audit-devel-2.3.6-8.1<>,Yc/=„\9y5sĒN+RZd:ے/5PlAܘ®p f(T&&f1h$#_* 4f֬i>WXrVRr>.8u,ƙo=v {1مTfLןW G3zsޑ8ieim‚uc(.a+Kv[@':Aq= tu2V:Iಡ]%,ģѲKV+k|"f*Z ,>9~?~pd  E 3SzNN \N N 0N N 0NhNNtN_(8$9$:$FlGl,NHmdNInNXnYn\oN]p@N^wbx'cxdy>eyCfyHlyJuy\Nvzw{Nx}(Nz~`Caudit-devel2.3.68.1Header files and static library for libauditThe audit-devel package contains the static libraries and header files needed for developing applications that need to use the audit framework libraries.Yccloud104openSUSE Leap 42.3openSUSELGPL-2.1+http://bugs.opensuse.orgDevelopment/Libraries/C and C++http://people.redhat.com/sgrubb/audit/linuxx86_64 R ^V=ro\h#$Vh]]aS@6>_l;LRTg:f6/jAA큤YaYaYaY`YaYcSHG[SHGKSHGKSHGKSHGKYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYaYa723354ae2527bf473287454b25e4f4fdd460682e1776c59db8c06271fb2124b47b482fd3dad268a47e69ee8c890e0140c6261684ccd4b54fb401c9d6d00755949c7a5e2bb2a4f75ef5d8afc8ebc145b26461d1b5a5807e80e67b424894cb5266658df4e6a0b3327c74058798e74007bfe8ad4d332e08d5da3e83ce1d65777431f541764292c9a2a9121e435be45472c431b27dd924a2f66eee7a514342828d7cd64e64cb6510487a12504007b24701fbf087dc63c732a21479cc32952dc7cc85406570c3cf5442701baca7bb0c05ff18d31e4506d7513d1ff6a87fab1c5c330d702e4fc36eb2daef5cb96d79e01fb14a85887f8ce5ece857a49de039c81a1adf9b34a7eaa14324efd034ee7aeff45027082a0b2172a65f140a8b988365a2e03fe81dfb1f1801b7b458cd988d5d674c210b29fa8c266ef67bef764f8b4d4dac4057649e6ff8436e8f98264a7a7753da7f80874a7447d175b4edaf2725b366edc1f0aea06198f2affdfe8d8d924d653e14998e1728bf62f7567b53e8407dd0710e1e0f8660d22c53dd71784c837c628ca2e57e44c949697736a21d5f15efa59b0ba07064e76da6b52be5872f7fb5ce8ef999d93bc6f826b6329382fbac3c1739d8a49d0b5a7f75bd36af9180e74fd57be984ef9ffe3708010e3c93769b4c9d33f39ccd55031518cc2c43805c1e2b12cb3f984014ff8a5ad859cb2e3eddc84c5d66dec8d13517831e1658093d751e1e2283523a8d26fda09816cfcc9273c36105ab536eab604a40a40138ce1cd9465eee25eee18fc4bbe4fa594d208750d1c2e22ee904c5966bb7c4f0fc630de66c77c95eba4bca706279c2678586e719333aa1777a93cce0c03987e3be94797bab3e83a40d65dfdacca15eed1f0a6e694df1ed7eaacae1ce326d953be2dfa1f228ea51d875dfa59ba2e9fdb58985e161836c58a55a29100fda15a6cc0eed5aca589effd0f8304bda356b5afb4ae48fb3d402812d1edadbbd6f1610f8a161e84c9e9cc30b0759df04a33b10d372334d6da2b8d8d987b1cf3f48abc053c8b59651eccd73d441115e1680ed65fc0054cb6789094d37a60e845ed55d2986bbc35d00a35ce0104022e4bc74ac490e85bc737422ddcd8a354f15f4a6abf86ef450aeee6215e27dcf35b61f45283e80ac6cc2d75bfb217c107ba818860c7dbd1c3b1314adc2da117ead0ffb251a173a07ac9fede7a4c029b19a341496d92da8ef985dcdbb97f3ca93fca17e02d334390a74e1cc88c21f2dfb06f0aa2ce674ccffd491911d8dea1bfdb7904f439f9ad6c1b5c5e74b28561de4378bb2ed157d8d441701235aa66607df2761bd70b65c5430934c957184f6fba6357fb7adab653dad8407a18e344a2516eea327de2be149f016866c3ce62593f9785f3a1d62d92291e34de58ca8aa360f769f2f4977f8511924f31a12e04474063c634fb9d1369196a8246d8ac1a86e4bdf24905716e101c92902bce399705fccc0a8486e8f2f4848aa1bf6a032540f1d0eb9fe973d1df4ac04c49faa29b36c8a412563a233d53e142625e04576e1ceec3ff2d8f55b689ba19bdd56705873efaab0eb42978419bbf68d9a7dc02f4208e3c9a2b9e1f5dbd324c52186170c192fe042c05a47e3803b4c92d7c0bb8abf1a22ac7517cabd828a1ab0ce3fbf1ffd9blibaudit.so.1.0.0libauparse.so.0.0.0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootaudit-2.3.6-8.1.src.rpmaudit-develaudit-devel(x86-64)   libaudit1libauparse0rpmlib(CompressedFileNames)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsLzma)2.3.62.3.63.0.4-14.0-14.4.6-14.11.2T@SM@R@R@QzQ)@Qzl@QP<@QP<@QLGQ @Q @P@Px@OLN@NtMz@M@MbSL!L֔LLL@L(L$@L$@K @K$@J@J@J<@J;}J@Iztonyj@suse.comtonyj@suse.comtonyj@suse.comtonyj@suse.comcoolo@suse.comtonyj@suse.commmeister@suse.comcrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orgjengelh@inai.decoolo@suse.comtonyj@suse.comcoolo@suse.comjengelh@medozas.demeissner@suse.detonyj@novell.comaj@suse.decoolo@novell.comcristian.rodriguez@opensuse.orgtonyj@novell.comaj@suse.deaj@suse.dejengelh@medozas.detonyj@novell.comdmueller@suse.detonyj@suse.dejengelh@medozas.decoolo@novell.comcrrodriguez@suse.decmorve69@yahoo.escoolo@novell.comtonyj@suse.dedmueller@suse.de- Add