Hide Forgot
Description of problem: There are a number of bugs that have been found and fixed on the maintenance branch of audit-2.8 that should be picked up to avoid problems. These include: - Mark netlabel events as simple events so that get processed quicker - When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - Add 30-ospp-v42.rules to meet new Common Criteria requirements - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - Event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - auparse_reset was not clearing everything it should - In ausearch/report, lightly parse selinux portion of USER_AVC events
audit-2.8.5 was released and built in Fedora.
audit-2.8.5-1.el7 was built to address this issue.
A memory leak in libauparse was reported upstream. Respinning to pick up this important fix.
audit-2.8.5-2.el7 was created to pickup this important bug fix.
Successfully verified. (In reply to Steve Grubb from comment #0) > Description of problem: > There are a number of bugs that have been found and fixed on the maintenance > branch of audit-2.8 that should be picked up to avoid problems. These > include: > > - When audispd is reconfiguring, only SIGHUP plugins with valid pid > (#1614833) Verified - https://bugzilla.redhat.com/show_bug.cgi?id=1614833#c15. > - In aureport, fix segfault in file report Verified - https://bugzilla.redhat.com/show_bug.cgi?id=1705376#c5 > - Fix memory leak in audisp-remote plugin when using krb5 transport. > (#1622194) Verified - https://bugzilla.redhat.com/show_bug.cgi?id=1622194#c8. The following changes were tested SanityOnly (ie. complete Sanity and Regression testing): > - Add 30-ospp-v42.rules to meet new Common Criteria requirements > - Mark netlabel events as simple events so that get processed quicker > - Add auparse_normalizer support for labeled networking events > - Event aging is off by a second > - In ausearch/auparse, correct event ordering to process oldest first > - auparse_reset was not clearing everything it should > - In ausearch/report, lightly parse selinux portion of USER_AVC events > - A memory leak in libauparse
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2191