)]}'
{
  "log": [
    {
      "commit": "9c937dcc71021f2dbf78f904f03d962dd9bcc130",
      "tree": "6ab53c1cf1235515307d521cecc4f76afa34e137",
      "parents": [
        "6a2bceec0ea7fdc47aef9a3f2f771c201eaabe5d"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Thu Jun 08 23:19:31 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:28 2006 -0400"
      },
      "message": "[PATCH] log more info for directory entry change events\n\nWhen an audit event involves changes to a directory entry, include\na PATH record for the directory itself.  A few other notable changes:\n\n    - fixed audit_inode_child() hooks in fsnotify_move()\n    - removed unused flags arg from audit_inode()\n    - added audit log routines for logging a portion of a string\n\nHere\u0027s some sample output.\n\nbefore patch:\ntype\u003dSYSCALL msg\u003daudit(1149821605.320:26): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbf8d3c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbf8d3c7c items\u003d1 ppid\u003d739 pid\u003d800 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149821605.320:26):  cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149821605.320:26): item\u003d0 name\u003d\"foo\" parent\u003d164068 inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nafter patch:\ntype\u003dSYSCALL msg\u003daudit(1149822032.332:24): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbfdd9c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbfdd9c7c items\u003d2 ppid\u003d714 pid\u003d777 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149822032.332:24):  cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d0 name\u003d\"/root\" inode\u003d164068 dev\u003d03:00 mode\u003d040750 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_dir_t:s0\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d1 name\u003d\"foo\" inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "f368c07d7214a7c41dfceb76c8db473b850f0229",
      "tree": "e3f1e2d1a6ffbe61bf99ece51b906654728db4c9",
      "parents": [
        "20ca73bc792be9625af184cbec36e1372611d1c3"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Fri Apr 07 16:55:56 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:27 2006 -0400"
      },
      "message": "[PATCH] audit: path-based rules\n\nIn this implementation, audit registers inotify watches on the parent\ndirectories of paths specified in audit rules.  When audit\u0027s inotify\nevent handler is called, it updates any affected rules based on the\nfilesystem event.  If the parent directory is renamed, removed, or its\nfilesystem is unmounted, audit removes all rules referencing that\ninotify watch.\n\nTo keep things simple, this implementation limits location-based\nauditing to the directory entries in an existing directory.  Given\na path-based rule for /foo/bar/passwd, the following table applies:\n\n    passwd modified -- audit event logged\n    passwd replaced -- audit event logged, rules list updated\n    bar renamed     -- rule removed\n    foo renamed     -- untracked, meaning that the rule now applies to\n\t\t       the new location\n\nAudit users typically want to have many rules referencing filesystem\nobjects, which can significantly impact filtering performance.  This\npatch also adds an inode-number-based rule hash to mitigate this\nsituation.\n\nThe patch is relative to the audit git tree:\nhttp://kernel.org/git/?p\u003dlinux/kernel/git/viro/audit-current.git;a\u003dsummary\nand uses the inotify kernel API:\nhttp://lkml.org/lkml/2006/6/1/145\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "5d136a010de3bc16fe595987feb9ef8868f064c2",
      "tree": "ce0dbf3d5da61bc9b69fa557f0f578cd980f3147",
      "parents": [
        "0a3b483e83edb6aa6d3c49db70eeb6f1cd9f6c6b"
      ],
      "author": {
        "name": "Serge E. Hallyn",
        "email": "serue@us.ibm.com",
        "time": "Thu Apr 27 16:45:14 2006 -0500"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:23 2006 -0400"
      },
      "message": "[PATCH] minor audit updates\n\nJust a few minor proposed updates.  Only the last one will\nactually affect behavior.  The rest are just misleading\ncode.\n\nSeveral AUDIT_SET functions return \u0027old\u0027 value, but only\nreturn value \u003c0 is checked for.  So just return 0.\n\npropagate audit_set_rate_limit and audit_set_backlog_limit\nerror values\n\nIn audit_buffer_free, the audit_freelist_count was being\nincremented even when we discard the return buffer, so\naudit_freelist_count can end up wrong.  This could cause\nthe actual freelist to shrink over time, eventually\nthreatening to degrate audit performance.\n\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "e1396065e0489f98b35021b97907ab4edbfb24e1",
      "tree": "a276ea0a2ece9132d435adf1a1f82d0ada1ae938",
      "parents": [
        "473ae30bc7b1dda5c5791c773f95e9424ddfead9"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Thu May 25 10:19:47 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:21 2006 -0400"
      },
      "message": "[PATCH] collect sid of those who send signals to auditd\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "473ae30bc7b1dda5c5791c773f95e9424ddfead9",
      "tree": "541f6f20b9131fcfb650ca491e291d3c6b148a1b",
      "parents": [
        "9044e6bca5a4a575d3c068dfccb5651a2d6a13bc"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Wed Apr 26 14:04:08 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:21 2006 -0400"
      },
      "message": "[PATCH] execve argument logging\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "9044e6bca5a4a575d3c068dfccb5651a2d6a13bc",
      "tree": "e0fa2beb83c3ef4e52cc6c6b28ce3173656f4276",
      "parents": [
        "bc0f3b8ebba611291fdaa2864dbffd2d29336c64"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 22 01:09:24 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Tue Jun 20 05:25:20 2006 -0400"
      },
      "message": "[PATCH] fix deadlocks in AUDIT_LIST/AUDIT_LIST_RULES\n\nWe should not send a pile of replies while holding audit_netlink_mutex\nsince we hold the same mutex when we receive commands.  As the result,\nwe can get blocked while sending and sit there holding the mutex while\nauditctl is unable to send the next command and get around to receiving\nwhat we\u0027d sent.\n\nSolution: create skb and put them into a queue instead of sending;\nonce we are done, send what we\u0027ve got on the list.  The former can\nbe done synchronously while we are handling AUDIT_LIST or AUDIT_LIST_RULES;\nwe are holding audit_netlink_mutex at that point.  The latter is done\nasynchronously and without messing with audit_netlink_mutex.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "ce29b682e228c70cdc91a1b2935c5adb2087bab8",
      "tree": "39e3e5b345748bec1c2d21962407689cdb1b7dab",
      "parents": [
        "e7c3497013a7e5496ce3d5fd3c73b5cf5af7a56e"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Sat Apr 01 18:29:34 2006 -0500"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 01 06:10:01 2006 -0400"
      },
      "message": "[PATCH] More user space subject labels\n\nHi,\n\nThe patch below builds upon the patch sent earlier and adds subject label to\nall audit events generated via the netlink interface. It also cleans up a few\nother minor things.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "e7c3497013a7e5496ce3d5fd3c73b5cf5af7a56e",
      "tree": "2a57da5e958011b300256988e414387b1455660c",
      "parents": [
        "9c7aa6aa74fa8a5cda36e54cbbe4fffe0214497d"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Mon Apr 03 09:08:13 2006 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 01 06:09:58 2006 -0400"
      },
      "message": "[PATCH] Reworked patch for labels on user space messages\n\nThe below patch should be applied after the inode and ipc sid patches.\nThis patch is a reworking of Tim\u0027s patch that has been updated to match\nthe inode and ipc patches since its similar.\n\n[updated:\n\u003e  Stephen Smalley also wanted to change a variable from isec to tsec in the\n\u003e  user sid patch.                                                              ]\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "3dc7e3153eddfcf7ba8b50628775ba516e5f759f",
      "tree": "926957e904739fc6c29e5125b7c1635b9f77548c",
      "parents": [
        "376bd9cb357ec945ac893feaeb63af7370a6e70b"
      ],
      "author": {
        "name": "Darrel Goeddel",
        "email": "dgoeddel@trustedcs.com",
        "time": "Fri Mar 10 18:14:06 2006 -0600"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon May 01 06:09:36 2006 -0400"
      },
      "message": "[PATCH] support for context based audit filtering, part 2\n\nThis patch provides the ability to filter audit messages based on the\nelements of the process\u0027 SELinux context (user, role, type, mls sensitivity,\nand mls clearance).  It uses the new interfaces from selinux to opaquely\nstore information related to the selinux context and to filter based on that\ninformation.  It also uses the callback mechanism provided by selinux to\nrefresh the information when a new policy is loaded.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "9b41046cd0ee0a57f849d6e1363f7933e363cca9",
      "tree": "246820e9493770e071cb92a48e7f72d8b9c90a98",
      "parents": [
        "68eef3b4791572ecb70249c7fb145bb3742dd899"
      ],
      "author": {
        "name": "OGAWA Hirofumi",
        "email": "hirofumi@mail.parknet.co.jp",
        "time": "Fri Mar 31 02:30:33 2006 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Fri Mar 31 12:18:53 2006 -0800"
      },
      "message": "[PATCH] Don\u0027t pass boot parameters to argv_init[]\n\nThe boot cmdline is parsed in parse_early_param() and\nparse_args(,unknown_bootoption).\n\nAnd __setup() is used in obsolete_checksetup().\n\n\tstart_kernel()\n\t\t-\u003e parse_args()\n\t\t\t-\u003e unknown_bootoption()\n\t\t\t\t-\u003e obsolete_checksetup()\n\nIf __setup()\u0027s callback (-\u003esetup_func()) returns 1 in\nobsolete_checksetup(), obsolete_checksetup() thinks a parameter was\nhandled.\n\nIf -\u003esetup_func() returns 0, obsolete_checksetup() tries other\n-\u003esetup_func().  If all -\u003esetup_func() that matched a parameter returns 0,\na parameter is seted to argv_init[].\n\nThen, when runing /sbin/init or init\u003dapp, argv_init[] is passed to the app.\nIf the app doesn\u0027t ignore those arguments, it will warning and exit.\n\nThis patch fixes a wrong usage of it, however fixes obvious one only.\n\nSigned-off-by: OGAWA Hirofumi \u003chirofumi@mail.parknet.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "71e1c784b24a026a490b3de01541fc5ee14ebc09",
      "tree": "7ee3aebf84b5bd1759b2b1925e09de37cb21d97f",
      "parents": [
        "bf45da97a45f634422559ec61429dddf4d2fffb9"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Mon Mar 06 22:40:05 2006 -0500"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:55 2006 -0500"
      },
      "message": "[PATCH] fix audit_init failure path\n\nMake audit_init() failure path handle situations where the audit_panic()\naction is not AUDIT_FAIL_PANIC (default is AUDIT_FAIL_PRINTK).  Other uses\nof audit_sock are not reached unless audit\u0027s netlink message handler is\nproperly registered.  Bug noticed by Peter Staubach.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "bf45da97a45f634422559ec61429dddf4d2fffb9",
      "tree": "6900ee56333ec64b1398cdfea2af9d04a01e182d",
      "parents": [
        "5a0bbce58bb25bd756f7ec437319d6ed2201a18b"
      ],
      "author": {
        "name": "lorenzo@gnu.org",
        "email": "lorenzo@gnu.org",
        "time": "Thu Mar 09 00:33:47 2006 +0100"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:55 2006 -0500"
      },
      "message": "[PATCH] EXPORT_SYMBOL patch for audit_log, audit_log_start, audit_log_end and audit_format\n\nHi,\n\nThis is a trivial patch that enables the possibility of using some auditing\nfunctions within loadable kernel modules (ie. inside a Linux Security Module).\n\n_\n\nMake the audit_log_start, audit_log_end, audit_format and audit_log\ninterfaces available to Loadable Kernel Modules, thus making possible\nthe usage of the audit framework inside LSMs, etc.\n\nSigned-off-by: \u003cLorenzo Hernández García-Hierro \u003clorenzo@gnu.org\u003e\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "5a0bbce58bb25bd756f7ec437319d6ed2201a18b",
      "tree": "d8b263248c3eaece9a1c906e02c0795794f480de",
      "parents": [
        "4023e020807ea249ae83f0d1d851b4c7cf0afd8a"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@elte.hu",
        "time": "Tue Mar 07 23:51:38 2006 -0800"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:55 2006 -0500"
      },
      "message": "[PATCH] sem2mutex: audit_netlink_sem\n\nSemaphore to mutex conversion.\n\nThe conversion was generated via scripts, and the result was validated\nautomatically via a script as well.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "93315ed6dd12dacfc941f9eb8ca0293aadf99793",
      "tree": "4fc070c92a1de21d3befe4ce48c733c65d044bb3",
      "parents": [
        "af601e4623d0303bfafa54ec728b7ae8493a8e1b"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Tue Feb 07 12:05:27 2006 -0500"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] audit string fields interface + consumer\n\nUpdated patch to dynamically allocate audit rule fields in kernel\u0027s\ninternal representation.  Added unlikely() calls for testing memory\nallocation result.\n\nAmy Griffis wrote:     [Wed Jan 11 2006, 02:02:31PM EST]\n\u003e Modify audit\u0027s kernel-userspace interface to allow the specification\n\u003e of string fields in audit rules.\n\u003e\n\u003e Signed-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n(cherry picked from 5ffc4a863f92351b720fe3e9c5cd647accff9e03 commit)\n"
    },
    {
      "commit": "fe7752bab26a9ac0651b695ad4f55659761f68f7",
      "tree": "b2e516a52232c978fc824b226418d8a28460b8a8",
      "parents": [
        "ee436dc46a762f430e37952d375a23d87735f73f"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@infradead.org",
        "time": "Thu Dec 15 18:33:52 2005 +0000"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] Fix audit record filtering with !CONFIG_AUDITSYSCALL\n\nThis fixes the per-user and per-message-type filtering when syscall\nauditing isn\u0027t enabled.\n\n[AV: folded followup fix from the same author]\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "8c8570fb8feef2bc166bee75a85748b25cda22d9",
      "tree": "ed783d405ea9d5f3d3ccc57fb56c7b7cb2cdfb82",
      "parents": [
        "c8edc80c8b8c397c53f4f659a05b9ea6208029bf"
      ],
      "author": {
        "name": "Dustin Kirkland",
        "email": "dustin.kirkland@us.ibm.com",
