2005-12-01 15:21 thomas * ChangeLog, include/laus.h, include/laus_tags.h, include/laussrv.h, include/linux/laus_audit.h, liblaussrv/syscall.h: - removed copyright disclaimer of SuSE from header files 2005-10-13 11:40 thomas * utils/audbin.c: - replaced perror() with fatal() for read errors 2005-10-13 11:37 thomas * utils/audbin.c: removed exit(1) at line 398 because fatal() does an exit() on its own 2005-08-05 15:20 thomas * TODO: - emotied 2005-07-27 11:29 thomas * liblaus/liblaus.c: - added laus_fd check to laus_log() 2005-07-25 17:51 thomas * utils/augrep.c: - fixed check_ent_time() body 2005-07-25 17:43 thomas * utils/augrep.c: - fixed declaration of check_end_time() 2005-07-25 14:59 thomas * ChangeLog: - updated ChangeLog 2005-07-25 14:58 thomas * ChangeLog, auditd/output.c, etc/audit.conf: - added Red Hat patch laus-rhel-nsync.patch to add threshold for syncing to improve performance 2005-07-25 14:16 thomas * utils/augrep.c: - added Red Hat patch laus-0.1-bug_147996_mktime.patch and laus-0.1-bug_147996_dst_correction.patch to improve (mktime()) and fix time handling 2005-07-25 14:02 thomas * utils/augrep.c: - added Red Hat patch laus-0.1-bug_147993_AUDPR_SEQNR.patch to add print flag AUDPR_SEQNR 2005-07-25 13:57 thomas * docs/auditd.8: - applied Red Hat patch laus-0.1-bug_138635_auditd_manpage.patch to fix typos 2005-07-25 13:56 thomas * liblaus/: laus_attach.3, laus_init.3, laus_open.3, laus_read.3, laus_setauditdaemon.3, laus_setfilter.3, laus_setpolicy.3, laus_strerror.3, laus_suspend.3, laus_textmessage.3: - applied Red Hat patch laus-0.1-bug_138634_aduit_audit.patch to fix typos 2005-07-25 13:55 thomas * docs/laus.7: - applied Red Hat patch laus-0.1-bug_138169_laus_records.patch to fix typos 2005-07-25 13:51 thomas * auditd/main.c, docs/audbin.1, etc/audit.conf, utils/audbin.c: - added threshold feature from Red Hat (laus-0.1-bug_130071_audbin_threshold.patch) 2005-07-25 13:24 thomas * auditd/output.c: - added patch to not sync piped commands (bug #98225, author: Ralf.Liesegang@fujitsu-siemens.com) 2005-07-25 13:23 thomas * auditd/output.c: - added patch to remove disk threshold checking for stream commands (bug #98225, author: Ralf.Liesegang@fujitsu-siemens.com) 2005-07-25 12:41 thomas * etc/audit.conf: - added missing ';' at the end of command = in stream mode 2005-05-30 15:55 thomas * auditd/output.c: - added patch for bug #84026 to fix handling of stream output. (UNTESTED) 2004-09-04 10:14 thomas * pam-module/Makefile.am: - added -lpam- updated 2004-08-31 13:23 thomas * include/linux/laus_audit.h: - added patch from Klaus to make the LOGIN and AUD messages recognizeable on ia64 2004-08-23 15:21 thomas * liblaussrv/process.c: - added missing msg_len variable 2004-08-20 17:51 thomas * liblaussrv/process.c: - added "alignment patch" for handling aud_message structure 2004-08-20 17:06 thomas * liblaussrv/syscall.c: - added laus-0.2_clone2.diff to add support for clone2() syscall needed on IA64 2004-08-20 17:05 thomas * auditd/main.c: - added patch laus-0.2_auditd-realign-a.diff to fix alignment problem while copying aud_message on IA64 2004-06-29 20:26 thomas * ChangeLog: - updated 2004-06-29 20:25 thomas * liblaussrv/syscall.c, include/asm/unistd.h, include/asm-parisc/unistd.h: - added HPPA support from bg@suse.de 2004-06-29 20:17 thomas * auditd/audit.init: - added section to reload filters only 2004-06-29 20:16 thomas * include/laus.h: - added description of error codes 2004-06-29 20:16 thomas * liblaussrv/syscall.c: - added Klaus' fix for semtimedop() 2004-06-02 12:31 thomas * etc/filter.conf: - removed entry for syscall create completely 2004-06-02 12:18 thomas * ChangeLog: - updated 2004-06-02 09:23 thomas * configure.ac, docs/laus.7: - removed last occurence of linux/audit.h 2004-06-01 18:29 thomas * auditd/actions.c, auditd/constants.c, auditd/daemon-conf.c, auditd/filter-conf.c, auditd/filter.c, auditd/filter.h, auditd/parser.c, etc/filter.conf, include/Makefile.am, include/laus.h, include/linux/laus_audit.h, utils/aucat.c, utils/audbin.c, utils/augrep.c: - removed the presence of linux/audit.h and audit.h 2004-06-01 18:05 thomas * include/linux/audit.h: - renamed to laus_aufit.h 2004-06-01 17:48 thomas * include/audit.h: - removed, contents in laus.h now 2004-06-01 17:33 thomas * include/linux/laus_audit.h: - needs to be renamed for glibc-devel conflict 2004-05-13 16:22 thomas * ChangeLog: - updated 2004-05-13 16:07 thomas * etc/filter.conf: - updated to new version from Jan 2004-05-11 15:40 thomas * auditd/output.c: - added missing var. status 2004-05-11 14:18 thomas * ChangeLog: - updated 2004-05-11 14:09 thomas * auditd/filter.c: - added liblaussrv.h 2004-05-11 14:09 thomas * utils/audbin.c: - initialized var. ofd 2004-05-11 14:07 thomas * utils/augrep.c: - initialized var. value - removed declaration of netlink_data 2004-05-11 14:03 thomas * auditd/output.c: - removed declaration of output_notify_wait() 2004-05-11 14:02 thomas * auditd/output.c: - removed unused var. res 2004-05-11 13:57 thomas * liblaussrv/syscall.c: - added missing function declaration 2004-05-11 13:54 thomas * liblaussrv/process.c: - added missing header file for free() 2004-05-11 13:50 thomas * include/laus.h: - added attribute to laus_log() for variable arg.s - removed warning in header fiel 2004-04-27 09:11 thomas * ChangeLog: - updated 2004-04-27 09:11 thomas * auditd/audit.init, etc/filter.conf, liblaussrv/syscall.c: - aded new patch from Jan 2004-04-19 11:27 thomas * utils/augrep.c: - added patch from Jerone (IBM) to make augrep handle syscall names correctly with new LAuS kernel code for 2.6 kernel. 