support for ppc64le (bnc#891861) New patch: audit-add-ppc64le-mach-support.patch- Update to version 2.3.6 Changelog 2.3.6 - Add an option to auditctl to interpret a0 - a3 of syscall rules when listing - Improve ARM and AARCH64 support (AKASHI Takahiro) - Add ausearch --checkpoint feature (Burn Alting) - Add --arch option to ausearch - Improve too long config line in audispd, auditd, and auparse (#1071580) - Fix aulast to accept the new AUDIT_LOGIN record format - Remove clear_config symbol in auparse Changelog 2.3.5 - In CRYPTO_KEY_USER events, do not interpret the 'fp' field - Change formatting of rules listing in auditctl to look like audit.rules - Change auditctl to do all netlink comm and then print rules - Add a debug option to ausearch to find skipped events - Parse subject, auid, and ses in LOGIN events (3.14 kernel changed format) - In auditd, when shifting logs, ignore the num_logs setting (#950158) - Allow passing a directory as the input file for ausearch/report (LC Bruzenak) - Interpret syscall fields in SECCOMP events - Increase a couple buffers to handle longer input Changelog 2.3.4 - Parse path in CONFIG_CHANGE events - In audisp-remote, fix retry logic for temporary network failures - In auparse, add get_type_name function - Add --no-config command option to aureport - Fix interpretting MCS seliunx contexts in ausearch (#970675) - In auparse, classify selinux contexts as MAC_LABEL field type - In ausearch/report parse vm-ctx and img-ctx as selinux labels - Update translation tables for the 3.14 kernel- Update to version 2.3.3 Changelog 2.3.3 - Documentation updates - Add AUDIT_USER_MAC_CONFIG_CHANGE event for MAC policy changes - Update interpreting scheduler policy names - Update automake files to automake-1.13.4 - Remove CAP_COMPROMISE_KERNEL interpretation - Parse name field in AVC's (#1049916) - Add missing typedef for auparse_type_t enumeration (#1053424) - Fix parsing encoded filenames in records - Parse SECCOMP events- Update to version 2.3.2 Changelog 2.3.2 - Put RefuseManualStop in the right systemd section (#969345) - Add legacy restart scripts for systemd support - Add more syscall argument interpretations - Add 'unset' keyword for uid & gid values in auditctl - In ausearch, parse obj in IPC records - In ausearch, parse subj in DAEMON_ROTATE records - Fix interpretation of MQ_OPEN and MQ_NOTIFY events - In auditd, restart dispatcher on SIGHUP if it had previously exited - In audispd, exit when no active plugins are detected on reconfigure - In audispd, clear signal mask set by libev so that SIGHUP works again - In audispd, track binary plugins and restart if binary was updated - In audispd, make sure we send signals to the correct process - In auditd, clear signal mask when spawning any child process - In audispd, make builtin plugins respond to SIGHUP - In auparse, interpret mode flags of open syscall if O_CREAT is passed - In audisp-remote, don't make address lookup always a permanent failure - In audisp-remote, remove EOE events more efficiently - In auditd, log the reason when email account is not valid - In audisp-remote, change default remote_ending action to reconnect - Add support for Aarch64 processors Changelog 2.3.1 - Rearrange auditd setting enabled and pid to avoid a race (#910568) - Interpret the ocomm field from OBJ_PID records - Fix missing 'then' statement in sysvinit script - Switch ausearch to use libauparse for interpretting fields - In libauparse, interpret prctl arg0, sched_setscheduler arg1 - In auparse, check source_list isn't NULL when opening next file (Liequan Che) - In libauparse, interpret send* flags argument - In libauparse, interpret level and name options for set/getsockopt - In ausearch/report, don't flush events until last file (Burn Alting) - Don't use systemctl to stop the audit daemon