Issued:
2012-02-20
Updated:
2012-02-20

RHBA-2012:0265 - audit bug fix and enhancement update

Synopsis

audit bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated audit packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 5.

Description

The audit packages contain the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 kernel.

The audit packages have been upgraded to upstream version 1.8, which provides a number of bug fixes and enhancements over the previous version. (BZ#697013)

This update fixes the following bugs:

  • When the auditd daemon was in immutable mode and was restarted, the following message appeared: "The audit system is in immutable mode, no rules loaded". This message was not clear and was misleading. The message has been therefore improved to "The audit system is in immutable mode, no changes allowed". (BZ#654883)

  • The audit.rules(7) and auditctl(8) manual pages were not consistent in the order of the "action" and "list" fields for the "-a" option. The auditctl(8) manual page has been modified to inform users that the fields can be used in either order. (BZ#671261)

  • Previously, the autrace utility was not aware of system calls being not available on certain architectures. As a consequence, running the "autrace -r" command on the IBM System z, 64-bit PowerPC, and 32-bit Intel architectures failed to insert audit rules. With this update, autrace is aware of system calls not being available on the aforementioned architectures, and audit rules are now successfully inserted. (BZ#702279)

  • System processes, this means processes with an audit id (auid) of -1, are logged by the audit subsystem. However, if the ausearch utility was used to locate events where the auid was -1, all events were displayed. With this update, the ausearch utility now correctly returns only events with an auid of -1. (BZ#706156)

This update also adds the following enhancement:

  • This update adds a new option to the configuration of the audisp syslog plug-in, which allows the plug-in to send syslog audit events to local syslog facilities. (BZ#667536)

All users of audit are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/kb/docs/DOC-11259

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for Power, big endian5ppc
Red Hat Enterprise Linux for IBM z Systems5s390x
Red Hat Enterprise Linux Workstation5x86_64
Red Hat Enterprise Linux Workstation5i386
Red Hat Enterprise Linux Server5x86_64
Red Hat Enterprise Linux Server5ia64
Red Hat Enterprise Linux Server5i386
Red Hat Enterprise Linux Server from RHUI5x86_64
Red Hat Enterprise Linux Server from RHUI5i386
Red Hat Enterprise Linux Desktop5x86_64
Red Hat Enterprise Linux Desktop5i386

Updated Packages

  • audit-libs-devel-1.8-2.el5.ia64.rpm
  • audit-libs-python-1.8-2.el5.x86_64.rpm
  • system-config-audit-0.4.10-7.el5.x86_64.rpm
  • system-config-audit-0.4.10-7.el5.i386.rpm
  • audit-libs-devel-1.8-2.el5.s390.rpm
  • system-config-audit-0.4.10-7.el5.ppc.rpm
  • system-config-audit-0.4.10-7.el5.s390x.rpm
  • audispd-plugins-1.8-2.el5.i386.rpm
  • audit-libs-python-1.8-2.el5.ia64.rpm
  • audit-libs-python-1.8-2.el5.i386.rpm
  • audit-1.8-2.el5.x86_64.rpm
  • audit-libs-devel-1.8-2.el5.s390x.rpm
  • audit-libs-devel-1.8-2.el5.ppc64.rpm
  • audit-1.8-2.el5.src.rpm
  • audispd-plugins-1.8-2.el5.s390x.rpm
  • audit-libs-1.8-2.el5.i386.rpm
  • system-config-audit-0.4.10-7.el5.ia64.rpm
  • audit-libs-1.8-2.el5.s390x.rpm
  • audispd-plugins-1.8-2.el5.ia64.rpm
  • audit-libs-devel-1.8-2.el5.ppc.rpm
  • audispd-plugins-1.8-2.el5.ppc.rpm
  • audit-libs-devel-1.8-2.el5.x86_64.rpm
  • audit-libs-1.8-2.el5.ppc.rpm
  • audit-libs-python-1.8-2.el5.s390x.rpm
  • audit-libs-1.8-2.el5.s390.rpm
  • audit-1.8-2.el5.ia64.rpm
  • audit-libs-python-1.8-2.el5.ppc.rpm
  • audispd-plugins-1.8-2.el5.x86_64.rpm
  • audit-libs-devel-1.8-2.el5.i386.rpm
  • audit-1.8-2.el5.s390x.rpm
  • audit-libs-1.8-2.el5.x86_64.rpm
  • audit-libs-1.8-2.el5.ia64.rpm
  • audit-1.8-2.el5.ppc.rpm
  • audit-1.8-2.el5.i386.rpm
  • audit-libs-1.8-2.el5.ppc64.rpm

Fixes

CVEs

(none)

References

(none)

Additional information