RHBA-2007:0602 - Bug Fix Advisory

Topic

Updated audit packages that add various enhancements and fix several bugs
are now available.

Description

The audit package contains the user space utilities for storing and
searching the audit records generate by the audit subsystem in the Linux
2.6 kernel.

Enhancements added and bugs fixed in this update include:

• fix ausearch -se option to work for obj labels.
• fix auditd init script to address /usr being a network device and correct

the return codes.

• update audit_rule_field_pair to handle perm field correctly.
• add support for a few new record types.
• fix audit-libs-devel to not require kernel-headers.
• update LSPP & CAPP rules.
• add NISPOM rules.
• add audit parsing library.
• add new bitwise operators for audit rules.

Users should upgrade to these updated packages, which resolve these issues
and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 226780 - LSPP: audit of writes to files of bin_t produces no records
• BZ - 228384 - LSPP: audit does not log obj label for traced process
• BZ - 230740 - LSPP: ausearch -se doesn't work with object label
• BZ - 233186 - LSPP: Add audit rule bit operators patch
• BZ - 234548 - audit-libs-python unneeded requires
• BZ - 234923 - LSPP: update lspp.rules file for evaluation
• BZ - 235321 - LSPP: audit DAEMON_CONFIG record truncated
• BZ - 235468 - LSPP: ausearch does not return DAEMON_END record when searching by subject
• BZ - 237788 - Wrong init script
• BZ - 251911 - Parsing log file with aureport causes segmentation fault

CVEs

(none)

References

(none)