Changelog 2.3 - The clone(2) man page is really clone(3), fix interpretation of clone syscall - Add systemd support for reload (#901533) - Allow -F msgtype on the user filter - Add legacy support for resuming logging under systemd (#830780) - Add legacy support for rotating logs under systemd (#916611) - In auditd, collect SIGUSR2 info for DAEMON_RESUME events - Updated man pages - Update libev to 4.15 - Update syscall tables for 3.9 kernel - Interpret MQ_OPEN events - Add augenrules support (Burn Alting) - Consume less stack sending audit events- remove libcap-ng too from audit.spec as it's only needed for plugins (and libcap-ng itself needs python to build bindings)- Eliminate build cycles. audit.spec now builds only libs/devel. Remainder (including daemon) built from audit-secondary.spec- audit-no_m4_dir.patch: Removed AC_CONFIG_MACRO_DIR([m4]) from configure.ac to fix build with new automake- --with-libcap-ng=yes has no effect if libcap-ng is not buildrequired and the lack of those requires causes a broken configure script after autoreconf add pkgconfig(libcap-ng) to both audit and audit-secondary, cap-ng is actually only use in the latter.- Version 2.2.3 - Code cleanups - In spec file, don't own lib64/audit - Update man pages - Aureport no longer reads auditd.conf when stdin is used - Don't let systemd kill auditd if auditctl errors out - Update syscall table for 3.7 and 3.8 kernels - Add interpretation for setns and unshare syscalls - Code cleanup (Tyler Hicks) - Documentation cleanups (Laurent Bigonville) - Add dirfd interpretation to the *at functions - Add termination signal to clone flags interpretation - Update stig.rules - In auditctl, when listing rules don't print numeric value of dir fields - Add support for rng resource type in auvirt - Fix aulast bad login output (#922508) - In ausearch, allow negative numbers for session and auid searches - In audisp-remote, if disk_full_action is stop then stop sending (#908977)- remove sysvinit scripts.- remove old tarball and update -secondary spec- Audit 2.2.2 , the purpose of this update is too add compatibility with systemd for 12.3 - In auditd, tcp_max_per_addr was allowing 1 more connection than specified - In ausearch, fix matching of object records - Auditctl was returning -1 when listing rules filtered on a key field - Add interpretations for CAP_BLOCK_SUSPEND and CAP_COMPROMISE_KERNEL - Add armv5tejl, armv5tel, armv6l and armv7l machine types (Nathaniel Husted) - Updates for the 3.6 kernel - Add auparse_feed_has_data function to libauparse - Update audisp-prelude to use auparse_feed_has_data - Add support to conditionally build auditd network listener (Tyler Hicks) - In auditd, reset a flag after receiving USR1 signal info when rotating logs - Add optional systemd init script support - Add support for SECCOMP event type - Don't interpret aN_len field in EXECVE records (#869555) - In audisp-remote, do better job of draining queue - Fix capability parsing in ausearch/auparse - Interpret BPRM_FCAPS capability fields - Add ANOM_LINK event type- Executing autoreconf requires autoconf- update to 2.2.1, upstream changelog: 2.2.1 - Add more interpretations in auparse for syscall parameters - Add some interpretations to ausearch for syscall parameters - In ausearch/report and auparse, allocate extra space for node names - Update syscall tables for the 3.3.0 kernel - Update libev to 4.0.4 - Reduce the size of some applications - In auditctl, check usage against euid rather than uid 2.2 - Correct all rules for clock_settime - Fix possible segfault in auparse library - Handle malformed socket addresses better - Improve performance in audit_log_user_message() - Improve performance in writing to the log file in auditd - Syscall update for accept4 and recvmmsg - Update autrace resource usage mode syscall list - Improved sample rules for recent syscalls - Add some debug info to audisp-remote startup and