        "time": "Thu Nov 03 17:15:16 2005 +0000"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] Capture selinux subject/object context information.\n\nThis patch extends existing audit records with subject/object context\ninformation. Audit records associated with filesystem inodes, ipc, and\ntasks now contain SELinux label information in the field \"subj\" if the\nitem is performing the action, or in \"obj\" if the item is the receiver\nof an action.\n\nThese labels are collected via hooks in SELinux and appended to the\nappropriate record in the audit code.\n\nThis additional information is required for Common Criteria Labeled\nSecurity Protection Profile (LSPP).\n\n[AV: fixed kmalloc flags use]\n[folded leak fixes]\n[folded cleanup from akpm (kfree(NULL)]\n[folded audit_inode_context() leak fix]\n[folded akpm\u0027s fix for audit_ipc_perm() definition in case of !CONFIG_AUDIT]\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "c8edc80c8b8c397c53f4f659a05b9ea6208029bf",
      "tree": "0b09c0ff9ea28038b711d7368100302a1cc69b6d",
      "parents": [
        "73241ccca0f7786933f1d31b3d86f2456549953a"
      ],
      "author": {
        "name": "Dustin Kirkland",
        "email": "dustin.kirkland@us.ibm.com",
        "time": "Thu Nov 03 16:12:36 2005 +0000"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:54 2006 -0500"
      },
      "message": "[PATCH] Exclude messages by message type\n\n    - Add a new, 5th filter called \"exclude\".\n    - And add a new field AUDIT_MSGTYPE.\n    - Define a new function audit_filter_exclude() that takes a message type\n      as input and examines all rules in the filter.  It returns \u00271\u0027 if the\n      message is to be excluded, and \u00270\u0027 otherwise.\n    - Call the audit_filter_exclude() function near the top of\n      audit_log_start() just after asserting audit_initialized.  If the\n      message type is not to be audited, return NULL very early, before\n      doing a lot of work.\n[combined with followup fix for bug in original patch, Nov 4, same author]\n[combined with later renaming AUDIT_FILTER_EXCLUDE-\u003eAUDIT_FILTER_TYPE\nand audit_filter_exclude() -\u003e audit_filter_type()]\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "90d526c074ae5db484388da56c399acf892b6c17",
      "tree": "edeb7c47d9144f3995846c5fc25db8e49ef12f5d",
      "parents": [
        "b63862f46547487388e582e8ac9083830d34f058"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Thu Nov 03 15:48:08 2005 +0000"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:53 2006 -0500"
      },
      "message": "[PATCH] Define new range of userspace messages.\n\nThe attached patch updates various items for the new user space\nmessages. Please apply.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "b0dd25a8263dde3c30b0d7d72a8bd92d7ba0e3f5",
      "tree": "8eadfe525920c8256d755b084035a513e3dcab47",
      "parents": [
        "7e7f8a036b8e2b2a300df016da5e7128c8a9192e"
      ],
      "author": {
        "name": "Randy Dunlap",
        "email": "rdunlap@xenotime.net",
        "time": "Tue Sep 13 12:47:11 2005 -0700"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Mar 20 14:08:53 2006 -0500"
      },
      "message": "[PATCH] AUDIT: kerneldoc for kernel/audit*.c\n\n- add kerneldoc for non-static functions;\n- don\u0027t init static data to 0;\n- limit lines to \u003c 80 columns;\n- fix long-format style;\n- delete whitespace at end of some lines;\n\n(chrisw: resend and update to current audit-2.6 tree)\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "715b49ef2de6fcead0776d9349071670282faf65",
      "tree": "d09b77c804aba3b191dc0ceb294387cf730ede4b",
      "parents": [
        "3213e913b0d6baeb28aa1affbdd4bfa7efedc35f"
      ],
      "author": {
        "name": "Alan Cox",
        "email": "alan@lxorguk.ukuu.org.uk",
        "time": "Wed Jan 18 17:44:07 2006 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Wed Jan 18 19:20:30 2006 -0800"
      },
      "message": "[PATCH] EDAC: atomic scrub operations\n\nEDAC requires a way to scrub memory if an ECC error is found and the chipset\ndoes not do the work automatically.  That means rewriting memory locations\natomically with respect to all CPUs _and_ bus masters.  That means we can\u0027t\nuse atomic_add(foo, 0) as it gets optimised for non-SMP\n\nThis adds a function to include/asm-foo/atomic.h for the platforms currently\nsupported which implements a scrub of a mapped block.\n\nIt also adjusts a few other files include order where atomic.h is included\nbefore types.h as this now causes an error as atomic_scrub uses u32.\n\nSigned-off-by: Alan Cox \u003calan@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "97a41e26124330e41aa10ef88cd1711bc3d17460",
      "tree": "1546db361efaf926c7a970e3ec6044ea8d4b6f4c",
      "parents": [
        "b7b4d7a4666454b40b45a853bd1d296af37a85f0"
      ],
      "author": {
        "name": "Adrian Bunk",
        "email": "bunk@stusta.de",
        "time": "Sun Jan 08 01:02:17 2006 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sun Jan 08 20:13:48 2006 -0800"
      },
      "message": "[PATCH] kernel/: small cleanups\n\nThis patch contains the following cleanups:\n- make needlessly global functions static\n- every file should include the headers containing the prototypes for\n  it\u0027s global functions\n\nSigned-off-by: Adrian Bunk \u003cbunk@stusta.de\u003e\nAcked-by: \"Paul E. McKenney\" \u003cpaulmck@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "7a4ae749a478f8bca73d4b5b8c1b8cbb178b2db5",
      "tree": "a8480cc6ab547c01818182112ce4bc8bdcc6f91f",
      "parents": [
        "bf001b26793bd9f8a446577c361226fbcd617182"
      ],
      "author": {
        "name": "Pierre Ossman",
        "email": "drzeus@drzeus.cx",
        "time": "Mon Dec 12 00:37:22 2005 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Mon Dec 12 08:57:43 2005 -0800"
      },
      "message": "[PATCH] Add try_to_freeze to kauditd\n\nkauditd was causing suspends to fail because it refused to freeze.  Adding\na try_to_freeze() to its sleep loop solves the issue.\n\nSigned-off-by: Pierre Ossman \u003cdrzeus@drzeus.cx\u003e\nAcked-by: Pavel Machek \u003cpavel@suse.cz\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "9796fdd829da626374458e8706daedcc0e432ddd",
      "tree": "a0b4af7f45267cdcdfb677c2167906c6ef981b76",
      "parents": [
        "55016f10e31bb15b85d8c500f979dfdceb37d548"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Fri Oct 21 03:22:03 2005 -0400"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Fri Oct 28 08:16:49 2005 -0700"
      },
      "message": "[PATCH] gfp_t: kernel/*\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "dd0fc66fb33cd610bc1a5db8a5e232d34879b4d7",
      "tree": "51f96a9db96293b352e358f66032e1f4ff79fafb",
      "parents": [
        "3b0e77bd144203a507eb191f7117d2c5004ea1de"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@ftp.linux.org.uk",
        "time": "Fri Oct 07 07:46:04 2005 +0100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sat Oct 08 15:00:57 2005 -0700"
      },
      "message": "[PATCH] gfp flags annotations - part 1\n\n - added typedef unsigned int __nocast gfp_t;\n\n - replaced __nocast uses for gfp flags with gfp_t - it gives exactly\n   the same warnings as far as sparse is concerned, doesn\u0027t change\n   generated code (from gcc point of view we replaced unsigned int with\n   typedef) and documents what\u0027s going on far better.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "5d54e69c68c05b162a56f9914cae72afd7e6f40a",
