In order to get the tarball mentioned below to compile for RHEL4u3, I had to modify the SPEC file to allow glibc-kernheaders >= 2.6.9.1.94, whereas before it was an exact match only. RHEL4u3 ships with 2.6.9.1.98, and I hoped the changes between -94 and -98 were minor. All I've done to this point is compile the package. I ran out of time to actually perform any tests. Thanks for posting this. Hopefully it passes the final wickets at RedHat without a lot of grief. Charlie Todd Ball Aerospace & Technologies Corp. -----Original Message----- From: linux-audit-bounces(a)redhat.com on behalf of Steve Grubb Sent: Tue 11/14/2006 5:01 PM To: Linux Audit Discussion Subject: audit 1.0.15 released Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit The srpm is aimed at FC-4. A slightly different srpm is required for RHEL4. The Changelog is: - Correct address resolving of hostname in logging functions - Fix logging messages to use addr if passed - Add TRUSTED_APP message type - Fix netlink errno return - Auditd ignore most signals - Add audit dispatcher interface to auditd - In auditd if num_logs is zero, don't rotate on SIGUSR1 (#208834) - Cleanup file descriptor handling in auditd - Improve time handling in ausearch and aureport (#191394) - Attempt to reconstruct full path from relative for searching - Ausearch & aureport now fail if no args to -te - In aureport, add class between syscall and permission in avc report - Fix bug where fsync is called in debug mode - ausearch & aureport implement uid/gid caching - In ausearch & aureport, extract addr when hostname is unknown - In ausearch & aureport, test audit log presence O_RDONLY - Updated man pages (#213328, #213330) Please let me if there are any issues with this. -Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit