Hi Linus, We've got two audit patches for the v5.7 merge window with a stellar 14 lines changed between the two patches. The patch descriptions are far more lengthy than the patches themselves, which is a very good thing for patches this size IMHO. The patches pass our test suites and a quick summary is below, please merge for v5.7. - Stop logging inode information when updating an audit file watch. Since we are not changing the inode, or the fact that we are watching the associated file, the inode information is just noise that we can do without. - Fix a problem where mandatory audit records were missing their accompanying audit records (e.g. SYSCALL records were missing). The missing records often meant that we didn't have the necessary context to understand what was going on when the event occurred. Thanks, -Paul -- The following changes since commit bb6d3fb354c5ee8d6bde2d576eb7220ea09862b9: Linux 5.6-rc1 (2020-02-09 16:08:48 -0800) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20200330 for you to fetch changes up to 1320a4052ea11eb2879eb7361da15a106a780972: audit: trigger accompanying records when no rules present (2020-03-12 10:42:51-0400) ---------------------------------------------------------------- audit/stable-5.7 PR 20200330 ---------------------------------------------------------------- Richard Guy Briggs (1): audit: trigger accompanying records when no rules present Steve Grubb (1): audit: CONFIG_CHANGE don't log internal bookkeeping as an event kernel/audit.c | 1 + kernel/audit.h | 8 ++++++++ kernel/audit_watch.c | 2 -- kernel/auditsc.c | 3 --- 4 files changed, 9 insertions(+), 5 deletions(-) -- paul moore www.paul-moore.com