      "tree": "c5933858c4861bc3e358559f64ef459a1f56ab75",
      "parents": [
        "63f3d1df1ad276a30b75339dd682a6e1f9d0c181",
        "b6ddc518520887a62728b0414efbf802a9dfdd55"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Tue Sep 13 09:47:30 2005 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Tue Sep 13 09:47:30 2005 -0700"
      },
      "message": "Merge master.kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6 \n"
    },
    {
      "commit": "066286071d3542243baa68166acb779187c848b3",
      "tree": "ef6604f16ceb13842a30311654e6a64aac716c48",
      "parents": [
        "9a4595bc7e67962f13232ee55a64e063062c3a99"
      ],
      "author": {
        "name": "Patrick McHardy",
        "email": "kaber@trash.net",
        "time": "Mon Aug 15 12:33:26 2005 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Mon Aug 29 16:01:11 2005 -0700"
      },
      "message": "[NETLINK]: Add \"groups\" argument to netlink_kernel_create\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "4fdb3bb723db469717c6d38fda667d8b0fa86ebd",
      "tree": "43d82e717922e6319cf8a8f9dc5ee902c651b491",
      "parents": [
        "020b4c12dbe3868d792a01d7c1470cd837abe10f"
      ],
      "author": {
        "name": "Harald Welte",
        "email": "laforge@netfilter.org",
        "time": "Tue Aug 09 19:40:55 2005 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Mon Aug 29 15:35:08 2005 -0700"
      },
      "message": "[NETLINK]: Add properly module refcounting for kernel netlink sockets.\n\n- Remove bogus code for compiling netlink as module\n- Add module refcounting support for modules implementing a netlink\n  protocol\n- Add support for autoloading modules that implement a netlink protocol\n  as soon as someone opens a socket for that protocol\n\nSigned-off-by: Harald Welte \u003claforge@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "3c789a19054034847afe80af2f23ebb0eebfbad6",
      "tree": "cc983b5fd132c329e16d61d408d8a26ca048cf6b",
      "parents": [
        "c3896495942392f1a792da1cafba7a573cbf6fc2"
      ],
      "author": {
        "name": "Amy Griffis",
        "email": "amy.griffis@hp.com",
        "time": "Wed Aug 17 16:05:35 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Aug 17 16:05:35 2005 +0100"
      },
      "message": "AUDIT: Prevent duplicate syscall rules\n\nThe following patch against audit.81 prevents duplicate syscall rules in\na given filter list by walking the list on each rule add.\n\nI also removed the unused struct audit_entry in audit.c and made the\nstatic inlines in auditsc.c consistent.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "ce625a801664d8ed7344117bbb57510e4e0e872c",
      "tree": "50e6760a0b1b506b234700afddc7296b28918650",
      "parents": [
        "d5b454f2c40c9efd0cc113bc3220ebcb66b7c022"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon Jul 18 14:24:46 2005 -0400"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon Jul 18 14:24:46 2005 -0400"
      },
      "message": "AUDIT: Reduce contention in audit_serial()\n... by generating serial numbers only if an audit context is actually\n_used_, rather than doing so at syscall entry even when the context\nisn\u0027t necessarily marked auditable.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "d5b454f2c40c9efd0cc113bc3220ebcb66b7c022",
      "tree": "a8aaa30e003c9dcc07840c217760f92e4fab430a",
      "parents": [
        "351bb722590b2329ac5e72c4b824b8b6ce6e3082"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jul 15 12:56:03 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jul 15 12:56:03 2005 +0100"
      },
      "message": "AUDIT: Fix livelock in audit_serial().\n\nThe tricks with atomic_t were bizarre. Just do it sensibly instead.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "6c8c8ba5d7e31b37d0184c388183a6039a672417",
      "tree": "a655804389553060311bfae595be7ee7f97a1b31",
      "parents": [
        "ad3f9a2238e401a1fc493b8c91341f9e57940eda"
      ],
      "author": {
        "name": "Victor Fusco",
        "email": "victor@cetuc.puc-rio.br",
        "time": "Wed Jul 13 22:26:57 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jul 13 22:26:57 2005 +0100"
      },
      "message": "[AUDIT] Fix sparse warning about gfp_mask type\n\nFix the sparse warning \"implicit cast to nocast type\"\n\nSigned-off-by: Victor Fusco \u003cvictor@cetuc.puc-rio.br\u003e\nSigned-off-by: Domen Puncer \u003cdomen@coderock.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "ac4cec443a80bfde829516e7a7db10f7325aa528",
      "tree": "599801be12aa415d1c734cde37b1c2378fc6fe98",
      "parents": [
        "7b430437c0de81681ecfa8efa8f55823df733529"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat Jul 02 14:08:48 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat Jul 02 14:08:48 2005 +0100"
      },
      "message": "AUDIT: Stop waiting for backlog after audit_panic() happens\n\nWe force a rate-limit on auditable events by making them wait for space \non the backlog queue. However, if auditd really is AWOL then this could \npotentially bring the entire system to a halt, depending on the audit \nrules in effect.\n\nFirstly, make sure the wait time is honoured correctly -- it\u0027s the \nmaximum time the process should wait, rather than the time to wait \n_each_ time round the loop. We were getting re-woken _each_ time a \npacket was dequeued, and the timeout was being restarted each time.\n\nSecondly, reset the wait time after audit_panic() is called. In general \nthis will be reset to zero, to allow progress to be made. If the system\nis configured to _actually_ panic on audit_panic() then that will \nalready have happened; otherwise we know that audit records are being \nlost anyway. \n\nThese two tunables can\u0027t be exposed via AUDIT_GET and AUDIT_SET because \nthose aren\u0027t particularly well-designed. It probably should have been \ndone by sysctls or sysfs anyway -- one for a later patch.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "e1b09eba2686eca94a3a188042b518df6044a3c1",
      "tree": "e528e42fde80c61b21e35266584ca73b32c0a962",
      "parents": [
        "5bb289b5a0becb53ac3e1d60815ff8b779296b73"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jun 24 17:24:11 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jun 24 17:24:11 2005 +0100"
      },
      "message": "AUDIT: Use KERN_NOTICE for printk of audit records\n\nThey aren\u0027t errors.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5bb289b5a0becb53ac3e1d60815ff8b779296b73",
      "tree": "0db75422d66eec857e0c05cd4cf4d014e7c0e264",
      "parents": [
        "993e2d4106e94dae6e8cfbeb32073bd12cdee203"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jun 24 14:14:05 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Jun 24 14:14:05 2005 +0100"
      },
      "message": "AUDIT: Clean up user message filtering\n\nDon\u0027t look up the task by its pid and then use the syscall filtering\nhelper. Just implement our own filter helper which operates solely on\nthe information in the netlink_skb_parms. \n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "9470178e620fe8f512928eed34994572c1c44be4",
