.
The big feature of this release is TLS protected remote logging. Thanks to
Sergio Correia for this. It's designed to work with pre-shared keys and
supports PQC ciphers. It does not support certificates.
Otherwise, this was a big bug fix release with around 170 total commits and
probably 100 of those fixing things found by static analysis and code
review.
If you notice any problems with this release, please let us know.
SHA256: 5c275e80dd96c1e55dc0f850f63568a73b678acc502963a7926cfdb5ea505eae
Looks like there's at least one problem with this release. The comm field is
set to 15 characters by the kernel. Turns out that utmp from systemd is
sending 19 characters. The logging function is currently rejecting it with
EINVAL. Commit d7ea98263ebd changes this to truncating the comm field.
If you are doing testing, you probably want that patch. I will re-release the
audit package with this patch and any other correction testers find
Wednesday of next week. (July 29) If you see anything, raise an issue or a PR
in github ASAP so that it is included with next week's update.
Thanks,
-Steve