2004-03-31 15:11 thomas * liblaus/: laus_api_version.3, laus_version.3: - added new man pages for newly added library function calls 2004-03-26 12:36 thomas * ChangeLog: - updated 2004-03-26 08:21 thomas * auditd/audit.init: - exit if module is not loaded 2004-03-25 17:49 thomas * etc/filter.conf: - modified filter.conf for 2.6 2004-03-25 12:12 thomas * liblaussrv/syscall.c: # removed superfluous #define for CLONE_PID 2004-03-25 11:45 thomas * auditd/auditd.h, auditd/filter-conf.c, auditd/filter.c, auditd/main.c, auditd/objects.c, auditd/output.c, include/laus.h, include/laussrv.h, include/linux/audit.h, liblaus/liblaus.c, liblaussrv/print.c, liblaussrv/process.c, liblaussrv/syscall.c, liblaussrv/syscall.h, utils/aucat.c, utils/augrep.c: - applied Jan's missing fix (lacked before) 2004-03-24 13:34 thomas * auditd/audit.init, auditd/filter.c, auditd/main.c, docs/laus.7, etc/filter.conf, include/laus.h, include/laussrv.h, include/linux/audit.h, liblaus/Makefile.am, liblaus/liblaus.c, liblaussrv/Makefile.am, liblaussrv/process.c, liblaussrv/syscall.c, liblaussrv/syscall.h, utils/aucat.c: - updated to Jan's new patch 2004-03-23 16:27 thomas * include/asm-i386/unistd.h, include/asm-ia64/unistd.h, include/asm-ppc/unistd.h, include/asm-ppc64/unistd.h, include/asm-x86_64/unistd.h, liblaussrv/syscall.c: - resolved PPC/PPC64 problems - updated arch-dependent unistd.h 2004-03-23 12:06 thomas * include/asm-s390/unistd.h, include/asm-s390x/unistd.h, include/asm-x86_64/unistd.h, liblaussrv/syscall.c: - fixed build problems on various architectures 2004-03-22 16:27 thomas * include/Makefile.am, pam-module/Makefile.am, pam-module/pam_laus.c: - make code run for SL9.1 2004-03-22 13:30 thomas * configure.ac, auditd/audit.init, auditd/filter.c, auditd/main.c, etc/filter.conf, include/laus.h, include/laussrv.h, include/asm-i386/unistd.h, include/linux/audit.h, liblaus/liblaus.c, liblaussrv/process.c, liblaussrv/syscall.c, liblaussrv/syscall.h, utils/aucat.c: - added patch from Jan Beulich for SLES9 2004-03-22 13:21 thomas * auditd/audit.init: - removed encoding escapes from MUA 2003-11-13 09:15 thomas * auditd/audit.init: - update to Klaus' version 2003-11-07 16:10 thomas * auditd/audit.init: - new version from Klaus 2003-11-05 08:22 thomas * docs/laus.7: - fixed typo 2003-10-31 09:26 thomas * auditd/audit.init: - added modifications from Klaus' certification RPM 2003-10-28 09:44 thomas * docs/auditd.8: - just added note foer -r option 2003-10-27 14:55 thomas * docs/Makefile.am: - added laus.7 2003-10-23 16:24 thomas * docs/Makefile.am: - added laus-fields.7 2003-10-21 14:33 thomas * auditd/audit.init: - removed audit64 support in innit script for all arch.s expect ppc64 2003-10-21 12:39 okir * auditd/main.c: - write correct pid to pid file 2003-10-20 10:09 thomas * auditd/audit.init: - added support for audit64 binary 2003-10-17 14:28 okir * liblaussrv/syscall.c: - msgrcv,msgsnd: print type+flags arguments as hex 2003-10-15 10:41 okir * auditd/constants.c: - fixed __WSIGMASK 2003-10-14 09:26 thomas * docs/laus.7: - minor bug-fixes 2003-10-08 10:57 thomas * auditd/audit.init: - updated - added support for pid file 2003-10-08 10:13 okir * auditd/: Makefile.am, auditd.h, main.c, utils.c: - auditd now creates a pid file at start-up 2003-10-08 10:08 okir * auditd/: auditd.h, constants.c: - Moved syslog.h include about 2003-10-07 11:37 thomas * docs/audit.4: - added description ofproc filesystem 2003-10-06 17:33 okir * utils/augrep.c: - The previous patch removes the biarch check. Re-adding it. 2003-10-02 11:46 thomas * ChangeLog: - updated 2003-10-02 11:23 thomas * docs/augrep.1: - added reference to laus-field.7 2003-10-02 11:21 thomas * docs/aucat.1: - added example output 2003-10-02 11:19 thomas * docs/laus-fields.7: - added field description 2003-10-02 10:41 thomas * docs/audit.conf.5: - added comment about include directive 2003-09-30 10:05 thomas * include/Makefile.am: - added asm-ia64 and asm-s390x 2003-09-30 09:52 thomas * include/: asm/unistd.h, asm-s390x/unistd.h: - added s390x support 2003-09-29 19:20 thomas * liblaus/liblaus.c: - added UINT_MAX check for counter 2003-09-29 18:17 thomas * liblaus/liblaus.c: - removed debug code 2003-09-29 18:09 thomas * liblaus/liblaus.c: - fixed init. of patch-Linux-PAM-0.76-laus.diff in laus_close() 2003-09-29 16:57 thomas * liblaus/liblaus.c: - laus_open counter limit typo fixed 2003-09-29 15:39 thomas * liblaus/liblaus.c: - added laus_open counter to avoid negativ interaction with laus'ized