)]}'
{
  "log": [
    {
      "commit": "9c937dcc71021f2dbf78f904f03d962dd9bcc130",
      "tree": "6ab53c1cf1235515307d521cecc4f76afa34e137",
      "parents": [
        "6a2bceec0ea7fdc47aef9a3f2f771c201eaabe5d"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Thu Jun 08 23:19:31 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:28 2006 -0400"
      },
      "message": "[PATCH] log more info for directory entry change events\n\nWhen an audit event involves changes to a directory entry, include\na PATH record for the directory itself.  A few other notable changes:\n\n    - fixed audit_inode_child() hooks in fsnotify_move()\n    - removed unused flags arg from audit_inode()\n    - added audit log routines for logging a portion of a string\n\nHere\u0027s some sample output.\n\nbefore patch:\ntype\u003dSYSCALL msg\u003daudit(1149821605.320:26): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbf8d3c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbf8d3c7c items\u003d1 ppid\u003d739 pid\u003d800 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149821605.320:26):  cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149821605.320:26): item\u003d0 name\u003d\"foo\" parent\u003d164068 inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nafter patch:\ntype\u003dSYSCALL msg\u003daudit(1149822032.332:24): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbfdd9c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbfdd9c7c items\u003d2 ppid\u003d714 pid\u003d777 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149822032.332:24):  cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d0 name\u003d\"/root\" inode\u003d164068 dev\u003d03:00 mode\u003d040750 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_dir_t:s0\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d1 name\u003d\"foo\" inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "f368c07d7214a7c41dfceb76c8db473b850f0229",
      "tree": "e3f1e2d1a6ffbe61bf99ece51b906654728db4c9",
      "parents": [
        "20ca73bc792be9625af184cbec36e1372611d1c3"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Fri Apr 07 16:55:56 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:27 2006 -0400"
      },
      "message": "[PATCH] audit: path-based rules\n\nIn this implementation, audit registers inotify watches on the parent\ndirectories of paths specified in audit rules.  When audit\u0027s inotify\nevent handler is called, it updates any affected rules based on the\nfilesystem event.  If the parent directory is renamed, removed, or its\nfilesystem is unmounted, audit removes all rules referencing that\ninotify watch.\n\nTo keep things simple, this implementation limits location-based\nauditing to the directory entries in an existing directory.  Given\na path-based rule for /foo/bar/passwd, the following table applies:\n\n    passwd modified -- audit event logged\n    passwd replaced -- audit event logged, rules list updated\n    bar renamed     -- rule removed\n    foo renamed     -- untracked, meaning that the rule now applies to\n\t\t       the new location\n\nAudit users typically want to have many rules referencing filesystem\nobjects, which can significantly impact filtering performance.  This\npatch also adds an inode-number-based rule hash to mitigate this\nsituation.\n\nThe patch is relative to the audit git tree:\nhttp://kernel.org/git/?p\u003dlinux/kernel/git/viro/audit-current.git;a\u003dsummary\nand uses the inotify kernel API:\nhttp://lkml.org/lkml/2006/6/1/145\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "e1396065e0489f98b35021b97907ab4edbfb24e1",
      "tree": "a276ea0a2ece9132d435adf1a1f82d0ada1ae938",
      "parents": [
        "473ae30bc7b1dda5c5791c773f95e9424ddfead9"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Thu May 25 10:19:47 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:21 2006 -0400"
      },
      "message": "[PATCH] collect sid of those who send signals to auditd\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "9044e6bca5a4a575d3c068dfccb5651a2d6a13bc",
      "tree": "e0fa2beb83c3ef4e52cc6c6b28ce3173656f4276",
      "parents": [
        "bc0f3b8ebba611291fdaa2864dbffd2d29336c64"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 22 01:09:24 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:20 2006 -0400"
      },
      "message": "[PATCH] fix deadlocks in AUDIT_LIST/AUDIT_LIST_RULES\n\nWe should not send a pile of replies while holding audit_netlink_mutex\nsince we hold the same mutex when we receive commands.  As the result,\nwe can get blocked while sending and sit there holding the mutex while\nauditctl is unable to send the next command and get around to receiving\nwhat we\u0027d sent.\n\nSolution: create skb and put them into a queue instead of sending;\nonce we are done, send what we\u0027ve got on the list.  The former can\nbe done synchronously while we are handling AUDIT_LIST or AUDIT_LIST_RULES;\nwe are holding audit_netlink_mutex at that point.  The latter is done\nasynchronously and without messing with audit_netlink_mutex.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "3dc7e3153eddfcf7ba8b50628775ba516e5f759f",
      "tree": "926957e904739fc6c29e5125b7c1635b9f77548c",
      "parents": [
        "376bd9cb357ec945ac893feaeb63af7370a6e70b"
      ],
      "author": {
        "name": "Darrel Goeddel",
        "email": "dgoeddel@trustedcs.com",
        "time": "Fri Mar 10 18:14:06 2006 -0600"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 01 06:09:36 2006 -0400"
      },
      "message": "[PATCH] support for context based audit filtering, part 2\n\nThis patch provides the ability to filter audit messages based on the\nelements of the process\u0027 SELinux context (user, role, type, mls sensitivity,\nand mls clearance).  It uses the new interfaces from selinux to opaquely\nstore information related to the selinux context and to filter based on that\ninformation.  It also uses the callback mechanism provided by selinux to\nrefresh the information when a new policy is loaded.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "5a0bbce58bb25bd756f7ec437319d6ed2201a18b",
      "tree": "d8b263248c3eaece9a1c906e02c0795794f480de",
      "parents": [
        "4023e020807ea249ae83f0d1d851b4c7cf0afd8a"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@elte.hu",
        "time": "Tue Mar 07 23:51:38 2006 -0800"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:55 2006 -0500"
      },
      "message": "[PATCH] sem2mutex: audit_netlink_sem\n\nSemaphore to mutex conversion.\n\nThe conversion was generated via scripts, and the result was validated\nautomatically via a script as well.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "93315ed6dd12dacfc941f9eb8ca0293aadf99793",
      "tree": "4fc070c92a1de21d3befe4ce48c733c65d044bb3",
      "parents": [
        "af601e4623d0303bfafa54ec728b7ae8493a8e1b"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Tue Feb 07 12:05:27 2006 -0500"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] audit string fields interface + consumer\n\nUpdated patch to dynamically allocate audit rule fields in kernel\u0027s\ninternal representation.  Added unlikely() calls for testing memory\nallocation result.\n\nAmy Griffis wrote:     [Wed Jan 11 2006, 02:02:31PM EST]\n\u003e Modify audit\u0027s kernel-userspace interface to allow the specification\n\u003e of string fields in audit rules.\n\u003e\n\u003e Signed-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n(cherry picked from 5ffc4a863f92351b720fe3e9c5cd647accff9e03 commit)\n"
    },
    {
      "commit": "fe7752bab26a9ac0651b695ad4f55659761f68f7",
      "tree": "b2e516a52232c978fc824b226418d8a28460b8a8",
      "parents": [
        "ee436dc46a762f430e37952d375a23d87735f73f"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@infradead.org",
        "time": "Thu Dec 15 18:33:52 2005 +0000"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] Fix audit record filtering with !CONFIG_AUDITSYSCALL\n\nThis fixes the per-user and per-message-type filtering when syscall\nauditing isn\u0027t enabled.\n\n[AV: folded followup fix from the same author]\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    }
  ]
}