Linus, Two audit patches for the Linux v6.16 merge window:
- Always record AUDIT_ANOM events when auditing is enabled. Prior to this patch we only recorded AUDIT_ANOM events if auditing was enabled and the admin/distro had explicitly configured audit beyond the defaults. Considering that AUDIT_ANOM events are anomolous events considered to be "security relevant", it seems wise to record these events as long as auditing is enabled, even if the system is running with a default audit configuration. - Mark the audit_log_vformat() function with the __printf() attribute to quiet GCC. Paul -- The following changes since commit 0af2f6be1b4281385b618cb86ad946eded089ac8: Linux 6.15-rc1 (2025-04-06 13:11:33 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20250527 for you to fetch changes up to 654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c: audit: record AUDIT_ANOM_* events regardless of presence of rules (2025-04-11 14:14:41 -0400) ---------------------------------------------------------------- audit-pr-20250527 ---------------------------------------------------------------- Andy Shevchenko (1): audit: mark audit_log_vformat() with __printf() attribute Richard Guy Briggs (1): audit: record AUDIT_ANOM_* events regardless of presence of rules kernel/audit.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- paul-moore.com