libpam 2003-09-29 11:07 thomas * TODO: - updated 2003-09-29 09:31 thomas * include/: asm/unistd.h, asm-ia64/unistd.h: - added ia64 support 2003-09-26 20:08 thomas * docs/augrep.1, utils/augrep.c: - new one from Jerone 2003-09-26 20:08 thomas * ChangeLog: - 2003-09-26 16:24 thomas * liblaus/: laus_attach.3, laus_init.3, laus_log.3, laus_open.3, laus_read.3, laus_setauditdaemon.3, laus_setfilter.3, laus_setpolicy.3, laus_strerror.3, laus_suspend.3, laus_textmessage.3: - reference laus.7 2003-09-26 16:21 thomas * docs/: aucat.1, audbin.1, audit-filesets.conf.5, audit-filter.conf.5, audit.4, audit.conf.5, auditd.8, augrep.1, aurun.8, laus-record.7, laus.7: - added reference to laus.7 2003-09-26 13:35 thomas * docs/audit-filter.conf.5: - added text about retirn code of user/login messages 2003-09-26 11:08 thomas * docs/laus.7: - fixed typos - added a bit more text 2003-09-25 17:20 okir * include/asm-s390/unistd.h: - missed __NR_sched_setaffinity and a few more 2003-09-25 14:28 thomas * docs/laus.7: - wrote laus.7 to give brief description of LAuS and to add all missing docu that does not fit elsewhere, like list of instrumented programs and alike 2003-09-24 16:28 thomas * docs/laus.7: - just added skeleton 2003-09-24 16:13 thomas * liblaus/: laus_attach.3, laus_init.3, laus_open.3, laus_read.3, laus_setauditdaemon.3, laus_setfilter.3, laus_setpolicy.3, laus_strerror.3, laus_suspend.3, laus_textmessage.3: - replaced occurence of laus (4) with audit (4) 2003-09-23 15:00 thomas * docs/audit-filter.conf.5: - removed list of instrumented user space code, we've to find a better place 2003-09-23 14:44 thomas * docs/audit-filter.conf.5: - added list of instrumented user space code 2003-09-23 14:00 thomas * docs/audit.4: - some minor makeup changes 2003-09-23 13:57 thomas * docs/: Makefile.am, audit.4, audit.conf.5, auditd.8: - replaced laus(4) with ausit(4) - added man-page for audit(4) 2003-09-22 17:50 okir * auditd/main.c: - When reloading audit policy, log a corresponding event 2003-09-22 17:40 okir * auditd/filter-conf.c: - When expanding sets, make sure the left term is always the predicate. This allows the kernel module to unroll into a small loop. 2003-09-22 17:38 okir * auditd/filter.c: - when dumping filters, properly print true/false 2003-09-22 13:00 thomas * COPYING: - changed to GPL 2003-09-19 14:59 thomas * docs/: Makefile.am, audit-filesets.conf.5: - added man page for filesets.conf 2003-09-19 14:04 thomas * docs/audit-filesets.conf.5: - just added pointer man-page 2003-09-19 13:55 thomas * docs/audit-filter.conf.5: - - added patch from Emily to explain include directive 2003-09-19 11:22 okir * auditd/actions.c: - handle SIGTERM when suspended 2003-09-19 09:36 okir * utils/augrep.c: - fixed -F option 2003-09-18 23:28 okir * liblaussrv/process.c: - another fix for follow mode 2003-09-18 23:18 okir * docs/: aucat.1, augrep.1: - dont document the new -F option, so ibm doesn't have to test it 2003-09-18 17:55 okir * liblaussrv/print.c: - dont try to strip NUL byte off empty strings 2003-09-18 14:37 okir * liblaussrv/syscall.c: - added some syscalls that were missinh on i386 2003-09-18 14:32 okir * liblaussrv/syscall.c: - added a new more syscalls, mostly ppc64 specific 2003-09-18 13:13 okir * TODO: Update 2003-09-18 10:00 okir * liblaussrv/biarch.c: - use exevp, as argv[0] may not be the full path 2003-09-17 23:56 okir * include/: Makefile.am, asm/unistd.h, asm-i386/unistd.h, asm-ppc/unistd.h, asm-ppc64/unistd.h, asm-s390/unistd.h, asm-x86_64/unistd.h: - copied asm*/unistd.h from kernel source so we have *all* system calls 2003-09-17 23:55 okir * include/linux/audit.h: - added AUDIT_ARG_VECTOR 2003-09-17 19:33 okir * docs/laus-record.7: - Removed incorrect comment wrt 64bit IMMEDAITE quantities on IA32 2003-09-17 17:18 okir * liblaussrv/: biarch.c, syscall.c: - fixed biarch handling 2003-09-17 16:14 okir * docs/aucat.1, docs/augrep.1, include/laussrv.h, liblaussrv/process.c, utils/aucat.c, utils/augrep.c: - Implemented follow mode in aucat/augrep 2003-09-17 16:06 okir * liblaussrv/syscall.c: - whe displaying open(2), suppress file mode if O_CREAT not given 2003-09-17 14:07 okir * liblaussrv/biarch.c: - make laus do the right thing on biarch systems 2003-09-17 11:48 okir * utils/audbin.c: - audbin doesnt need to be biarch aware either 2003-09-17 11:45 okir * auditd/main.c, include/laussrv.h, liblaussrv/Makefile.am, utils/aucat.c, utils/audbin.c, utils/augrep.c: - make laus do the right thing on biarch systems 2003-09-17 00:39 thomas * include/laus_tags.h: - added ADMIN_amtu 2003-09-17 00:23 thomas * liblaus/laus_log.3: - added patch from Emily to delete the reference to the non-existent laus man page 2003-09-16 23:59 thomas * auditd/audit.init: - fixed typo 2003-09-15 14:20 okir * auditd/: auditd.h, output.c: - run auditd at SCHED_RR priority 2003-09-15 14:19 okir * auditd/main.c: - run auditd at SCHED_RR priority - debug output: print messages/sec 2003-09-15 14:18 okir * auditd/thresholds.c: - less verbose debug output 2003-09-15 09:54 okir * TODO, NEWS: