Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Disable ProtectControlGroups in auditd.service by default - Fix rule checking for exclude filter - Make audit_rule_syscallbyname_data work correctly outside of auditctl - Add new record types - Add io_uring support - Add support for new FANOTIFY record fields - Add keyword, this-hour, to ausearch/report start/end options - Add Requires.private to audit.pc file - Try to interpret OPENAT2 fields correctly ProtectControlGroups in auditd.service was preventing people from placing rules on /proc, so it's now off by default. The checks on the exclude filter were not matching the checks that kernel does. The checks were updated. io_uring support was added as was support for translating the new fields in the FANOTIFY record. The interpretation of the mode field in the OPENAT2 record was broken because it was expected to be in hex format like everywhere else, but instead it is decimal. That should be corrected. SHA256: b5cf3cdabb2786c08b1de3599a3b1a547e55f7a9f9c1eb2078f5b44cf44e8378 Please let me know if you run across any problems with this release. -Steve