shutdown - Make compiling with Python optional - In auditd, if disk_error_action is ignore, don't syslog anything - Fix some memory leaks - If audispd is stopping, don't restart children - Add support in auditctl for shell escaped filenames (Alexander) - Add search support for virt events (Marcelo Cerri) - Update interpretation tables - Sync auparse's auditd config parser with auditd's parser - In ausearch, also use cwd fields in file name searchs - In ausearch, parse cwd in USER_CMD events - In ausearch, correct parsing of uid in user space events - In ausearch, update parsing of integrity events - Apply some text cleanups from Debian (Russell Coker) - In auditd, relax some permission checks for external apps - Add ROLE_MODIFY event type - In auditctl, new -c option to continue through bad rules but with failed exit - Add auvirt program to do special reporting on virt events (Marcelo Cerri) - Add interfield comparison support to auditctl (Peter Moody) - Update auparse type intepretation for apparmor (Marcelo Cerri) - Increase tcp_max_per_addr maximum to 1024. - remove audit-no_python.patch, there is a configure switch for that now - remove prereq on sysvinit- Update to version 2.1.3, upstream changelog: - 2.1.3 - Fix parsing of EXECVE records to not escape argc field - If auditd's disk is full, send the right reason to client (#715315) - Add CAP_WAKE_ALARM to interpretations - Some updates to audisp-remote's remote-fgets function (Mirek Trmac) - Add detection of TTY events to audisp-prelude (Matteo Sessa) - Updated syscall tables for the 3.0 kernel - Update linker flags for better relro support - Make default size of logs bigger (#727310) - Extract obj from NETFILTER_PKT events - Disable 2 kerberos config options in audisp-remote.conf - 2.1.2 - In ausearch/report, fix a segfault caused by MAC_POLICY_LOAD records - In ausearch/report, add and update parsers - In auditd, cleanup DAEMON_ACCEPT and DAEMON_CLOSE addr fields - In ausearch/report, parse addr field of DAEMON_ACCEPT & DAEMON_CLOSE records - In auditd, move startup success to after events are registered - If auditd shutsdown due to failed tcp init, write a DAEMON_ABORT event - Update auditd to avoid the oom killer in new kernels (Andreas Jaeger) - Parse and interpret NETFILTER_PKT events correctly - Return error if auditctl -l fails (#709345) - In audisp-remote, replace glibc's fgets with custom implementation- add libtool as buildrequire to make the spec file more reliable- Remove redundant tags/sections from specfile - Add audit-devel to baselibs- Adjust license of libaudit and libauparse to be LGPLv2.1 or later.- Update to version 2.1.1, upstream changelog: - 2.1.1 - When ausearch is interpretting, output "as is" if no = is found - Correct socket setup in remote logging - Adjusted a couple default settings for remote logging and init script - Audispd was not marking restarted plugins as active - Audisp-remote should keep a capability if local_port < 1024 - When audispd restarts plugin, send event in its preferred format - In audisp-remote, make all I/O asynchronous - In audisp-remote, add sigusr1 handler to dump internal state - Fix autrace to use correct syscalls on s390 and s390x systems - Add shutdown syscall to remote logging teardowns - Correct autrace rule for 32 bits systems 2.1 - Update auditctl man page for new field on user filter - Fix crash in aulast when auid is foreign to the system - Code cleanups - Add store and forward model to audispd-remote (Mirek Trmac) - Free memory on failed startups in audisp-prelude - Fix memory leak in aureport - Fix parsing state problem in libauparse - Improve the robustness of libaudit field encoding functions - Update capability tables - In auditd, make failure action config checking consistent - In auditd, check that NULL is not being passed to safe_exec - In audisp-remote, overflow_action wasn't suspending if that action was chosen - Update