Update 2003-09-15 09:34 okir * utils/augrep.c: - fixed up help message (Jerone) 2003-09-15 09:33 okir * docs/: aucat.1, augrep.1: - manpage fixup from Jerone 2003-09-12 17:46 okir * liblaussrv/print.c: - strip trailing NUL byte off strings 2003-09-12 13:43 okir * TODO: Update 2003-09-10 16:14 thomas * etc/filter.conf: - added filter and predicates for handling address result values 2003-09-10 15:37 okir * auditd/main.c: - When reading from the audit device, split up data into individual records 2003-09-09 20:14 okir * auditd/output.c: - fixed race condition in SIGCHLD handling 2003-09-08 18:52 okir * utils/augrep.c: - fixed typo spotted by Jerone 2003-09-04 18:28 okir * liblaussrv/syscall.c: - print 3rd arg of sendfile 2003-09-04 17:23 okir * etc/filter.conf: - another syntax error 2003-09-04 14:15 thomas * utils/augrep.c: added patch from Jerone 2003-09-04 14:12 thomas * utils/aucat.c: added Jerone's patch to enhance option list 2003-09-04 14:08 thomas * docs/augrep.1: new version from Jerone 2003-09-04 08:36 thomas * auditd/audit.init: - fixed modprobe 2003-09-01 11:02 thomas * auditd/Makefile.am: - fixed typo 2003-09-01 11:02 okir * liblaussrv/syscall.c: - __NR_tkilld -> __NR_tkill 2003-08-29 20:37 okir * TODO: Update 2003-08-29 18:16 thomas * etc/filter.conf: cleaned up a bit 2003-08-29 17:52 okir * auditd/main.c: - make sure auditd doesn't audit itself 2003-08-29 17:36 okir * NEWS: Update 2003-08-29 15:42 okir * liblaussrv/: syscall.c, syscall.h: - when printing the return code of a syscall, consider values < -1024 as addresses, so that stuff like create_module properly reports their return value. 2003-08-27 16:57 thomas * etc/filesets.conf: - removed set for sensitive direc.s 2003-08-27 15:37 okir * etc/audit.conf: - the symlink should be /var/log/audit NOT /var/log/audit.bin 2003-08-27 15:32 okir * etc/filter.conf: - removed left-over reference to is-sensitive 2003-08-26 20:19 okir * TODO: Update 2003-08-26 14:04 okir * TODO: Update 2003-08-26 14:01 okir * liblaussrv/netlink.c: - bug fixes to netlink printing code 2003-08-26 13:08 okir * TODO, NEWS: Update 2003-08-26 13:08 okir * liblaussrv/: netlink.c, syscall.c, syscall.h: - added missing netlink messages 2003-08-26 10:21 thomas * etc/: filesets.conf, filter.conf: - fixed O_CREAT, fixed sensitive-dirs 2003-08-25 13:01 thomas * etc/filter.conf: - changed mask value for ipc creat 2003-08-22 13:27 okir * etc/filter.conf: - Added default filters for user-message and process-login 2003-08-22 13:26 okir * TODO, NEWS: Update 2003-08-22 13:26 okir * docs/audit-filter.conf.5: - documented filter tags 2003-08-22 13:21 okir * docs/audit-filter.conf.5: - added missing bits and pieces 2003-08-22 13:00 okir * docs/audit.conf.5, etc/audit.conf: - the keyword to specify filter config file is really filter-config 2003-08-22 12:59 okir * include/linux/audit.h: - Update to latest kernel header 2003-08-22 12:59 okir * auditd/filter.c: - Added target event-name 2003-08-22 12:59 okir * auditd/main.c: - Changed event names AUDIT_{START,STOP} to AUDIT_{start,stop} 2003-08-22 12:58 okir * auditd/constants.c: - added various netlink related constants 2003-08-21 18:07 okir * TODO: Update 2003-08-20 11:59 thomas * TODO: updated 2003-08-19 09:47 thomas * TODO: updated 2003-08-15 11:31 okir * TODO: Update 2003-08-15 11:20 okir * docs/audit-filter.conf.5: - small update 2003-08-15 10:08 okir * docs/auditd.8: - implemented filter reload through auditd -r 2003-08-15 10:02 okir * auditd/: filter.c, main.c: - implemented filter reload through auditd -r 2003-08-15 10:02 okir * auditd/output.c: - fixed debug output, again 2003-08-14 21:32 thomas * etc/filter.conf: - is-sensitive re-added 2003-08-14 21:17 thomas * etc/filter.conf: - added full audit-tags support 2003-08-14 20:32 thomas * etc/audit.conf: - nothing changed 2003-08-14 20:28 thomas * auditd/constants.c: - added constants for IPC and ioctl 2003-08-14 17:15 okir * NEWS, TODO: Update 2003-08-14 14:19 okir * auditd/: filter.c, output.c: - debugging fixes 2003-08-14 14:19 okir * etc/: filesets.conf, filter.conf: - updated default filters 2003-08-14 14:18 okir * utils/aurun.c: - fixed use of laus_log 2003-08-13 10:12 thomas * include/laus.h: - added errno.h 2003-08-12 15:38 okir * auditd/filter-conf.c: - removed obsolete debug message 2003-08-08 15:44 okir * NEWS, TODO: Update 2003-08-08 14:25 okir * TODO: Update 2003-08-08 14:24 okir * include/audit.h: - didn't compile 2003-08-08 14:20 okir * auditd/auditd.h: - added output_child_complete 2003-08-08 14:20 okir * auditd/main.c: - catch exiting children; dispatch status to output code 2003-08-08 14:19 okir * auditd/output.c: - Reorganized binfile output stuff so that binfiles don't get clobbered when the daemon is restarted - Handle exit status of notify commands as soon as the exit; try to be more robust about failures. 