      "tree": "99b6d171a827cbea045119f90b62de25ff92a70f",
      "parents": [
        "9ad9ad385be27fcc7c16d290d972c6173e780a61"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 15:40:55 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 15:40:55 2005 +0100"
      },
      "message": "AUDIT: Remove stray declaration of tsk from audit_receive_msg().\n\nIt\u0027s not used any more.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "9ad9ad385be27fcc7c16d290d972c6173e780a61",
      "tree": "bbca700c2d88ba421a6c9c348de367eaf4de0e2c",
      "parents": [
        "177bbc733a1d9c935bc3d6efd776a6699b29b1ca"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 15:04:33 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 15:04:33 2005 +0100"
      },
      "message": "AUDIT: Wait for backlog to clear when generating messages.\n\nAdd a gfp_mask to audit_log_start() and audit_log(), to reduce the\namount of GFP_ATOMIC allocation -- most of it doesn\u0027t need to be \nGFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to\n60 seconds for the auditd backlog to clear instead of immediately \nabandoning the message. \n\nThe timeout should probably be made configurable, but for now it\u0027ll \nsuffice that it only happens if auditd is actually running.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "4a4cd633b575609b741a1de7837223a2d9e1c34c",
      "tree": "f4c3a6beb6a587598193053240f3e3f82885f1e3",
      "parents": [
        "f6a789d19858a951e7ff9e297a44b377c21b6c33"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 14:56:47 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed Jun 22 14:56:47 2005 +0100"
      },
      "message": "AUDIT: Optimise the audit-disabled case for discarding user messages\n\nAlso exempt USER_AVC message from being discarded to preserve \nexisting behaviour for SE Linux.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "f6a789d19858a951e7ff9e297a44b377c21b6c33",
      "tree": "5e54f1460bc048706ad6df8c5cb5bf748f067f13",
      "parents": [
        "ae7b961b1c943367dfe179411f120d7bf8eaba89"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue Jun 21 16:22:01 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue Jun 21 16:22:01 2005 +0100"
      },
      "message": "AUDIT: Spawn kernel thread to list filter rules.\n\nIf we have enough rules to fill the netlink buffer space, it\u0027ll \ndeadlock because auditctl isn\u0027t ever actually going to read from the \nsocket until we return, and we aren\u0027t going to return until it \nreads... so we spawn a kernel thread to spew out the list and then\nexit.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "d6e0e1585a1a9a15e48ec47206a809828afe4450",
      "tree": "67f444b480566fe0272c0543dea9e54cb1cbde12",
      "parents": [
        "df5179854bca84ac5be500849b12dd33ce03f03f"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon Jun 20 16:02:09 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon Jun 20 16:02:09 2005 +0100"
      },
      "message": "AUDIT: Drop user-generated messages immediately while auditing disabled.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "0f45aa18e65cf3d768082d7d86054a0d2a20bb18",
      "tree": "6e94dfcd813061f5a710b5621e1b2f5a01a95533",
      "parents": [
        "0107b3cf3225aed6ddde4fa8dbcd4ed643b34f4d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sun Jun 19 19:35:50 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sun Jun 19 19:35:50 2005 +0100"
      },
      "message": "AUDIT: Allow filtering of user messages\n\nTurn the field from a bitmask to an enumeration and add a list to allow \nfiltering of messages generated by userspace. We also define a list for \nfile system watches in anticipation of that feature.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "bccf6ae083318ea08094d6ab185fdf7c49906b3a",
      "tree": "0dc4fabe9004aa666e646c69e976fda989c08565",
      "parents": [
        "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon May 23 21:35:28 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon May 23 21:35:28 2005 +0100"
      },
      "message": "AUDIT: Unify auid reporting, put arch before syscall number\n\nThese changes make processing of audit logs easier. Based on a patch\nfrom Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a",
      "tree": "72a2068a1008a66db09ad6eebfdeb490f1a33308",
      "parents": [
        "7b5d781ce1f19fb7382d3d3fb7af48e429bed12d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 21:08:09 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 21:08:09 2005 +0100"
      },
      "message": "AUDIT: Assign serial number to non-syscall messages\n\nMove audit_serial() into audit.c and use it to generate serial numbers \non messages even when there is no audit context from syscall auditing.  \nThis allows us to disambiguate audit records when more than one is \ngenerated in the same millisecond.\n\nBased on a patch by Steve Grubb after he observed the problem.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n\n"
    },
    {
      "commit": "326e9c8ba6a149f47e020719b23b24a14ba740d6",
      "tree": "279ace274d6a5e7c696c95f397bfbf5d5d5c347a",
      "parents": [
        "05474106a41f44d16d649bc8c7687fc24ce4370a"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Sat May 21 00:22:31 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 00:22:31 2005 +0100"
      },
      "message": "AUDIT: Fix inconsistent use of loginuid vs. auid, signed vs. unsigned \n\nThe attached patch changes all occurrences of loginuid to auid. It also \nchanges everything to %u that is an unsigned type.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "05474106a41f44d16d649bc8c7687fc24ce4370a",
      "tree": "0c6893b88d843795d60eb03e929bac3e8937bc9c",
      "parents": [
        "011161051bbc25f7f8b7df059dbd934c534443f0"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Sat May 21 00:18:37 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 00:18:37 2005 +0100"
      },
      "message": "AUDIT: Fix AVC_USER message passing.\n\nThe original AVC_USER message wasn\u0027t consolidated with the new range of\nuser messages. The attached patch fixes the kernel so the old messages \nwork again.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "fb19b4c6aa024837a0071f07baa07dbf49d07151",
      "tree": "6062647cc9e84f81d679a5f3d27ceb8363e9822d",
      "parents": [
        "7063e6c717f6108c4b3fc3135a516c86ef944870"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 14:55:56 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 14:55:56 2005 +0100"
      },
      "message": "AUDIT: Honour audit_backlog_limit again.\n\nThe limit on the number of outstanding audit messages was inadvertently\nremoved with the switch to queuing skbs directly for sending by a kernel\nthread. Put it back again.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "b7d1125817c9a46cc46f57db89d9c195e7af22f8",
      "tree": "c1096ff7ae35b77bf8108c3a60b856551c50a9d7",
      "parents": [
        "168b7173959f80d20720dd1f7ec909a88ef2689d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:56:58 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:56:58 2005 +0100"
      },
