Description of problem: There is not good way to audit syscalls that have bit mapped options. A patch was sent to the linux-audit mail list adding this capability. This is not strictly required for LSPP, but helps customers.
Patch has been applied and is working correctly. Tested on lspp.70 kernel.
Created attachment 150785 [details] patch against RHEL5 RHEL5 version of the patch
removing from LSPP list. I don't remember seeing an upstream patch for this, just the RHEL5 version, but maybe i'm mistaken. I'll have to look into that before i submit for internal inclusion.
in 2.6.18-27.el5 You can download this test kernel from http://people.redhat.com/dzickus/el5
Confirmed patch is in the -46.el5 kernel
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0959.html