[GIT PULL] Audit patches for 4.6

From: Paul Moore
Date: Thu Mar 17 2016 - 16:14:36 EST

Hi Linus,

A small set of patches for audit this time; just three in total and one is a
spelling fix. The two patches with actual content are designed to help
prevent new instances of auditd from displacing an existing, functioning
auditd and to generate a log of the attempt. Not to worry, dead/stuck auditd
instances can still be replaced by a new instance without problem.

Nothing controversial, and everything passes our regression suite; please pull
for Linux 4.6.


The following changes since commit cb74ed278f8054fddf79ed930495b9e214f7c7b2:

audit: always enable syscall auditing when supported and audit is enabled
(2016-01-13 09:18:55 -0500)

are available in the git repository at:

git://git.infradead.org/users/pcmoore/audit stable-4.6

for you to fetch changes up to fd97646b05957348e01be3d9de5c3d979b25c819:

audit: Fix typo in comment (2016-02-08 11:25:39 -0500)

Richard Guy Briggs (2):
audit: stop an old auditd being starved out by a new auditd
audit: log failed attempts to change audit_pid configuration

Wei Yuan (1):
audit: Fix typo in comment

include/uapi/linux/audit.h | 1 +
kernel/audit.c | 20 +++++++++++++++++++-
kernel/audit_watch.c | 2 +-
kernel/auditfilter.c | 6 +++---
4 files changed, 24 insertions(+), 5 deletions(-)

paul moore
security @ redhat