2003-08-08 12:42 okir * liblaussrv/syscall.c: - Added support for AUDIT_ARG_ERROR - Some pretty printing fixes 2003-08-08 12:28 thomas * include/Makefile.am: - add new laus_tags.h file 2003-08-08 12:26 thomas * include/laus_tags.h: - renamed 2003-08-08 12:18 okir * include/linux/audit.h: - added AUDIT_ARG_ERROR 2003-08-08 12:16 thomas * include/linux/audit_tags.h: - moved to ../laus_tags.h 2003-08-08 08:55 thomas * include/audit.h: - added audit tags 2003-08-08 08:42 thomas * include/laus.h: - changed laus_log() declaration 2003-08-08 08:40 thomas * liblaus/liblaus.c: - laus_log() supports audit tags, TAKE CARE: added one argument 2003-08-07 21:01 okir * TODO, auditd/actions.c, etc/audit.conf: - fixed event name handling in disk full audit action 2003-08-07 20:56 okir * TODO: TODO 2003-08-07 20:52 okir * etc/: audit.conf, filter.conf: - also catch SOCK_RAW sockets 2003-08-07 20:51 okir * auditd/constants.c: - added SOCK_* constants 2003-08-07 20:37 okir * auditd/: filter-conf.c, filter.c, filter.h, parser.c: - sorted out bug with name tags 2003-08-07 19:13 okir * utils/audbin.c: - write indefinite length header 2003-08-07 19:13 okir * docs/: Makefile.am, audbin.1: - added new manpage for audbin 2003-08-07 19:12 okir * utils/audbin.c: - flock the destionation file while writing to it 2003-08-07 18:58 okir * docs/aucat.1: - Cleanup up the troff formatting a little 2003-08-07 18:45 okir * utils/: Makefile.am, audbin.c: - added new command audbin 2003-08-07 18:45 okir * liblaussrv/process.c: - deal more gracefully with empty files 2003-08-07 17:06 okir * TODO: Update 2003-08-07 15:45 okir * liblaussrv/print.c: - print exit message (patch from Jerone) 2003-08-07 14:53 okir * NEWS, TODO: Update 2003-08-07 14:48 okir * NEWS, TODO, auditd/filter-conf.c, auditd/filter.c, auditd/filter.h, auditd/main.c, include/linux/audit.h: - implemented rule tagging 2003-08-07 14:48 okir * auditd/output.c: - bugfix to previous change 2003-08-07 14:11 okir * auditd/filter-conf.c, auditd/filter.c, auditd/filter.h, etc/filter.conf: - implemented filter expression tagging 2003-08-07 13:47 okir * etc/audit.conf, include/laus.h, liblaussrv/process.c: - Added new field to audit file header that holds the number of bytes written 2003-08-07 13:46 okir * auditd/output.c: - Maintain "current" symlink pointing to current bin file - Faster start-up: don't blank bin file if all blocks are allocated already - added field to audit file header that holds the number of bytes written 2003-08-07 13:44 okir * TODO, NEWS: Update 2003-08-07 13:44 okir * docs/audit.conf.5: - documented new bin symlink 2003-08-07 12:57 okir * auditd/filter.c: - support for filtering by login uid; fixed some warnings 2003-08-07 12:57 okir * docs/audit-filter.conf.5: - support for filtering by login uid 2003-08-04 12:41 okir * include/linux/audit.h: - Update to latest kernel header file 2003-08-01 17:08 thomas * include/linux/audit_tags.h: - added for supporting audit tags 2003-08-01 15:04 okir * NEWS: Update 2003-08-01 13:59 okir * TODO: Update 2003-08-01 13:30 okir * liblaussrv/syscall.c: - x86_64 has no send(2) recv(2) system calls 2003-08-01 12:38 okir * utils/aurun.c: - previous change was broken 2003-08-01 12:29 okir * utils/aurun.c: - Fixed printing of command line args - if caller was audited, log invoked program to callers session. if he wasn't audited, log using the new session info 2003-08-01 11:21 thomas * TODO: - updated 2003-08-01 11:18 okir * utils/aurun.c: - attach before calling laus_log 2003-08-01 11:17 okir * liblaus/liblaus.c: - laus_usermessage should set failed_func on error 2003-08-01 10:33 thomas * TODO: - updated 2003-07-31 18:03 okir * TODO: Update 2003-07-31 12:24 okir * utils/augrep.c: - fixed typo 2003-07-31 12:20 okir * configure.ac, liblaussrv/syscall.c: - build fix for ppc (sys/capability.h) 2003-07-31 10:40 okir * utils/augrep.c: - fixed segfault 2003-07-31 10:37 okir * TODO: Update 2003-07-29 15:43 okir * include/Makefile.am: - install linux/audit.h as well 2003-07-29 15:27 okir * liblaussrv/syscall.c: - SLES build fixes 2003-07-29 15:08 okir * liblaus/liblaus.c: - when printing an error message, include name of failed function again 2003-07-29 15:08 okir * TODO: Update 2003-07-29 15:08 okir * liblaussrv/syscall.c: - more pretty printing fixes 2003-07-29 14:30 okir * liblaussrv/syscall.c: - fsetxattr fix 2003-07-29 14:26 okir * liblaussrv/syscall.c: - pretty print clone(2) arg 2003-07-29 14:20 okir * liblaussrv/syscall.c: - pretty print capset args 2003-07-29 12:38 okir * utils/aurun.c: - added missing include string.h 2003-07-29 12:31 okir * TODO: Update 2003-07-29 12:23 okir * TODO: Update 2003-07-29 12:22 okir * liblaussrv/: Makefile.am, netlink.c, print.c, syscall.c, syscall.h: - added netlink printing stuff 2003-07-28 21:30 okir * liblaussrv/syscall.c: - added SIOC[GS]ARP 2003-07-28 21:04 okir * auditd/auditd.h, auditd/main.c, auditd/output.c, pam-module/pam_laus.c: - Build fix for previous change 2003-07-28 12:39 okir * pam-module/pam_laus.c: - Updated to new error returns from liblaus 2003-07-28 12:30 okir * docs/aurun.8: - documented -N option 2003-07-28 12:30 okir * utils/aurun.c: - added -N option - new liblaus error handling - log command+args 2003-07-28 12:29 okir * liblaussrv/process.c: - turned file header checks into warning, no longer fatal 2003-07-28 12:28 okir * include/laus.h, liblaus/liblaus.c: - fixed liblaus error handling 2003-07-28 12:28 okir * auditd/: auditd.h, main.c: - logging changes 2003-07-28 12:28 okir * auditd/output.c: - die on fatal errors 2003-07-28 12:25 okir * configure.ac: - backed out previous change; stupid 2003-07-28 12:25 okir * configure.ac: - force -all 2003-07-28 12:25 okir * TODO: Update 2003-07-28 11:36 okir * docs/augrep.1: - Added --syscall option 2003-07-28 11:36 okir * utils/augrep.c: - Fixed strptime warning - Added --syscall option - Fixed strings (no \ continuation lines) 2003-07-28 11:32 okir * liblaussrv/: print.c, syscall.c, syscall.h: - Major redo of system call printing; lots of new pretty print stuff 2003-07-28 11:31 okir * liblaus/liblaus.c: - Remove terminal owner check 2003-07-28 11:31 okir * auditd/output.c: - create /var/log/audit.d if it doesn't exist 2003-07-28 11:30 okir * TODO: Update 2003-07-27 02:49 okir * TODO: Update 2003-07-27 02:38 okir * liblaussrv/process.c: - fixed version check 2003-07-27 02:35 okir * include/laus.h: - changed back LAUS_VERSION 2003-07-26 21:19 okir * utils/aucat.c: - fixed typo 2003-07-26 15:48 okir * auditd/output.c: - fixed error handling 2003-07-26 15:46 okir * etc/audit.conf: - added missing semicolons 2003-07-25 16:11 thomas * utils/augrep.c: - fixed bug at line 587 2003-07-25 13:31 thomas * liblaus/liblaus.c: - just stripped some error messages 2003-07-25 12:54 thomas * liblaussrv/print.c, utils/augrep.c: - make code compile 2003-07-25 12:26 thomas * utils/Makefile.am, utils/aucat.c, utils/augrep.c, include/laussrv.h, liblaussrv/print.c: - added Jerone's patches 2003-07-25 12:25 thomas * docs/Makefile.am: - added Jerone's augrep man page - moved utils man pages 2003-07-25 09:26 thomas * docs/: aucat.1, augrep.1: - added man pages from Jerone 2003-07-24 15:27 thomas * liblaus/liblaus.c: - added error codes and description for terminal checks 2003-07-24 15:24 thomas * include/laus.h: - added error code for terminal sanity checks 2003-07-24 15:23 thomas * liblaus/liblaus.c: - added sanity checks for terminal in laus_setsession() 2003-07-24 15:22 thomas * TODO: - updated 2003-07-24 13:54 thomas * TODO: - updated 2003-07-23 21:32 okir * TODO: Update 2003-07-23 16:06 thomas * TODO: - updated (PAM) 2003-07-23 15:49 thomas * TODO, include/laus.h, liblaus/liblaus.c: - make laus_open() report all possible error values 2003-07-23 14:19 thomas * pam-module/pam_laus.c: - minor fix for if statement 2003-07-23 14:13 thomas * pam-module/pam_laus.c: - added "detach" option handling - UNTESTED! 2003-07-22 16:57 thomas * pam-module/pam_laus.c: - removed loggin, will be placed in libpam patch by klaus@ 2003-07-22 16:17 okir * auditd/output.c: - fixed uninitialized var 2003-07-18 20:05 thomas * ChangeLog: - update for code drop 2003-07-18 17:25 okir * TODO: Update 2003-07-18 11:48 thomas * TODO: - ppc64 porting done 2003-07-17 21:17 thomas * liblaussrv/syscall.c: - works now on PowerPC64 (headers are ugly broken, so fix is ugly too) 2003-07-17 20:16 okir * TODO: Update 2003-07-17 18:26 thomas * TODO: - added some lines in respect to conference call 2003-07-17 15:03 thomas * TODO: - added "Arch. Porting" section 2003-07-17 13:02 thomas * TODO: - updated for arch dependent code - added questions 2003-07-17 12:50 thomas * liblaussrv/: print.c, syscall.c: - modifications to make code compile on other architectures 2003-07-17 12:50 thomas * auditd/constants.c: - modifications to make code compile on PPC 2003-07-16 10:05 thomas * docs/Makefile.am: fix for not installing all man pages 2003-07-15 16:50 okir * include/linux/audit.h: - update 2003-07-15 16:44 okir * include/linux/audit.h: - protect kernel includes with ifdef __KERNEL 2003-07-14 16:27 okir * etc/audit.conf: - updated to match new action syntax 2003-07-14 16:24 okir * Makefile.am, configure.ac: - install manpages from docs directory 2003-07-14 16:24 okir * auditd/actions.c: - get action type from type = for symmetry 2003-07-14 16:24 okir * auditd/output.c: - fail if no bin file size is given 2003-07-14 16:23 okir * docs/auditd.8: - minor fix 2003-07-14 16:23 okir * docs/: audit.conf.5, Makefile.am: - added 2003-07-14 14:46 okir * auditd/Makefile.am: - moved manpages to ../docs 2003-07-14 14:43 okir * include/Makefile.am: - install audit.h 2003-07-14 14:43 okir * include/laus.h: - fixed formatting 2003-07-14 14:43 okir * include/audit.h: - added AUDIT_QLENCFG_PATH 2003-07-14 14:42 okir * auditd/actions.c, docs/auditd.8: - manpage update 2003-07-14 14:19 okir * TODO, auditd/Makefile.am, auditd/actions.c, auditd/auditd.h, auditd/output.c, auditd/thresholds.c: - made output error handling configurable 2003-07-14 14:19 okir * etc/audit.conf: - Updated to latest features 2003-07-14 13:35 okir * etc/Makefile.am: - install config files in proper location 2003-07-14 13:06 okir * include/audit.h: - Added 2003-07-14 12:44 okir * auditd/output.c: - compile fix 2003-07-14 12:43 okir * liblaussrv/process.c: - process file header 