interpretations for virt events - Improve remote logging warning and error messages - Add interpretations for netfilter events 2.0.6 - ausearch/report performance improvements - Synchronize all sample syscall rules to use action,list - If program name provided to audit_log_acct_message, escape it - Fix man page for the audit_encode_nv_string function (#647131) - If value is NULL, don't segfault (#647128) - Fix simple event parsing to not assume session id can't be last (Peng Haitao) - Add support for new mmap audit event type - Add ability for audispd syslog plugin to choose facility local0-7 (#593340) - Fix autrace to use correct syscalls on i386 systems (Peng Haitao) - On startup and reconfig, check for excess logs and unlink them - Add a couple missing parser debug messages - Fix error output resolving numeric address and update man page - Add netfilter event types - Fix spelling error in audit.rules man page (#667845) - Improve warning in auditctl regarding immutable mode (#654883) - Update syscall tables for the 2.6.37 kernel - In ausearch, allow searching for auid -1 - Add queue overflow_action to audisp-remote to control queue overflows - Update sample rules for new syscalls and packages- Fix value of oom_score_adj.- prereq init script syslog- use full RELRO.- Update to version 2.0.5 (drop: audit-as_needed.patch) - Update README-BEFORE-ADDING-PATCHES - Upstream 2.0.5 changelog: - Make auparse handle empty AUSOURCE_FILE_ARRAY correctly (Miloslav Trmač) - On i386, audit rules do not work on inode's with a large number (#554553) - Fix displaying of inode values to be unsigned integers when listing rules - Correct Makefile install of audispd (Jason Tang) - Syscall table updates for 2.6.34 kernel - Add definitions for service start and stop - Fix handling of ignore errors in auditctl - Fix gssapi support to build with new linker options - Add virtualization event types - Update aureport program help and man pages to show all options- Annotate patch audit-oom_score_adj.- Use /proc//oom_score_adj if available.- use %_smp_mflags- Minor changes to README-BEFORE-ADDING-PATCHES file. - Add this file as %source in spec- obsolete -XXbit package- Update to version 2.0.4. This is a major version update, libaudit.so has changed version. There is no backward compatibility. audit-libs has been split into libaudit1 and libauparse0. - Redhat changelog for 2.0 - 2.0.4 follows: * 2.0.4 - Make alpha processor support optional - Add support for the arm eabi processor - add a compatible regexp processing capability to auparse (Miloslav Trmač) - Fix regression in parsing user space originating records in aureport - Add tcp_max_per_addr option in auditd.conf to limit concurrent connections - Rearrange shutdown of auditd to allow DAEMON_END event more time * 2.0.3 - In auditd, tell libev to stop processing a connection when idle timeout - In auditd, tell libev to stop processing a connection when shutting down - Interpret CAPSET records in ausearch/auparse * 2.0.2 - If audisp-remote plugin has a queue at exit, use non-zero exit code - Fix autrace to use the exit filter - In audisp-remote, add a sigchld handler - In auditd, check for duplicate remote connections before accepting - Remove trailing ':' if any are at the end of acct fields in ausearch - Update remote logging code to do better sanity check of data - Fix audisp-prelude to prefer files if multiple path records are encountered - Add libaudit.conf man page - In auditd, disconnect idle clients * 2.0.1 - Aulast now reads daemon_start events for the kernel version of reboot - Clarify the man pages for ausearch/report regarding locale and date formats - Fix getloginuid for python bindings - Disable the audispd af_unix plugin by default - Add a couple new init script actions for LSB 3.2 - In audisp-remote plugin, timeout network reads (#514090) - Make some error logging in audisp-remote plugin more prominent - Add