- rel 2; by default audit was enabled but with zero rules. Now disable audit entirely...

diff --git a/audit.spec b/audit.spec
index 81ff7bb2b3f796323d85a2c8300fb0a7e969079f..4f40ec8a433752ac5a78d6fdf7f751b9d767e365 100644 (file)
--- a/audit.spec
+++ b/audit.spec
@@ -10,7 +10,7 @@ Summary:      User space tools for 2.6 kernel auditing
 Summary(pl.UTF-8):     Narzędzia przestrzeni użytkownika do audytu jąder 2.6
 Name:          audit
 Version:       2.4.1
-Release:       1
+Release:       2
 License:       GPL v2+
 Group:         Daemons
 Source0:       http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -26,6 +26,8 @@ Patch5:               %{name}-am.patch
 Patch6:                %{name}-no-refusemanualstop.patch
 Patch7:                %{name}-cronjob.patch
 Patch8:                golang-paths.patch
+# https://fedorahosted.org/fesco/ticket/1311
+Patch9:                never-audit.patch
 URL:           http://people.redhat.com/sgrubb/audit/
 BuildRequires: autoconf >= 2.59
 BuildRequires: automake >= 1:1.9
@@ -167,6 +169,7 @@ Pythonowy interfejs do biblioteki libaudit.
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
+%patch9 -p1
 
 %if %{without python}
 sed 's#swig/Makefile ##' -i configure.ac

diff --git a/never-audit.patch b/never-audit.patch
new file mode 100644 (file)
index 0000000..ee93620
--- /dev/null
+++ b/never-audit.patch
@@ -0,0 +1,17 @@
+diff -ur audit.orig/init.d/audit.rules audit/init.d/audit.rules
+--- audit.orig/init.d/audit.rules      2014-07-20 10:43:44.724841702 -0400
++++ audit/init.d/audit.rules   2014-07-22 14:55:50.856253189 -0400
+@@ -6,9 +6,8 @@
+ # First rule - delete all
+ -D
+ 
+-# Increase the buffers to survive stress events.
+-# Make this bigger for busy systems
+--b 320
+-
+-# Feel free to add below this line. See auditctl man page
++# This suppresses syscall auditing for all tasks started
++# with this rule in effect.  Remove it if you need syscall
++# auditing.
++-a task,never
+