audit-2.2.1 released

[Steve Grubb]

Hi,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide  
soon. The ChangeLog is:

- Add more interpretations in auparse for syscall parameters 
- Add some interpretations to ausearch for syscall parameters
- In ausearch/report and auparse, allocate extra space for node names
- Update syscall tables for the 3.3.0 kernel
- Update libev to 4.0.4
- Reduce the size of some applications
- In auditctl, check usage against euid rather than uid

As I mentioned in another email, one of the best features of this release is 
that for ausearch a little over 40 common syscalls can now have some of their 
arguments interpreted. This means that if you are doing an investigation and you 
needed to know what flags was being passed, it will now tell you. If the 
arguments to the syscall involve uid's or gid's, they are now resolves to the 
account name. Also in the interpreted mode, a 0x is prefixed to all syscall 
arguments that are not interpreted as a visual reminder that the numbers are in 
hex.

This also contains an important bug fix where all records of a single event could 
not be grouped if the records contained a node name that was modest or large in 
size. All other changes in this release are self explanatory.

Please let me know if you run across any problems with this release.

-Steve