audit.rules man page - Interpret the session field in audit events * 2.0 - Remove system-config-audit - Get rid of () from userspace originating events - Removed old syscall rules API - not needed since 2.6.16 - Remove all use of the old rule structs from API - Fix uninitialized variable in auditd log rotation - Add libcap-ng support for audispd plugins - Removed ancient defines that are part of kernel 2.6.29 headers - Bump soname number for libaudit - In auditctl, deprecate the entry filter and move rules to exit filter - Parse integrity audit records in ausearch/report (Mimi Zohar) - Updated syscall table for 2.6.31 kernel - Remove support for the legacy negate syscall rule operator - In auditd reset syslog warnings if disk space becomes available- add baselibs.conf as a source- updated patches to apply with fuzz=0- do not package static libraries - fix -devel package dependencies- fixed build with --as-needed- disable as-needed for this package as it fails to build with it- Update from 1.7.7 to 1.7.13. - Redhat changelog for 1.7.8 - 1.7.13 follows: * Tue Apr 21 2009 Steve Grubb 1.7.13-1 - Disable libev asserts unless --with-debug passed to configure - Handle kernel 2.6.29's audit = 0 boot parameter better - Install audit.py file in arch specific python directory (Dan Walsh) - Fix problem with negative uids in audit rules on 32 bit systems - When file type is unknown, output octal for mode field (Miloslav Trmač) - Update tty keystroke interpretations (Miloslav Trmač) * Tue Feb 24 2009 Steve Grubb 1.7.12-1 - Add definitions for crypto events - Fix regression where msgtype couldn't be used as a range in audit rules - In libaudit, extend time spent checking reply - In acct events, prefer id over acct if given - In aulast, try id and acct in USER_LOGIN events - When in immutable mode, have auditctl tell user instead of sending rules - Add option to sysconfig to disable audit system on auditd stop - Add tcp_wrappers config option to auditd - Aulastlog can now take input from stdin - Update libaudit python bindings to throw exceptions on error - Adjust formatting of TTY data in libauparse to be like ausearch/report - Add more key mappings to TTY interpretations - Add internal queue to audisp-remote - Fix failure action code to allow executables in audisp-remote (Chu Li) - Fix memory leak when NOLOG log_format option given to auditd - Quieten some of the reconnect text being sent to syslog in audisp-remote - Apply some libev fixups to auditd - Cleanup shutdown sequence of auditd - Allow auditd log rotation via SIGUSR1 when NOLOG log format option given * Sat Jan 10 2009 Steve Grubb 1.7.11-1 - Don't error out in auditd when calling setsid - Reformat a couple auditd error messages (Oden Eriksson) - If log rotate fails, leave the old log writable - Fixed bug in setting up auditd event loop when listening - Warn if on biarch machine and auditctl rules show a syscall mismatch - Audisp-remote was not parsing some config options correctly - In auparse, check for single key in addition to virtual keys - When auditd shuts down, send AUDIT_RMW_TYPE_ENDING messages to clients - Created reconnect option to remote ending setting of audisp-remote * Sat Dec 13 2008 Steve Grubb 1.7.10-1 - Fix ausearch and aureport to handle out of order events - Add line-buffer option to ausearch & timeout pipe input (Tony Jones) - Add support in ausearch/report for tty data - In audisp-remote, allow the keyword "any" for local_port - Tighten parsing for -m and -w options in auditctl - Add session query hint for aulast proof - Fix audisp-remote to tolerate krb5 config options when not supported - Created new aureport option for tty keystroke report - audispd should detect backup config files and not use them - When checking for ack in netlink interface, retry on EAGAIN a few times - In aureport, fix mods report to show acct acted upon * Wed Nov 05 2008 Steve Grubb 1.7.9-1 - Fix uninitialized