)]}'
{
  "log": [
    {
      "commit": "bccf6ae083318ea08094d6ab185fdf7c49906b3a",
      "tree": "0dc4fabe9004aa666e646c69e976fda989c08565",
      "parents": [
        "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon May 23 21:35:28 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Mon May 23 21:35:28 2005 +0100"
      },
      "message": "AUDIT: Unify auid reporting, put arch before syscall number\n\nThese changes make processing of audit logs easier. Based on a patch\nfrom Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a",
      "tree": "72a2068a1008a66db09ad6eebfdeb490f1a33308",
      "parents": [
        "7b5d781ce1f19fb7382d3d3fb7af48e429bed12d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 21:08:09 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 21:08:09 2005 +0100"
      },
      "message": "AUDIT: Assign serial number to non-syscall messages\n\nMove audit_serial() into audit.c and use it to generate serial numbers \non messages even when there is no audit context from syscall auditing.  \nThis allows us to disambiguate audit records when more than one is \ngenerated in the same millisecond.\n\nBased on a patch by Steve Grubb after he observed the problem.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n\n"
    },
    {
      "commit": "326e9c8ba6a149f47e020719b23b24a14ba740d6",
      "tree": "279ace274d6a5e7c696c95f397bfbf5d5d5c347a",
      "parents": [
        "05474106a41f44d16d649bc8c7687fc24ce4370a"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Sat May 21 00:22:31 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 00:22:31 2005 +0100"
      },
      "message": "AUDIT: Fix inconsistent use of loginuid vs. auid, signed vs. unsigned \n\nThe attached patch changes all occurrences of loginuid to auid. It also \nchanges everything to %u that is an unsigned type.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "05474106a41f44d16d649bc8c7687fc24ce4370a",
      "tree": "0c6893b88d843795d60eb03e929bac3e8937bc9c",
      "parents": [
        "011161051bbc25f7f8b7df059dbd934c534443f0"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Sat May 21 00:18:37 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Sat May 21 00:18:37 2005 +0100"
      },
      "message": "AUDIT: Fix AVC_USER message passing.\n\nThe original AVC_USER message wasn\u0027t consolidated with the new range of\nuser messages. The attached patch fixes the kernel so the old messages \nwork again.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "fb19b4c6aa024837a0071f07baa07dbf49d07151",
      "tree": "6062647cc9e84f81d679a5f3d27ceb8363e9822d",
      "parents": [
        "7063e6c717f6108c4b3fc3135a516c86ef944870"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 14:55:56 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 14:55:56 2005 +0100"
      },
      "message": "AUDIT: Honour audit_backlog_limit again.\n\nThe limit on the number of outstanding audit messages was inadvertently\nremoved with the switch to queuing skbs directly for sending by a kernel\nthread. Put it back again.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "b7d1125817c9a46cc46f57db89d9c195e7af22f8",
      "tree": "c1096ff7ae35b77bf8108c3a60b856551c50a9d7",
      "parents": [
        "168b7173959f80d20720dd1f7ec909a88ef2689d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:56:58 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:56:58 2005 +0100"
      },
      "message": "AUDIT: Send netlink messages from a separate kernel thread\n\nnetlink_unicast() will attempt to reallocate and will free messages if\nthe socket\u0027s rcvbuf limit is reached unless we give it an infinite \ntimeout. So do that, from a kernel thread which is dedicated to spewing\nstuff up the netlink socket.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "168b7173959f80d20720dd1f7ec909a88ef2689d",
      "tree": "dc197062e11c003b330b5302535fd74407c2138b",
      "parents": [
        "209aba03243ee42a22f8df8d08aa9963f62aec64"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Thu May 19 10:24:22 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 19 10:24:22 2005 +0100"
      },
