audit.44 kernel

David Woodhouse dwmw2 at infradead.org
Thu May 19 15:20:26 UTC 2005


I seem to be building them faster than I can announce them. 

When testing socketcall code I observed that auditd was logging its own
actions, which soon descended into insanity as it generated two more log
entries for every one that it read from the socket. I have added code to
auditsc.c to exempt the audit_pid from being audited -- see attached
patch. The rest of it is just getting the skb queueing via kernel dæmon
working properly...

* Thu May 19 2005 David Woodhouse <dwmw2 at redhat.com> audit.44
- Honour audit_backlog_limit again
- Reorder patches to reflect upstream status

* Thu May 19 2005 David Woodhouse <dwmw2 at redhat.com> audit.43
- printk in audit_log_end() when no auditd
- Don't audit auditd itself

* Wed May 18 2005 David Woodhouse <dwmw2 at redhat.com> audit.42
- Restore Chris' third audit-to-skb patch

-- 
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: linux-2.6.9-audit-not-auditd.patch
Type: text/x-patch
Size: 1172 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050519/fdbc4824/attachment.bin>


More information about the Linux-audit mailing list