      "message": "AUDIT: Send netlink messages from a separate kernel thread\n\nnetlink_unicast() will attempt to reallocate and will free messages if\nthe socket\u0027s rcvbuf limit is reached unless we give it an infinite \ntimeout. So do that, from a kernel thread which is dedicated to spewing\nstuff up the netlink socket.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "168b7173959f80d20720dd1f7ec909a88ef2689d",
      "tree": "dc197062e11c003b330b5302535fd74407c2138b",
      "parents": [
        "209aba03243ee42a22f8df8d08aa9963f62aec64"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Thu May 19 10:24:22 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:24:22 2005 +0100"
      },
      "message": "AUDIT: Clean up logging of untrusted strings\n\n* If vsnprintf returns -1, it will mess up the sk buffer space accounting. \nThis is fixed by not calling skb_put with bogus len values.\n\n* audit_log_hex was a loop that called audit_log_vformat with %02X for each \ncharacter. This is very inefficient since conversion from unsigned character \nto Ascii representation is essentially masking, shifting, and byte lookups. \nAlso, the length of the converted string is well known - it\u0027s twice the \noriginal. Fixed by rewriting the function.\n\n* audit_log_untrustedstring had no comments. This makes it hard for \nsomeone to understand what the string format will be.\n\n* audit_log_d_path was never fixed to use untrustedstring. This could mess\nup user space parsers. This was fixed to make a temp buffer, call d_path, \nand log temp buffer using untrustedstring. \n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "209aba03243ee42a22f8df8d08aa9963f62aec64",
      "tree": "e45ee43e7af31f847377e8bb3a0a61581732b653",
      "parents": [
        "3ec3b2fba526ead2fa3f3d7c91924f39a0733749"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 18 10:21:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 18 10:21:07 2005 +0100"
      },
      "message": "AUDIT: Treat all user messages identically.\n\nIt\u0027s silly to have to add explicit entries for new userspace messages\nas we invent them. Just treat all messages in the user range the same.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5e014b10ef8477c32a939a48fa02aedcad35a226",
      "tree": "8c314b8485aff98506402976c3bca1011735a633",
      "parents": [
        "23f32d18aa589e228c5a9e12e0d0c67c9b5bcdce"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:50:33 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:50:33 2005 +0100"
      },
      "message": "AUDIT: fix max_t thinko.\n\nDer... if you use max_t it helps if you give it a type. \n\nNote to self: Always just apply the tested patches, don\u0027t try to port \nthem by hand. You\u0027re not clever enough.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "23f32d18aa589e228c5a9e12e0d0c67c9b5bcdce",
      "tree": "fa8e1156035b871d446cdf9706898b761d6455e0",
      "parents": [
        "c04049939f88b29e235d2da217bce6e8ead44f32"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 13 18:35:15 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:35:15 2005 +0100"
      },
      "message": "AUDIT: Fix some spelling errors\n\nI\u0027m going through the kernel code and have a patch that corrects \nseveral spelling errors in comments.\n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c04049939f88b29e235d2da217bce6e8ead44f32",
      "tree": "9bf3ab72b9939c529e7c96f8768bc8b7e1d768c9",
      "parents": [
        "9ea74f0655412d0fbd12bf9adb6c14c8fe707a42"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 13 18:17:42 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:17:42 2005 +0100"
      },
      "message": "AUDIT: Add message types to audit records\n\nThis patch adds more messages types to the audit subsystem so that audit \nanalysis is quicker, intuitive, and more useful.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n---\nI forgot one type in the big patch. I need to add one for user space \noriginating SE Linux avc messages. This is used by dbus and nscd.\n\n-Steve\n---\nUpdated to 2.6.12-rc4-mm1.\n-dwmw2\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "9ea74f0655412d0fbd12bf9adb6c14c8fe707a42",
      "tree": "8c04a9c6ed0144ff217b227fbf354f41dbceb023",
      "parents": [
        "add671412021b68c3b4f2882b0d10a56e2dcdabe"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 16:35:19 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 16:35:19 2005 +0100"
      },
      "message": "AUDIT: Round up audit skb expansion to AUDIT_BUFSIZ.\n\nOtherwise, we will be repeatedly reallocating, even if we\u0027re only\nadding a few bytes at a time. Pointed out by Steve Grubb.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c1b773d87eadc3972d697444127e89a7291769a2",
      "tree": "edfce2e842c3b6be70f3b90584507aab9fb3de8f",
      "parents": [
        "197c69c6afd2deb7eec44040ff533d90d26c6161"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:55:10 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:55:10 2005 +0100"
      },
      "message": "Add audit_log_type\n\nAdd audit_log_type to allow callers to specify type and pid when logging.\nConvert audit_log to wrapper around audit_log_type.  Could have\nconverted all audit_log callers directly, but common case is default\nof type AUDIT_KERNEL and pid 0.  Update audit_log_start to take type\nand pid values when creating a new audit_buffer.  Move sequences that\ndid audit_log_start, audit_log_format, audit_set_type, audit_log_end,\nto simply call audit_log_type directly.  This obsoletes audit_set_type\nand audit_set_pid, so remove them.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "197c69c6afd2deb7eec44040ff533d90d26c6161",
      "tree": "a44d7170fe20d6119eff6e656d39be623ed6131a",
      "parents": [
        "804a6a49d874841a98ebea3247ad2e672812ad6a"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:54:05 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:54:05 2005 +0100"
      },
      "message": "Move ifdef CONFIG_AUDITSYSCALL to header\n\nRemove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c.\nMove these dependencies to audit.h with the rest.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "804a6a49d874841a98ebea3247ad2e672812ad6a",
      "tree": "84bd717927666811d55f31346387f8cb99dff346",
      "parents": [
        "5a241d77039a2632e81070619d5733258728f8bd"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:52:45 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:52:45 2005 +0100"
      },
      "message": "Audit requires CONFIG_NET\n\nAudit now actually requires netlink.  So make it depend on CONFIG_NET, \nand remove the inline dependencies on CONFIG_NET.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5a241d77039a2632e81070619d5733258728f8bd",
      "tree": "c0f1b643144e5f53d619f22df6afb031ed0aef45",
      "parents": [
        "eecb0a7338ef6504aa49def4dde6429853025801"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:43:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:43:07 2005 +0100"
      },
      "message": "AUDIT: Properly account for alignment difference in nlmsg_len.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "eecb0a7338ef6504aa49def4dde6429853025801",
      "tree": "078561cbf3e1fb3d8f837a96f2a6d49d85c6819a",
      "parents": [
        "e3b926b4c1499ba7b1b9513aa6113944d572aba5"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:58:51 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:58:51 2005 +0100"
      },