2003-07-14 12:42 okir * liblaussrv/print.c, utils/aucat.c: - print event name 2003-07-14 12:42 okir * liblaus/liblaus.c: - added laus_usermessage 2003-07-14 12:42 okir * include/linux/audit.h: - update to latest kernel header 2003-07-14 12:42 okir * include/laussrv.h: - print header, event name 2003-07-14 12:41 okir * include/laus.h: - add audit file header 2003-07-14 12:41 okir * etc/filter.conf: - add ioctl() 2003-07-14 12:41 okir * auditd/output.c: - write audit file header 2003-07-14 12:39 okir * auditd/main.c: - log audit messages on daemon start/stop 2003-07-14 12:39 okir * auditd/filter-conf.c: - fixed smallish keyword buffer 2003-07-14 12:38 okir * auditd/constants.c: - added ioctl constants 2003-07-14 12:38 okir * auditd/auditd.h: - added log_audit 2003-07-14 12:34 okir * TODO: Update 2003-07-11 16:36 okir * INSTALL, TODO: Update 2003-07-11 15:44 okir * TODO: Update 2003-07-11 15:35 okir * include/laus.h: - fixed typo 2003-07-11 15:34 okir * TODO: Update 2003-07-11 15:34 okir * include/linux/audit.h: - updated to latest kernel header 2003-07-11 15:34 okir * include/laussrv.h: - added extern C for C++ 2003-07-11 15:33 okir * include/laus.h: - Added laus_suspend/resume - added extern "C" 2003-07-11 15:27 okir * TODO, auditd/auditd.h, auditd/constants.c, auditd/daemon-conf.c, auditd/filter-conf.c, auditd/filter.c, auditd/filter.h, auditd/main.c, auditd/objects.c, auditd/output.c, auditd/parser.c, auditd/thresholds.c, include/laus.h, liblaus/liblaus.c, liblaussrv/process.c, pam-module/pam_laus.c, utils/aucat.c: - fixed compiler warnings 2003-07-11 15:26 okir * etc/audit.conf: - Update 2003-07-11 15:24 thomas * INSTALL: changed configure call 2003-07-11 14:56 okir * pam-module/pam_laus.c: - fixed ntop call 2003-07-11 14:55 okir * include/Makefile.am: - Make sure hdr files are installed 2003-07-11 14:53 okir * auditd/: Makefile.am, auditd.h, main.c, objects.c, output.c: - fixed bin mode 2003-07-11 14:53 okir * docs/auditd.8: - added FILES section 2003-07-11 14:40 thomas * pam-module/pam_laus.c: - added #define PAM_SM_ACCOUNT 2003-07-11 13:17 okir * auditd/audit.init: - added init script 2003-07-10 18:11 okir * TODO: Update 2003-07-10 17:27 okir * include/laussrv.h, include/linux/audit.h, liblaussrv/print.c, liblaussrv/process.c, utils/aucat.c: - Changed kernel audit message to include the time stamp when the record was generated 2003-07-10 17:26 okir * TODO: Update 2003-07-10 11:13 okir * include/laussrv.h, liblaussrv/print.c, utils/aucat.c: - merged aucat prettying up patch from Jerone 2003-07-10 11:13 okir * INSTALL: - updated 2003-07-09 12:59 okir * pam-module/pam_laus.c: - added acc_mgmt hook 2003-07-07 16:20 okir * auditd/thresholds.c: - added shutdown action 2003-07-07 12:00 thomas * TODO: - added security issue concerning ttys 2003-07-05 13:13 thomas * liblaus/Makefile.am: enabled versioning for liblaus 2003-07-02 18:08 thomas * TODO: added items as result of conference call on 2003-07-02 2003-06-30 16:12 thomas * TODO: added some stuff afx asked about 2003-06-27 15:20 okir * pam-module/pam_laus.c: - laus_init is now void 2003-06-27 12:01 okir * TODO: Update 2003-06-27 11:20 okir * include/laus.h, liblaus/liblaus.c: - laus_init() now void 2003-06-27 11:20 okir * TODO: Update 2003-06-27 11:18 okir * auditd/output.c, docs/auditd.8: - Updated manpage to reflect log destination changes 2003-06-26 13:20 okir * etc/audit.conf: - fixed minor typo 2003-06-26 13:20 okir * INSTALL: - updated for pam-module 2003-06-26 13:20 okir * pam-module/Makefile: - obsolete 2003-06-26 13:19 okir * pam-module/: Makefile.am, pam_laus.c, pam_laus_auth.c, pam_laus_sess.c: - added automake support; fixed some bugs 2003-06-26 13:18 okir * configure.ac: - added automake support to pam-module 2003-06-26 13:11 thomas * pam-module/Makefile: added install section for top level makefile 2003-06-25 16:58 okir * auditd/main.c: - fixed write_record 2003-06-25 16:57 okir * TODO: Update 2003-06-25 09:46 okir * etc/filter.conf: - fixed process events 2003-06-18 17:59 okir * docs/laus-record.7: - new 2003-06-16 10:46 thomas * pam-module/Makefile: added rules for auth and sess module 2003-06-16 10:45 thomas * pam-module/pam_laus_sess.c: renamed 2003-06-16 10:43 thomas * pam-module/pam_laus_auth.c: authentication module 2003-06-16 10:34 thomas * pam-module/pam_laus.c: moved to pam_laus_sess 2003-06-13 16:54 okir * pam-module/Makefile: - Added -I../include 2003-06-13 16:53 okir * etc/Makefile.am: - Update 2003-06-13 16:53 okir * etc/auditd.conf: - Obsolete 2003-06-13 16:52 okir * etc/audit.conf: - Added new file 2003-06-13 16:33 okir * auditd/: daemon-conf.c, output.c, parser.c, thresholds.c: - fixes to previous checkin 2003-06-13 16:13 okir * configure.ac: - fixed PATH_CONFIG_DIR 2003-06-13 16:12 okir * auditd/: Makefile.am, auditd.h, constants.c, daemon-conf.c, filter-conf.c, filter.c, filter.h, main.c, objects.c, output.c, parser.c, parser.h, thresholds.c: - major rewrite for audit.conf based configuration 2003-06-13 16:12 okir * auditd/def_syscalls.c: - obsolete 2003-06-13 10:50 okir * liblaus/liblaus.c: - compile fix 2003-06-13 10:22 okir * liblaus/liblaus.c: - fix laus_exec 2003-06-12 18:40 okir * liblaus/: laus_attach.3, laus_init.3, laus_log.3, laus_open.3, laus_read.3, laus_setauditdaemon.3, laus_setfilter.3, laus_setpolicy.3, laus_suspend.3, laus_textmessage.3: - added security considerations 2003-06-12 18:04 thomas * liblaus/laus_suspend.3: typo 2003-06-12 17:52 okir * liblaus/: Makefile.am, laus_log.3, laus_setfilter.3, laus_setpolicy.3, laus_suspend.3, laus_textmessage.3: - some more manpages 2003-06-12 17:03 okir * liblaus/: Makefile.am, laus_setpolicy.3: - added laus_setpolicy.3 2003-06-12 16:10 okir * liblaus/laus_attach.3: - Update 2003-06-12 16:03 okir * liblaus/: Makefile.am, laus_attach.3, laus_init.3, laus_open.3, laus_read.3, laus_setauditdaemon.3, laus_strerror.3: - added some manpages 2003-06-12 15:51 okir * liblaus/liblaus.c: - Make laus_open behave the way the manpage says - Added laus_suspend/resume 2003-06-11 17:43 okir * docs/audit-filter.conf.5: - major embellishments 2003-06-11 17:42 okir * auditd/filter.c: - added netlink-* targets 2003-06-11 16:26 okir * auditd/filter.c: - added sock-{family,type} 2003-06-11 12:16 thomas * pam-module/: Makefile, pam_laus.c: first release of PAM module (UNTESTED) 2003-06-11 12:16 thomas * Makefile.am: added support for pam-module/ 2003-06-10 16:41 okir * liblaus/: laus_init.3, laus_open.3: - Manpage update 2003-06-10 15:43 thomas * TODO: mod 2003-06-10 15:06 okir * auditd/filter-conf.c, auditd/filter.c, auditd/main.c, include/linux/audit.h, liblaussrv/print.c: - added netlink events 2003-06-05 18:00 thomas * liblaus/: laus_init.3, laus_open.3: first version of man page fot laus_open and for laus_init 2003-06-05 17:35 thomas * liblaus/liblaus.c: set FD_CLOEXEC for global fdesc to enhance security 2003-06-04 16:00 okir * etc/filter.conf: - Updated 2003-06-04 15:59 okir * auditd/filter.c: - added support for return() and syscall-minor 2003-06-04 15:59 okir * auditd/filter-conf.c: - combine filters for socket/accept/etc into one switch statement; same for ipc 2003-06-04 15:58 okir * auditd/constants.c: - added AF_* constants 2003-06-04 15:58 okir * liblaussrv/print.c: - changed aud->code to aud->major/minor 2003-06-04 15:57 okir * liblaussrv/syscall.c: - Added many syscalls - Added sys_ipc mux/demux 2003-06-04 15:57 okir * include/laussrv.h: - added sys_ipc mux/demux 2003-06-04 15:56 okir * include/linux/audit.h: - Update to latest kernel patch 2003-06-03 17:20 okir * auditd/Makefile.am, docs/audit-filter.conf.5: - added audit-filter.conf.5 2003-06-03 15:49 okir * TODO: Update 2003-06-03 15:49 okir * etc/filter.conf: - updated sample file 2003-06-03 15:49 okir * auditd/: Makefile.am, constants.c, filter-conf.c, filter.c, filter.h, main.c: - Added support for in-kernel filtering 2003-06-03 15:48 okir * include/laussrv.h, liblaussrv/print.c, liblaussrv/process.c, utils/aucat.c: - syscall/result no longer arrive in two separate messages 2003-06-03 15:48 okir * include/linux/audit.h: - Update to latest kernel patch 2003-06-03 13:06 thomas * include/laus.h, liblaus/liblaus.c: added function laus_log() to meet design doc 2003-06-03 12:59 okir * include/laus.h, liblaus/liblaus.c: - added laus_textmessage 2003-06-03 12:57 okir * liblaus/liblaus.c, include/laus.h: - removed laus_setauditsessionid 2003-06-03 11:37 thomas * TODO: [no log message] 2003-06-03 11:37 thomas * etc/auditd.conf: new 2003-06-03 08:56 thomas * ChangeLog: mod 2003-05-28 17:55 okir * TODO: Update 2003-05-28 17:13 okir * Makefile.am, configure.ac: - added etc subdir 2003-05-28 17:13 okir * etc/: Makefile.am, filesets.conf, filter.conf: - added 2003-05-28 17:11 okir * auditd/Makefile.am, auditd/auditd.h, auditd/filter-conf.c, auditd/filter.c, auditd/filter.h, auditd/main.c, include/linux/audit.h: - first stab at filtering support 2003-05-28 17:11 okir * INSTALL: Updated configure instructions 2003-05-28 17:11 okir * liblaussrv/syscall.c: - added syscall_max() 2003-05-28 17:10 okir * liblaus/liblaus.c, include/laus.h: - added clrfilter, setfilter 2003-05-26 13:35 thomas * AUTHORS, ChangeLog, INSTALL, Makefile.am, README, configure.ac, COPYING, NEWS, TODO, auditd/Makefile.am, auditd/auditd.h, auditd/def_syscalls.c, auditd/main.c, docs/auditd.8, include/Makefile.am, include/laus.h, include/laussrv.h, docs/aurun.8, include/linux/audit.h, liblaus/Makefile.am, liblaus/liblaus.c, liblaussrv/Makefile.am, liblaussrv/print.c, liblaussrv/process.c, liblaussrv/syscall.c, utils/Makefile.am, utils/aucat.c, utils/aurun.c: Initial revision 2003-05-26 13:35 thomas * AUTHORS, ChangeLog, INSTALL, Makefile.am, README, configure.ac, COPYING, NEWS, TODO, auditd/Makefile.am, auditd/auditd.h, auditd/def_syscalls.c, auditd/main.c, docs/auditd.8, include/Makefile.am, include/laus.h, include/laussrv.h, docs/aurun.8, include/linux/audit.h, liblaus/Makefile.am, liblaus/liblaus.c, liblaussrv/Makefile.am, liblaussrv/print.c, liblaussrv/process.c, liblaussrv/syscall.c, utils/Makefile.am, utils/aucat.c, utils/aurun.c: Linux Audit-Subsystem Development Tree