      "message": "AUDIT: Clean up logging of untrusted strings\n\n* If vsnprintf returns -1, it will mess up the sk buffer space accounting. \nThis is fixed by not calling skb_put with bogus len values.\n\n* audit_log_hex was a loop that called audit_log_vformat with %02X for each \ncharacter. This is very inefficient since conversion from unsigned character \nto Ascii representation is essentially masking, shifting, and byte lookups. \nAlso, the length of the converted string is well known - it\u0027s twice the \noriginal. Fixed by rewriting the function.\n\n* audit_log_untrustedstring had no comments. This makes it hard for \nsomeone to understand what the string format will be.\n\n* audit_log_d_path was never fixed to use untrustedstring. This could mess\nup user space parsers. This was fixed to make a temp buffer, call d_path, \nand log temp buffer using untrustedstring. \n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "209aba03243ee42a22f8df8d08aa9963f62aec64",
      "tree": "e45ee43e7af31f847377e8bb3a0a61581732b653",
      "parents": [
        "3ec3b2fba526ead2fa3f3d7c91924f39a0733749"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 18 10:21:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 18 10:21:07 2005 +0100"
      },
      "message": "AUDIT: Treat all user messages identically.\n\nIt\u0027s silly to have to add explicit entries for new userspace messages\nas we invent them. Just treat all messages in the user range the same.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5e014b10ef8477c32a939a48fa02aedcad35a226",
      "tree": "8c314b8485aff98506402976c3bca1011735a633",
      "parents": [
        "23f32d18aa589e228c5a9e12e0d0c67c9b5bcdce"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:50:33 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:50:33 2005 +0100"
      },
      "message": "AUDIT: fix max_t thinko.\n\nDer... if you use max_t it helps if you give it a type. \n\nNote to self: Always just apply the tested patches, don\u0027t try to port \nthem by hand. You\u0027re not clever enough.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "23f32d18aa589e228c5a9e12e0d0c67c9b5bcdce",
      "tree": "fa8e1156035b871d446cdf9706898b761d6455e0",
      "parents": [
        "c04049939f88b29e235d2da217bce6e8ead44f32"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 13 18:35:15 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:35:15 2005 +0100"
      },
      "message": "AUDIT: Fix some spelling errors\n\nI\u0027m going through the kernel code and have a patch that corrects \nseveral spelling errors in comments.\n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c04049939f88b29e235d2da217bce6e8ead44f32",
      "tree": "9bf3ab72b9939c529e7c96f8768bc8b7e1d768c9",
      "parents": [
        "9ea74f0655412d0fbd12bf9adb6c14c8fe707a42"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 13 18:17:42 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 18:17:42 2005 +0100"
      },
      "message": "AUDIT: Add message types to audit records\n\nThis patch adds more messages types to the audit subsystem so that audit \nanalysis is quicker, intuitive, and more useful.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n---\nI forgot one type in the big patch. I need to add one for user space \noriginating SE Linux avc messages. This is used by dbus and nscd.\n\n-Steve\n---\nUpdated to 2.6.12-rc4-mm1.\n-dwmw2\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "9ea74f0655412d0fbd12bf9adb6c14c8fe707a42",
      "tree": "8c04a9c6ed0144ff217b227fbf354f41dbceb023",
      "parents": [
        "add671412021b68c3b4f2882b0d10a56e2dcdabe"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 16:35:19 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 13 16:35:19 2005 +0100"
      },
      "message": "AUDIT: Round up audit skb expansion to AUDIT_BUFSIZ.\n\nOtherwise, we will be repeatedly reallocating, even if we\u0027re only\nadding a few bytes at a time. Pointed out by Steve Grubb.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c1b773d87eadc3972d697444127e89a7291769a2",
      "tree": "edfce2e842c3b6be70f3b90584507aab9fb3de8f",
      "parents": [
        "197c69c6afd2deb7eec44040ff533d90d26c6161"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:55:10 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:55:10 2005 +0100"
      },