      "message": "AUDIT: Fix abuse of va_args. \n\nWe\u0027re not allowed to use args twice; we need to use va_copy.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "e3b926b4c1499ba7b1b9513aa6113944d572aba5",
      "tree": "6d4a230f3c02ebfd5073517fe8eb36f9a61dad22",
      "parents": [
        "8c5aa40c94ef8bb7f7da95ecd5942e2d20fc3c9d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:56:08 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:56:08 2005 +0100"
      },
      "message": "AUDIT: pass size argument to audit_expand().\n\nLet audit_expand() know how much it\u0027s expected to grow the buffer, in \nthe case that we have that information to hand.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "8c5aa40c94ef8bb7f7da95ecd5942e2d20fc3c9d",
      "tree": "8cda8d1193dfc814a724406cdd0479c7f46c0487",
      "parents": [
        "ea9c102cb0a7969df5733d34f26e0b12c8a3c889"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Tue May 10 18:53:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:53:07 2005 +0100"
      },
      "message": "AUDIT: Fix reported length of audit messages.\n\nWe were setting nlmsg_len to skb-\u003elen, but we should be subtracting\nthe size of the header.\n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "4332bdd332a2dca93dc3b1d017b2dd27d5c8cef3",
      "tree": "a1152698b795a215ec572942836be058ae65ef51",
      "parents": [
        "5ac52f33b6f05fcb91a97124155183b779a4efdf"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:59:57 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:59:57 2005 +0100"
      },
      "message": "AUDIT: Honour gfp_mask in audit_buffer_alloc()\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5ac52f33b6f05fcb91a97124155183b779a4efdf",
      "tree": "9987d074c840a7afa731660400f4d5a8a8bad973",
      "parents": [
        "8fc6115c2a04099a6e846dc0b2d85cba43821b54"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:54:53 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:54:53 2005 +0100"
      },
      "message": "AUDIT: buffer audit msgs directly to skb\n\nDrop the use of a tmp buffer in the audit_buffer, and just buffer\ndirectly to the skb.  All header data that was temporarily stored in\nthe audit_buffer can now be stored directly in the netlink header in\nthe skb.  Resize skb as needed.  This eliminates the extra copy (and\nthe audit_log_move function which was responsible for copying).\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "8fc6115c2a04099a6e846dc0b2d85cba43821b54",
      "tree": "6dc6bf0f59f6ada9ed42c79b0e641f8668a9bf0b",
      "parents": [
        "16e1904e694d459ec2ca9b33c22b818eaaa4c63f"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:54:17 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:54:17 2005 +0100"
      },
      "message": "AUDIT: expand audit tmp buffer as needed\n\nIntroduce audit_expand and make the audit_buffer use a dynamic buffer\nwhich can be resized.  When audit buffer is moved to skb it will not\nbe fragmented across skb\u0027s, so we can eliminate the sklist in the\naudit_buffer.  During audit_log_move, we simply copy the full buffer\ninto a single skb, and then audit_log_drain sends it on.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "16e1904e694d459ec2ca9b33c22b818eaaa4c63f",
      "tree": "ca35b75b7d2e95b2ee11ba4b608549a5339b3cf0",
      "parents": [
        "c2f0c7c356dc9ae15419f00c725a2fcc58eeff58"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:53:34 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:53:34 2005 +0100"
      },
      "message": "AUDIT: Add helper functions to allocate and free audit_buffers.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c2f0c7c356dc9ae15419f00c725a2fcc58eeff58",
      "tree": "2b765b791115e0e85b45bc98800fd2650b23155b",
      "parents": [
        "2512809255d018744fe6c2f5e996c83769846c07"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 06 12:38:39 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 12:38:39 2005 +0100"
      },
      "message": "The attached patch addresses the problem with getting the audit daemon \nshutdown credential information. It creates a new message type \nAUDIT_TERM_INFO, which is used by the audit daemon to query who issued the \nshutdown. \n\nIt requires the placement of a hook function that gathers the information. The \nhook is after the DAC \u0026 MAC checks and before the function returns. Racing \nthreads could overwrite the uid \u0026 pid - but they would have to be root and \nhave policy that allows signalling the audit daemon. That should be a \nmanageable risk.\n\nThe userspace component will be released later in audit 0.7.2. When it \nreceives the TERM signal, it queries the kernel for shutdown information. \nWhen it receives it, it writes the message and exits. The message looks \nlike this:\n\ntype\u003dDAEMON msg\u003dauditd(1114551182.000) auditd normal halt, sending pid\u003d2650 \nuid\u003d525, auditd pid\u003d1685\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "bfd4bda097f8758d28e632ff2035e25577f6b060",
      "tree": "022276b3625a432c7132e39776e7e448445087ac",
      "parents": [
        "488f2eaca1b0831a5a5e6a66e33bad2cdeff7238",
        "b2d84f078a8be40f5ae3b4d2ac001e2a7f45fe4f"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 05 13:59:37 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 05 13:59:37 2005 +0100"
      },
      "message": "Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git\n"
    },
    {
      "commit": "2a0a6ebee1d68552152ae8d4aeda91d806995dec",
      "tree": "a0b77861b3395b4728e75f2b2f92755e0a4777d3",
      "parents": [
        "96c36023434b7b6824b1da72a6b7b1ca61d7310c"
      ],
      "author": {
        "name": "Herbert Xu",
        "email": "herbert@gondor.apana.org.au",
        "time": "Tue May 03 14:55:09 2005 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue May 03 14:55:09 2005 -0700"
      },
      "message": "[NETLINK]: Synchronous message processing.\n\nLet\u0027s recap the problem.  The current asynchronous netlink kernel\nmessage processing is vulnerable to these attacks:\n\n1) Hit and run: Attacker sends one or more messages and then exits\nbefore they\u0027re processed.  This may confuse/disable the next netlink\nuser that gets the netlink address of the attacker since it may\nreceive the responses to the attacker\u0027s messages.\n\nProposed solutions:\n\na) Synchronous processing.\nb) Stream mode socket.\nc) Restrict/prohibit binding.\n\n2) Starvation: Because various netlink rcv functions were written\nto not return until all messages have been processed on a socket,\nit is possible for these functions to execute for an arbitrarily\nlong period of time.  If this is successfully exploited it could\nalso be used to hold rtnl forever.\n\nProposed solutions:\n\na) Synchronous processing.\nb) Stream mode socket.\n\nFirstly let\u0027s cross off solution c).  It only solves the first\nproblem and it has user-visible impacts.  In particular, it\u0027ll\nbreak user space applications that expect to bind or communicate\nwith specific netlink addresses (pid\u0027s).\n\nSo we\u0027re left with a choice of synchronous processing versus\nSOCK_STREAM for netlink.\n\nFor the moment I\u0027m sticking with the synchronous approach as\nsuggested by Alexey since it\u0027s simpler and I\u0027d rather spend\nmy time working on other things.\n\nHowever, it does have a number of deficiencies compared to the\nstream mode solution:\n\n1) User-space to user-space netlink communication is still vulnerable.\n\n2) Inefficient use of resources.  This is especially true for rtnetlink\nsince the lock is shared with other users such as networking drivers.\nThe latter could hold the rtnl while communicating with hardware which\ncauses the rtnetlink user to wait when it could be doing other things.\n\n3) It is still possible to DoS all netlink users by flooding the kernel\nnetlink receive queue.  The attacker simply fills the receive socket\nwith a single netlink message that fills up the entire queue.  The\nattacker then continues to call sendmsg with the same message in a loop.\n\nPoint 3) can be countered by retransmissions in user-space code, however\nit is pretty messy.\n\nIn light of these problems (in particular, point 3), we should implement\nstream mode netlink at some point.  In the mean time, here is a patch\nthat implements synchronous processing.  \n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "0dd8e06bdaa0a97e706ee1a489a1f6176c4ddc64",
