audit-userspace

audit-userspace copied to clipboard

The `cppcheck` static code analysis tool reports two issues found in ausearch/auparse. Both of them seem to be false positives but it would be better to not see them.

Cropi

Remove systemd as runtime dependecy

2

Auditd does not depend on `systemd` for building and running. It only depends on `systemd` if systemd service files are used to start `auditd`. But `auditd` can be started by...

lzkof

Does audit register symlink events?

1

Does audit can register symlink events?

dimv36

I've tried creating my own plugin of type `af_unix` on Ubuntu 20.04 and RHEL 7 system (audit 2.8.5). Everything looked fine, I could connect to socket on given file and...

tperka-catalogicsoftware

Add entry for uretprobe syscall (6.11, x86_&4-only)

2

hillu

Can't exclude TCP connections from being audited

1

I am running Proxmox PVE (7.4-19) (Debian 11) to host services like SMTP on internal LXC containers. On my Proxmox Hypervisor I am running auditd (1:3.0-2) with a custom set...

shark0x00

syscall list update: Rename multiple syscalls to be up to date with kernel

4

I checked all relevant files from the kernel part mentioned in `lib/syscall-update.txt`. I haven't observed any significat updates on socketcall/ipccall. ### Some notes: - Interpretation could be added for: `arm_sync_file_range/sync_file_range,...

Cropi

ausearch-parse: fix parsing for success/uid/exe in some cases

5

1) In `parse_daemon1()`, we may have the uid= field appear both before and after pid=, which may cause our parsing of it to fail, as we may have skipped past...

sergio-correia

augenrules --load exit code 1

46

I'm having a similar issue as #355 since August 14th on Arch linux. I'm not sure opening a new issue is the correct action to take, since that issue is...

mrvantage