      "message": "Add audit_log_type\n\nAdd audit_log_type to allow callers to specify type and pid when logging.\nConvert audit_log to wrapper around audit_log_type.  Could have\nconverted all audit_log callers directly, but common case is default\nof type AUDIT_KERNEL and pid 0.  Update audit_log_start to take type\nand pid values when creating a new audit_buffer.  Move sequences that\ndid audit_log_start, audit_log_format, audit_set_type, audit_log_end,\nto simply call audit_log_type directly.  This obsoletes audit_set_type\nand audit_set_pid, so remove them.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "197c69c6afd2deb7eec44040ff533d90d26c6161",
      "tree": "a44d7170fe20d6119eff6e656d39be623ed6131a",
      "parents": [
        "804a6a49d874841a98ebea3247ad2e672812ad6a"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:54:05 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:54:05 2005 +0100"
      },
      "message": "Move ifdef CONFIG_AUDITSYSCALL to header\n\nRemove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c.\nMove these dependencies to audit.h with the rest.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "804a6a49d874841a98ebea3247ad2e672812ad6a",
      "tree": "84bd717927666811d55f31346387f8cb99dff346",
      "parents": [
        "5a241d77039a2632e81070619d5733258728f8bd"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:52:45 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:52:45 2005 +0100"
      },
      "message": "Audit requires CONFIG_NET\n\nAudit now actually requires netlink.  So make it depend on CONFIG_NET, \nand remove the inline dependencies on CONFIG_NET.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5a241d77039a2632e81070619d5733258728f8bd",
      "tree": "c0f1b643144e5f53d619f22df6afb031ed0aef45",
      "parents": [
        "eecb0a7338ef6504aa49def4dde6429853025801"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Wed May 11 10:43:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Wed May 11 10:43:07 2005 +0100"
      },
      "message": "AUDIT: Properly account for alignment difference in nlmsg_len.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "eecb0a7338ef6504aa49def4dde6429853025801",
      "tree": "078561cbf3e1fb3d8f837a96f2a6d49d85c6819a",
      "parents": [
        "e3b926b4c1499ba7b1b9513aa6113944d572aba5"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:58:51 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:58:51 2005 +0100"
      },
      "message": "AUDIT: Fix abuse of va_args. \n\nWe\u0027re not allowed to use args twice; we need to use va_copy.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "e3b926b4c1499ba7b1b9513aa6113944d572aba5",
      "tree": "6d4a230f3c02ebfd5073517fe8eb36f9a61dad22",
      "parents": [
        "8c5aa40c94ef8bb7f7da95ecd5942e2d20fc3c9d"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:56:08 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:56:08 2005 +0100"
      },
      "message": "AUDIT: pass size argument to audit_expand().\n\nLet audit_expand() know how much it\u0027s expected to grow the buffer, in \nthe case that we have that information to hand.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "8c5aa40c94ef8bb7f7da95ecd5942e2d20fc3c9d",
      "tree": "8cda8d1193dfc814a724406cdd0479c7f46c0487",
      "parents": [
        "ea9c102cb0a7969df5733d34f26e0b12c8a3c889"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Tue May 10 18:53:07 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 10 18:53:07 2005 +0100"
      },
      "message": "AUDIT: Fix reported length of audit messages.\n\nWe were setting nlmsg_len to skb-\u003elen, but we should be subtracting\nthe size of the header.\n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "4332bdd332a2dca93dc3b1d017b2dd27d5c8cef3",
      "tree": "a1152698b795a215ec572942836be058ae65ef51",
      "parents": [
        "5ac52f33b6f05fcb91a97124155183b779a4efdf"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:59:57 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:59:57 2005 +0100"
      },
      "message": "AUDIT: Honour gfp_mask in audit_buffer_alloc()\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "5ac52f33b6f05fcb91a97124155183b779a4efdf",
      "tree": "9987d074c840a7afa731660400f4d5a8a8bad973",
      "parents": [
        "8fc6115c2a04099a6e846dc0b2d85cba43821b54"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:54:53 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:54:53 2005 +0100"
      },