      "tree": "f09181360e5b68d46ea2856c9fa63eaa3515080c",
      "parents": [
        "27b030d58c8e72fc7a95187a791bd9406e350f02"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Tue May 03 14:01:15 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 03 14:01:15 2005 +0100"
      },
      "message": "[PATCH] add new audit data to last skb\n\nWhen adding more formatted audit data to an skb for delivery to userspace,\nthe kernel will attempt to reuse an skb that has spare room.  However, if\nthe audit message has already been fragmented to multiple skb\u0027s, the search\nfor spare room in the skb uses the head of the list.  This will corrupt the\naudit message with trailing bytes being placed midway through the stream.\nFix is to look at the end of the list.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "37509e749dc2072e667db806ef24b9e897f61b8a",
      "tree": "62e8c43ba360a9d0584822b06126284e4db428b8",
      "parents": [
        "c94c257c88c517f251da273a15c654224c7b6e21"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri Apr 29 17:19:14 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 17:19:14 2005 +0100"
      },
      "message": "[AUDIT] Requeue messages at head of queue, up to audit_backlog\n\nIf netlink_unicast() fails, requeue the skb back at the head of the queue\nit just came from, instead of the tail. And do so unless we\u0027ve exceeded\nthe audit_backlog limit; not according to some other arbitrary limit.\n\nFrom: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c94c257c88c517f251da273a15c654224c7b6e21",
      "tree": "992dd50f6bb13a70b04450cdfe0dbfb3c7b17ef5",
      "parents": [
        "85c8721ff3bc96b702427a440616079e8daf8a2f"
      ],
      "author": {
        "name": "Serge Hallyn",
        "email": "serue@us.ibm.com",
        "time": "Fri Apr 29 16:27:17 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:27:17 2005 +0100"
      },
      "message": "Add audit uid to netlink credentials\n\nMost audit control messages are sent over netlink.In order to properly\nlog the identity of the sender of audit control messages, we would like\nto add the loginuid to the netlink_creds structure, as per the attached\npatch.\n\nSigned-off-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "85c8721ff3bc96b702427a440616079e8daf8a2f",
      "tree": "1232ac4ebbd6d2453ee4d4a104003273ced20440",
      "parents": [
        "67eb81e1686f44bcf8f005b296213fd2c21b4719"
      ],
      "author": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:23:29 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:23:29 2005 +0100"
      },
      "message": "audit: update pointer to userspace tools, remove emacs mode tags\n"
    },
    {
      "commit": "c7fcb0ee74ef4cfdea02befacb55945c93641e44",
      "tree": "fbc01cfa85e2f7a3d070098e7d67d0196f52fa40",
      "parents": [
        "d812ddbb89e323d054a7d073466225966c8350c8"
      ],
      "author": {
        "name": "Peter Martuccelli",
        "email": "peterm@redhat.com",
        "time": "Fri Apr 29 16:10:24 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:10:24 2005 +0100"
      },
      "message": "[AUDIT] Avoid using %*.*s format strings.\n\nThey don\u0027t seem to work correctly (investigation ongoing), but we don\u0027t\nactually need to do it anyway.\n\nPatch from Peter Martuccelli \u003cpeterm@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "d812ddbb89e323d054a7d073466225966c8350c8",
      "tree": "469e3e7bb7d1ca450059fc1b45660b8bc6452dc7",
      "parents": [
        "2fd6f58ba6efc82ea2c9c2630f7ff5ed9eeaf34a"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri Apr 29 16:09:52 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:09:52 2005 +0100"
      },
      "message": "[AUDIT] Fix signedness of \u0027serial\u0027 in various routines.\n\nAttached is a patch that corrects a signed/unsigned warning. I also noticed\nthat we needlessly init serial to 0. That only needs to occur if the kernel\nwas compiled without the audit system.\n\n-Steve Grubb\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "81b7854d52d35ed2353dd47033ae630d18322a2d",
      "tree": "9df2b6f7accc3a7f3bcee9af5493c0cdf6b1f140",
      "parents": [
        "83c7d09173fdb6b06b109e65895392db3e49ac9c"
      ],
      "author": {
        "name": "Andrew Morton",
        "email": "akpm@osdl.org",
        "time": "Fri Apr 29 15:59:11 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:59:11 2005 +0100"
      },
      "message": "audit_log_untrustedstring() warning fix\n\nkernel/audit.c: In function `audit_log_untrustedstring\u0027:\nkernel/audit.c:736: warning: comparison is always false due to limited range of data type\n\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "83c7d09173fdb6b06b109e65895392db3e49ac9c",
      "tree": "3f48367a4d1413e221a5367bcd0cf8df7322c368",
      "parents": [
        "c60c390620e0abb60d4ae8c43583714bda27763f"
      ],
      "author": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:54:44 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:54:44 2005 +0100"
      },
      "message": "AUDIT: Avoid log pollution by untrusted strings.\n\nWe log strings from userspace, such as arguments to open(). These could\nbe formatted to contain \\n followed by fake audit log entries. Provide\na function for logging such strings, which gives a hex dump when the\nstring contains anything but basic printable ASCII characters. Use it\nfor logging filenames.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
      "tree": "0bba044c4ce775e45a88a51686b5d9f90697ea9d",
      "parents": [],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@ppc970.osdl.org",
        "time": "Sat Apr 16 15:20:36 2005 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@ppc970.osdl.org",
        "time": "Sat Apr 16 15:20:36 2005 -0700"
      },
      "message": "Linux-2.6.12-rc2\n\nInitial git repository build. I\u0027m not bothering with the full history,\neven though we have it. We can create a separate \"historical\" git\narchive of that later if we want to, and in the meantime it\u0027s about\n3.2GB when imported into git - space that would just make the early\ngit days unnecessarily complicated, when we don\u0027t have a lot of good\ninfrastructure for it.\n\nLet it rip!\n"
    }
  ]
}