20030829

 -	Added missing netlink message types to liblaussrv/print.c

 -	aucat properly displays results of create_module

 -	log sigaction etc with arguments

 -	etc/filter.conf syntax error fixed (LTC4105)

 -	fixed kernel bugs: LTC4131, LTC4120, LTC3614, LTC4083,
	LTC4080, LTC4066

20030822

 -	Fixed filtering of listen/connect and other socket calls

 -	Added filtering of user messages and login messages:

		predicate is-proc-exec = eq("PROC_execute");
		event user-message = is-proc-exec(event-name);

		event process-login = never;

	Note you cannot filter AUDIT_start and AUDIT_stop; these
	are generated by auditd and never pass the kernel filters.

 -	chroot should now generate correct records

 -	Added netlink related constants to filter.conf parser

 -	Updated audit-filter.conf.5 a little

20030815

 -	New kernel code to add better file matching support:
	 o	hard links to a file we monitor are detected
		(does not work for prefix matching, rendering it
		somewhat useless)
	 o	prevent race conditions by denying file system
	 	access while we're executing a system call that
		we are going to write a log entry for
 
 -	audit ruleset reload through "auditd -r"
 	(unlike restarting auditd, this does not lose any messages)

 -	Fixes to exit.c/fork.c to make UML work again

 -	various cleanups


20030808

 -	New kernel code: prevent tinkering with system call arguments
 	while we're inside the kernel (see drivers/audit/args.c)

 -	New kernel code: if we're unable to get the arguments of
 	a system call, kill the application. This is dicey, and
	doesn't work properly yet (e.g. ping 0 dies)

 -	support for filtering by login-uid

 -	we now create a symlink pointing to the current bin file

 -	major rewrite of binfile handling; we no longer clobber
	existing data when auditd restarts

 -	support for adding event names to filter rules. In filter.conf,
	simply add "tag foobar" in front of predicate, filter and syscall
	statements:

		tag "FILE_open" syscall "open" = ....;

 -	truncate64/ftruncate64 arguments should now be reported as a single
	64bit value rather than two longs on all platforms.

 -	New command "audbin" for bin file processing

 -	Detach audited processes when the module is unloaded, rather
	than when auditd exits. This also means that auditing will be
	inherited across fork() even when auditd is not running.

20030801

 -	another kernel API change (struct audit_filter now
 	uses to u_int64_t's instead of unsigned long, and
	has a new event name field)

 -	do not call audit module in exit() if we're not auditing
 	this task

 -	merged arch specific pieces of code. Still some way to
	go, esp with 32bit emulation on 64bit platforms (ioctl
	and data structure translation translation)
	The current patch is now patches/kernel/linux-audit_SP3.patch

 -	Lots of new pretty printing code in print.c

 -	New error handling in liblaus

 -	Now recording arguments for readv, writev, etc.

 -	Various minor buglets fixed