      "message": "AUDIT: buffer audit msgs directly to skb\n\nDrop the use of a tmp buffer in the audit_buffer, and just buffer\ndirectly to the skb.  All header data that was temporarily stored in\nthe audit_buffer can now be stored directly in the netlink header in\nthe skb.  Resize skb as needed.  This eliminates the extra copy (and\nthe audit_log_move function which was responsible for copying).\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "8fc6115c2a04099a6e846dc0b2d85cba43821b54",
      "tree": "6dc6bf0f59f6ada9ed42c79b0e641f8668a9bf0b",
      "parents": [
        "16e1904e694d459ec2ca9b33c22b818eaaa4c63f"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:54:17 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:54:17 2005 +0100"
      },
      "message": "AUDIT: expand audit tmp buffer as needed\n\nIntroduce audit_expand and make the audit_buffer use a dynamic buffer\nwhich can be resized.  When audit buffer is moved to skb it will not\nbe fragmented across skb\u0027s, so we can eliminate the sklist in the\naudit_buffer.  During audit_log_move, we simply copy the full buffer\ninto a single skb, and then audit_log_drain sends it on.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "16e1904e694d459ec2ca9b33c22b818eaaa4c63f",
      "tree": "ca35b75b7d2e95b2ee11ba4b608549a5339b3cf0",
      "parents": [
        "c2f0c7c356dc9ae15419f00c725a2fcc58eeff58"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri May 06 15:53:34 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 15:53:34 2005 +0100"
      },
      "message": "AUDIT: Add helper functions to allocate and free audit_buffers.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c2f0c7c356dc9ae15419f00c725a2fcc58eeff58",
      "tree": "2b765b791115e0e85b45bc98800fd2650b23155b",
      "parents": [
        "2512809255d018744fe6c2f5e996c83769846c07"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri May 06 12:38:39 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri May 06 12:38:39 2005 +0100"
      },
      "message": "The attached patch addresses the problem with getting the audit daemon \nshutdown credential information. It creates a new message type \nAUDIT_TERM_INFO, which is used by the audit daemon to query who issued the \nshutdown. \n\nIt requires the placement of a hook function that gathers the information. The \nhook is after the DAC \u0026 MAC checks and before the function returns. Racing \nthreads could overwrite the uid \u0026 pid - but they would have to be root and \nhave policy that allows signalling the audit daemon. That should be a \nmanageable risk.\n\nThe userspace component will be released later in audit 0.7.2. When it \nreceives the TERM signal, it queries the kernel for shutdown information. \nWhen it receives it, it writes the message and exits. The message looks \nlike this:\n\ntype\u003dDAEMON msg\u003dauditd(1114551182.000) auditd normal halt, sending pid\u003d2650 \nuid\u003d525, auditd pid\u003d1685\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "bfd4bda097f8758d28e632ff2035e25577f6b060",
      "tree": "022276b3625a432c7132e39776e7e448445087ac",
      "parents": [
        "488f2eaca1b0831a5a5e6a66e33bad2cdeff7238",
        "b2d84f078a8be40f5ae3b4d2ac001e2a7f45fe4f"
      ],
      "author": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 05 13:59:37 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Thu May 05 13:59:37 2005 +0100"
      },
      "message": "Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git\n"
    },
    {
      "commit": "2a0a6ebee1d68552152ae8d4aeda91d806995dec",
      "tree": "a0b77861b3395b4728e75f2b2f92755e0a4777d3",
      "parents": [
        "96c36023434b7b6824b1da72a6b7b1ca61d7310c"
      ],
      "author": {
        "name": "Herbert Xu",
        "email": "herbert@gondor.apana.org.au",
        "time": "Tue May 03 14:55:09 2005 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue May 03 14:55:09 2005 -0700"
      },
