audit.44 kernel

Timothy R. Chavez tinytim at us.ibm.com
Thu May 19 15:34:13 UTC 2005


On Thursday 19 May 2005 10:20, David Woodhouse wrote:
> I seem to be building them faster than I can announce them.
>
> When testing socketcall code I observed that auditd was logging its own
> actions, which soon descended into insanity as it generated two more log
> entries for every one that it read from the socket. I have added code to
> auditsc.c to exempt the audit_pid from being audited -- see attached
> patch. The rest of it is just getting the skb queueing via kernel dæmon
> working properly...
>
> * Thu May 19 2005 David Woodhouse <dwmw2 at redhat.com> audit.44
> - Honour audit_backlog_limit again
> - Reorder patches to reflect upstream status
>
> * Thu May 19 2005 David Woodhouse <dwmw2 at redhat.com> audit.43
> - printk in audit_log_end() when no auditd
> - Don't audit auditd itself
>
> * Wed May 18 2005 David Woodhouse <dwmw2 at redhat.com> audit.42
> - Restore Chris' third audit-to-skb patch

test-booting a .39 kernel with the sleep and hook fixes (quit moving my damned 
audit_notify_watch() hook out of permission(), it needs to be there =)) 

-tim




More information about the Linux-audit mailing list