variable in aureport causing segfault - Quieten down the gssapi not supported messages - Fix bug interpretting i386 logs on x86_64 machines - If kernel is in immutable mode, auditd should not send enable command - Fix ausearch/report recent and now time keyword lookups - Created aulast program - prelude plugin should pull auid for login alert from 2nd uid field - Add system boot, shutdown, and run level change events - Add max_restarts to audispd.conf to limit times a plugin is restarted - Expand session detection in ausearch * Wed Oct 22 2008 Steve Grubb 1.7.8-1 - Interpret TTY audit data in auparse (Miloslav Trmač) - Extract terminal from USER_AVC events for ausearch/report (Peng Haitao) - Add USER_AVCs to aureport's avc reporting (Peng Haitao) - Short circuit hostname resolution in libaudit if host is empty - If log_group and user are not root, don't check dispatcher perms - Fix a bug when executing "ausearch -te today PM" - Add --exit search option to ausearch - Fix parsing config file when kerberos is disabled- refresh patchescloud104 1508242531  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMN2.3.6-8.12.3.6-8.1auparse-defs.hauparse.hlibaudit.hlibaudit.solibauparse.soaudit-develpluginMakefileaudisp-example.caudisp-example.confskeleton.caudit_add_rule_data.3.gzaudit_add_watch.3.gzaudit_delete_rule_data.3.gzaudit_detect_machine.3.gzaudit_encode_nv_string.3.gzaudit_get_reply.3.gzaudit_getloginuid.3.gzaudit_log_acct_message.3.gzaudit_log_semanage_message.3.gzaudit_log_user_avc_message.3.gzaudit_log_user_comm_message.3.gzaudit_log_user_command.3.gzaudit_log_user_message.3.gzaudit_open.3.gzaudit_request_rules_list_data.3.gzaudit_request_signal_info.3.gzaudit_request_status.3.gzaudit_set_backlog_limit.3.gzaudit_set_enabled.3.gzaudit_set_failure.3.gzaudit_set_pid.3.gzaudit_set_rate_limit.3.gzaudit_setloginuid.3.gzaudit_update_watch_perms.3.gzauparse_add_callback.3.gzauparse_destroy.3.gzauparse_feed.3.gzauparse_feed_has_data.3.gzauparse_find_field.3.gzauparse_find_field_next.3.gzauparse_first_field.3.gzauparse_first_record.3.gzauparse_flush_feed.3.gzauparse_get_field_int.3.gzauparse_get_field_name.3.gzauparse_get_field_str.3.gzauparse_get_field_type.3.gzauparse_get_filename.3.gzauparse_get_line_number.3.gzauparse_get_milli.3.gzauparse_get_node.3.gzauparse_get_num_fields.3.gzauparse_get_num_records.3.gzauparse_get_record_text.3.gzauparse_get_serial.3.gzauparse_get_time.3.gzauparse_get_timestamp.3.gzauparse_get_type.3.gzauparse_goto_record_num.3.gzauparse_init.3.gzauparse_interpret_field.3.gzauparse_next_event.3.gzauparse_next_field.3.gzauparse_next_record.3.gzauparse_node_compare.3.gzauparse_reset.3.gzauparse_timestamp_compare.3.gzausearch_add_expression.3.gzausearch_add_interpreted_item.3.gzausearch_add_item.3.gzausearch_add_regex.3.gzausearch_add_timestamp_item.3.gzausearch_clear.3.gzausearch_next_event.3.gzausearch_set_stop.3.gzget_auditfail_action.3.gzset_aumessage_mode.3.gz/usr/include//usr/lib64//usr/share/doc/packages//usr/share/doc/packages/audit-devel//usr/share/doc/packages/audit-devel/plugin//usr/share/man/man3/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -gobs://build.opensuse.org/openSUSE:Maintenance:7386/openSUSE_Leap_42.3_Update/c4ec5a422bbcc8c7215281b86ec84cb7-audit.openSUSE_Leap_42.3_Updatedrpmlzma5x86_64-suse-linuxC source, ASCII textdirectorymakefile script, ASCII textASCII texttroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)C source, ASCII text (gzip compressed data, max compression, from Unix)ZS/\nZŘ:G?p]"k%fs)q x8>z?kQs8w$V?@T9q$/׿Hm6K';Vꄅ.|Z] D?y̚GK+hᦴ HM[2=/|aadlny|VhpIŧ24^q͆YH!;4T;]Le74+ Ǹ^ss=͉~>кuUiGmx ,$Mb(AaytbyR<!/!tjG ~ MdͳPkGW؊S!9xWlP$5u}HEFDS>t-uAҊb;f_z7#zMI^j]7^EFH )N5)1M2K?S8wqb-T/jݑzX=xBFK}tk%F4OܕҎ%-q H&/c'a6)`#k;)L2ʒcࢢIo[k)eP 3o7a <{d [\i|18 zG)i|r5Fл/(|5̋~V7t'X8.ZΏW<1'l6WoB*9q@SN}3}&'s_t(;7r^2e_)zxZQYI> d+G>FcFFj{jsZ x;UŸmHHWȯy7 ~^WhrI$ Hol>̬iɳ4v0qy)#8N;EvQ8t&S]֔G(F}҅PZ9.dL 6탾o;+߂?,lA)e`Cz/3jT;TH