      "message": "[NETLINK]: Synchronous message processing.\n\nLet\u0027s recap the problem.  The current asynchronous netlink kernel\nmessage processing is vulnerable to these attacks:\n\n1) Hit and run: Attacker sends one or more messages and then exits\nbefore they\u0027re processed.  This may confuse/disable the next netlink\nuser that gets the netlink address of the attacker since it may\nreceive the responses to the attacker\u0027s messages.\n\nProposed solutions:\n\na) Synchronous processing.\nb) Stream mode socket.\nc) Restrict/prohibit binding.\n\n2) Starvation: Because various netlink rcv functions were written\nto not return until all messages have been processed on a socket,\nit is possible for these functions to execute for an arbitrarily\nlong period of time.  If this is successfully exploited it could\nalso be used to hold rtnl forever.\n\nProposed solutions:\n\na) Synchronous processing.\nb) Stream mode socket.\n\nFirstly let\u0027s cross off solution c).  It only solves the first\nproblem and it has user-visible impacts.  In particular, it\u0027ll\nbreak user space applications that expect to bind or communicate\nwith specific netlink addresses (pid\u0027s).\n\nSo we\u0027re left with a choice of synchronous processing versus\nSOCK_STREAM for netlink.\n\nFor the moment I\u0027m sticking with the synchronous approach as\nsuggested by Alexey since it\u0027s simpler and I\u0027d rather spend\nmy time working on other things.\n\nHowever, it does have a number of deficiencies compared to the\nstream mode solution:\n\n1) User-space to user-space netlink communication is still vulnerable.\n\n2) Inefficient use of resources.  This is especially true for rtnetlink\nsince the lock is shared with other users such as networking drivers.\nThe latter could hold the rtnl while communicating with hardware which\ncauses the rtnetlink user to wait when it could be doing other things.\n\n3) It is still possible to DoS all netlink users by flooding the kernel\nnetlink receive queue.  The attacker simply fills the receive socket\nwith a single netlink message that fills up the entire queue.  The\nattacker then continues to call sendmsg with the same message in a loop.\n\nPoint 3) can be countered by retransmissions in user-space code, however\nit is pretty messy.\n\nIn light of these problems (in particular, point 3), we should implement\nstream mode netlink at some point.  In the mean time, here is a patch\nthat implements synchronous processing.  \n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "0dd8e06bdaa0a97e706ee1a489a1f6176c4ddc64",
      "tree": "f09181360e5b68d46ea2856c9fa63eaa3515080c",
      "parents": [
        "27b030d58c8e72fc7a95187a791bd9406e350f02"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Tue May 03 14:01:15 2005 +0100"
      },
      "committer": {
        "name": "David Woodhouse",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Tue May 03 14:01:15 2005 +0100"
      },
      "message": "[PATCH] add new audit data to last skb\n\nWhen adding more formatted audit data to an skb for delivery to userspace,\nthe kernel will attempt to reuse an skb that has spare room.  However, if\nthe audit message has already been fragmented to multiple skb\u0027s, the search\nfor spare room in the skb uses the head of the list.  This will corrupt the\naudit message with trailing bytes being placed midway through the stream.\nFix is to look at the end of the list.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "37509e749dc2072e667db806ef24b9e897f61b8a",
      "tree": "62e8c43ba360a9d0584822b06126284e4db428b8",
      "parents": [
        "c94c257c88c517f251da273a15c654224c7b6e21"
      ],
      "author": {
        "name": "Chris Wright",
        "email": "chrisw@osdl.org",
        "time": "Fri Apr 29 17:19:14 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 17:19:14 2005 +0100"
      },
      "message": "[AUDIT] Requeue messages at head of queue, up to audit_backlog\n\nIf netlink_unicast() fails, requeue the skb back at the head of the queue\nit just came from, instead of the tail. And do so unless we\u0027ve exceeded\nthe audit_backlog limit; not according to some other arbitrary limit.\n\nFrom: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "c94c257c88c517f251da273a15c654224c7b6e21",
      "tree": "992dd50f6bb13a70b04450cdfe0dbfb3c7b17ef5",
      "parents": [
        "85c8721ff3bc96b702427a440616079e8daf8a2f"
      ],
      "author": {
        "name": "Serge Hallyn",
        "email": "serue@us.ibm.com",
        "time": "Fri Apr 29 16:27:17 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:27:17 2005 +0100"
      },
      "message": "Add audit uid to netlink credentials\n\nMost audit control messages are sent over netlink.In order to properly\nlog the identity of the sender of audit control messages, we would like\nto add the loginuid to the netlink_creds structure, as per the attached\npatch.\n\nSigned-off-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "85c8721ff3bc96b702427a440616079e8daf8a2f",
