libauparse exporting clear_config()

2014-04-10 Thread Laurent Bigonville
Hello, With 2.3.5, libauparse is exporting a new symbol (clear_config()) It seems that all the other symbols are prefixed with either auparse_ or audit_, so is this expected? Cheers, Laurent Bigonville Output of some debian tools: --- debian/libauparse0.symbols (libauparse0_1:2.3.5-1_amd64)

Re: libauparse exporting clear_config()

2014-04-10 Thread Steve Grubb
On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote: With 2.3.5, libauparse is exporting a new symbol (clear_config()) It seems that all the other symbols are prefixed with either auparse_ or audit_, so is this expected? No, this was not expected. It should be an internal use

[GIT PULL] Audit subsystem for v3.15

2014-04-10 Thread Eric Paris
Linus, Please pull the audit tree for v3.15. You will have merge conflicts. I'll publish my branch merge-test where I attempted to resolve them the way you will. The main issue is an across tree change to syscall_get_arch(). I change it from taking a task_struct and pt_regs to take a void.

[PATCH] MIPS: use current instead of task in syscall_get_arch

2014-04-10 Thread Eric Paris
In commit 6e345746 Markos started using task to determine 64bit vs 32bit instead of it being completely CONFIG based. In commit 5e937a9a we dropped the 'task' argument to syscall_get_arch() across the entire system. This obviously results in a build failure when Linus's and the audit tree were

Re: [GIT PULL] Audit subsystem for v3.15

2014-04-10 Thread Eric Paris
My tree is fine, your tree is fine, but the merge (even if you solve the conflicts) has a build failure on MIPS just discovered when I published by 'merge-test' branch because of the syscall_get_arch(void) changes. (thanks to the kbuild test robot) attached is my solution which I just sent to the

Re: [PATCH] MIPS: use current instead of task in syscall_get_arch

2014-04-10 Thread Richard Guy Briggs
On 14/04/10, Eric Paris wrote: In commit 6e345746 Markos started using task to determine 64bit vs 32bit instead of it being completely CONFIG based. In commit 5e937a9a we dropped the 'task' argument to syscall_get_arch() across the entire system. This obviously results in a build failure

Re: Repository of audit events

2014-04-10 Thread Mimi Zohar
On Wed, 2014-04-09 at 18:26 -0700, Peter Moody wrote: On Wed, Apr 09 2014 at 10:19, Steve Grubb wrote: Missing INTEGRITY_RULE IMA with an 'audit' rule generates INTEGRITY_RULE messages. Missing INTEGRITY_DATA Failure to collect or appraise file data. (Requires the filesystem to be