Re: [PATCH] audit: convert status version to a feature bitmap

2014-11-14 Thread Richard Guy Briggs
On 14/11/13, Steve Grubb wrote: > On Thursday, November 13, 2014 08:08:52 PM Richard Guy Briggs wrote: > > > So what terrible things happen to userspace if > > > AUDIT_VERSION_BACKLOG_WAIT_TIME becomes 0x03 instead of 0x02? > > > > But it won't. It gets the value of > > AUDIT_FEATURE_BITMAP_BACK

Re: AUID question

2014-11-14 Thread Steve Grubb
On Friday, November 14, 2014 10:16:12 AM David Flatley wrote: >While checking audit logs for failed logins, It was noticed that the > AUID was one name and there was a UID of the user that failed login. The > only thing we can figure is that the AUID user rebooted the system > by logging in as

AUID question

2014-11-14 Thread David Flatley
While checking audit logs for failed logins, It was noticed that the AUID was one name and there was a UID of the user that failed login. The only thing we can figure is that the AUID user rebooted the system by logging in as himself and then using sudo to reboot the system prior to the fails. A

Re: [PATCH] audit: convert status version to a feature bitmap

2014-11-14 Thread Paul Moore
My apologies, yes I was concerned about LATEST. Try the test that Steve described and if that works I'm happy. -- paul moore www.paul-moore.com On November 13, 2014 8:09:11 PM Richard Guy Briggs wrote: On 14/11/13, Paul Moore wrote: > On Thursday, November 13, 2014 03:29:10 PM Richard Guy B