      "tree": "1232ac4ebbd6d2453ee4d4a104003273ced20440",
      "parents": [
        "67eb81e1686f44bcf8f005b296213fd2c21b4719"
      ],
      "author": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:23:29 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:23:29 2005 +0100"
      },
      "message": "audit: update pointer to userspace tools, remove emacs mode tags\n"
    },
    {
      "commit": "c7fcb0ee74ef4cfdea02befacb55945c93641e44",
      "tree": "fbc01cfa85e2f7a3d070098e7d67d0196f52fa40",
      "parents": [
        "d812ddbb89e323d054a7d073466225966c8350c8"
      ],
      "author": {
        "name": "Peter Martuccelli",
        "email": "peterm@redhat.com",
        "time": "Fri Apr 29 16:10:24 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:10:24 2005 +0100"
      },
      "message": "[AUDIT] Avoid using %*.*s format strings.\n\nThey don\u0027t seem to work correctly (investigation ongoing), but we don\u0027t\nactually need to do it anyway.\n\nPatch from Peter Martuccelli \u003cpeterm@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "d812ddbb89e323d054a7d073466225966c8350c8",
      "tree": "469e3e7bb7d1ca450059fc1b45660b8bc6452dc7",
      "parents": [
        "2fd6f58ba6efc82ea2c9c2630f7ff5ed9eeaf34a"
      ],
      "author": {
        "name": "Steve Grubb",
        "email": "sgrubb@redhat.com",
        "time": "Fri Apr 29 16:09:52 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 16:09:52 2005 +0100"
      },
      "message": "[AUDIT] Fix signedness of \u0027serial\u0027 in various routines.\n\nAttached is a patch that corrects a signed/unsigned warning. I also noticed\nthat we needlessly init serial to 0. That only needs to occur if the kernel\nwas compiled without the audit system.\n\n-Steve Grubb\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "81b7854d52d35ed2353dd47033ae630d18322a2d",
      "tree": "9df2b6f7accc3a7f3bcee9af5493c0cdf6b1f140",
      "parents": [
        "83c7d09173fdb6b06b109e65895392db3e49ac9c"
      ],
      "author": {
        "name": "Andrew Morton",
        "email": "akpm@osdl.org",
        "time": "Fri Apr 29 15:59:11 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:59:11 2005 +0100"
      },
      "message": "audit_log_untrustedstring() warning fix\n\nkernel/audit.c: In function `audit_log_untrustedstring\u0027:\nkernel/audit.c:736: warning: comparison is always false due to limited range of data type\n\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "83c7d09173fdb6b06b109e65895392db3e49ac9c",
      "tree": "3f48367a4d1413e221a5367bcd0cf8df7322c368",
      "parents": [
        "c60c390620e0abb60d4ae8c43583714bda27763f"
      ],
      "author": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:54:44 2005 +0100"
      },
      "committer": {
        "name": "",
        "email": "dwmw2@shinybook.infradead.org",
        "time": "Fri Apr 29 15:54:44 2005 +0100"
      },
      "message": "AUDIT: Avoid log pollution by untrusted strings.\n\nWe log strings from userspace, such as arguments to open(). These could\nbe formatted to contain \\n followed by fake audit log entries. Provide\na function for logging such strings, which gives a hex dump when the\nstring contains anything but basic printable ASCII characters. Use it\nfor logging filenames.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n"
    },
    {
      "commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
      "tree": "0bba044c4ce775e45a88a51686b5d9f90697ea9d",
      "parents": [],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@ppc970.osdl.org",
        "time": "Sat Apr 16 15:20:36 2005 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@ppc970.osdl.org",
        "time": "Sat Apr 16 15:20:36 2005 -0700"
      },
      "message": "Linux-2.6.12-rc2\n\nInitial git repository build. I\u0027m not bothering with the full history,\neven though we have it. We can create a separate \"historical\" git\narchive of that later if we want to, and in the meantime it\u0027s about\n3.2GB when imported into git - space that would just make the early\ngit days unnecessarily complicated, when we don\u0027t have a lot of good\ninfrastructure for it.\n\nLet it rip!\n"
    }
  ]
}