diff --git a/.audit.metadata b/.audit.metadata
new file mode 100644
index 0000000..a46f962
--- /dev/null
+++ b/.audit.metadata
@@ -0,0 +1 @@
+6968c30d9bb05d3f44413d1cd944ca8cbf3cf8c4 SOURCES/audit-3.0-alpha5.tar.gz
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..93992bf
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+SOURCES/audit-3.0-alpha5.tar.gz
diff --git a/SOURCES/audit-3.0-af_unix-plugin.patch b/SOURCES/audit-3.0-af_unix-plugin.patch
new file mode 100644
index 0000000..d0e0ce1
--- /dev/null
+++ b/SOURCES/audit-3.0-af_unix-plugin.patch
@@ -0,0 +1,244 @@
+diff -urp audit-3.0.orig/audisp/audispd-builtins.c audit-3.0/audisp/audispd-builtins.c
+--- audit-3.0.orig/audisp/audispd-builtins.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/audisp/audispd-builtins.c	2018-12-06 20:01:06.922443361 -0500
+@@ -35,12 +35,17 @@
+ #include <sys/uio.h> // writev
+ #include <fcntl.h>
+ #include <stdio.h>
++#include "ev.h"
+ #include "audispd-pconfig.h"
+ #include "audispd-builtins.h"
+ 
++// Global data
++extern struct ev_loop *loop;
++
+ // Local data
+ static volatile int sock = -1, conn = -1;
+ static char *path = NULL;
++static struct ev_io af_unix_watcher;
+ 
+ // Local prototypes
+ static void init_af_unix(const plugin_conf_t *conf);
+@@ -63,21 +68,37 @@ void stop_builtin(plugin_conf_t *conf)
+ 		syslog(LOG_ERR, "Unknown builtin %s", conf->path);
+ }
+ 
+-static void af_unix_accept(int fd)
++static int watching = 0;
++static void stop_watching(void)
++{
++	if (watching) {
++		ev_io_stop(loop, &af_unix_watcher);
++		watching = 0;
++	}
++}
++
++static void af_unix_accept(struct ev_loop *l, struct ev_io *_io, int revents)
+ {
+ 	int cmd;
+ 
+ 	do {
+-		conn = accept(fd, NULL, NULL);
++		conn = accept(_io->fd, NULL, NULL);
+ 	} while (conn < 0 && errno == EINTR);
+ 
+ 	// De-register since this is intended to be one listener
+ 	if (conn >= 0)
+-		remove_event(fd);
++		stop_watching();
+ 	cmd = fcntl(conn, F_GETFD);
+ 	fcntl(conn, F_SETFD, cmd|FD_CLOEXEC);
+ }
+ 
++static void start_watching(void)
++{
++	ev_io_init(&af_unix_watcher, af_unix_accept, sock, EV_READ);
++	ev_io_start(loop, &af_unix_watcher);
++	watching = 1;
++}
++
+ static int create_af_unix_socket(const char *path, int mode)
+ {
+ 	struct sockaddr_un addr;
+@@ -122,8 +143,8 @@ static int create_af_unix_socket(const c
+ 	// Make socket listening...won't block
+ 	(void)listen(sock, 5);
+ 
+-	// Register socket with poll
+-	add_event(sock, af_unix_accept);
++	// Register socket with libev
++	start_watching();
+ 	return 0;
+ }
+ 
+@@ -213,7 +234,8 @@ void send_af_unix_string(const char *s,
+ 		if (rc < 0 && errno == EPIPE) {
+ 			close(conn);
+ 			conn = -1;
+-			add_event(sock, af_unix_accept);
++			stop_watching();
++			start_watching();
+ 		}
+ 	} 
+ }
+@@ -237,7 +259,8 @@ void send_af_unix_binary(event_t *e)
+ 		if (rc < 0 && errno == EPIPE) {
+ 			close(conn);
+ 			conn = -1;
+-			add_event(sock, af_unix_accept);
++			stop_watching();
++			start_watching();
+ 		}
+ 	} 
+ }
+@@ -250,10 +273,13 @@ void destroy_af_unix(void)
+ 		conn = -1;
+ 		did_something = 1;
+ 	}
++	stop_watching();
+ 	if (sock >= 0) {
++
+ 		close(sock);
+ 		sock = -1;
+ 		did_something = 1;
++		
+ 	}
+ 	if (path) {
+ 		unlink(path);
+diff -urp audit-3.0.orig/audisp/audispd-builtins.h audit-3.0/audisp/audispd-builtins.h
+--- audit-3.0.orig/audisp/audispd-builtins.h	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/audisp/audispd-builtins.h	2018-12-06 20:01:06.922443361 -0500
+@@ -33,10 +33,5 @@ void send_af_unix_string(const char *s,
+ void send_af_unix_binary(event_t *e);
+ void destroy_af_unix(void);
+ 
+-typedef void (*poll_callback_ptr)(int fd);
+-int add_event(int fd, poll_callback_ptr cb);
+-int remove_event(int fd);
+-
+-
+ #endif
+ 
+diff -urp audit-3.0.orig/audisp/audispd.c audit-3.0/audisp/audispd.c
+--- audit-3.0.orig/audisp/audispd.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/audisp/audispd.c	2018-12-06 20:01:06.922443361 -0500
+@@ -31,7 +31,6 @@
+ #include <pthread.h>
+ #include <dirent.h>
+ #include <fcntl.h>
+-#include <sys/poll.h>
+ #include <netdb.h>
+ #include <arpa/inet.h>
+ #include <limits.h>
+@@ -578,43 +577,6 @@ static int event_loop(void)
+ 		return 1;
+ }
+ 
+-static struct pollfd pfd[4];
+-static poll_callback_ptr pfd_cb[4];
+-static volatile int pfd_cnt=0;
+-int add_event(int fd, poll_callback_ptr cb)
+-{
+-	if (pfd_cnt > 3)
+-		return -1;
+-
+-	pfd[pfd_cnt].fd = fd;
+-	pfd[pfd_cnt].events = POLLIN;
+-	pfd[pfd_cnt].revents = 0;
+-	pfd_cb[pfd_cnt] = cb;
+-	pfd_cnt++;
+-	return 0;
+-}
+-
+-int remove_event(int fd)
+-{
+-	int start, i;
+-	if (pfd_cnt == 0)
+-		return -1;
+-
+-	for (start=0; start < pfd_cnt; start++) {
+-		if (pfd[start].fd == fd)
+-			break;
+-	}
+-	for (i=start; i<(pfd_cnt-1); i++) {
+-		pfd[i].events = pfd[i+1].events;
+-		pfd[i].revents = pfd[i+1].revents;
+-		pfd[i].fd = pfd[i+1].fd;
+-		pfd_cb[i] = pfd_cb[i+1];
+-	}
+-
+-	pfd_cnt--;
+-	return 0;
+-}
+-
+ /* returns > 0 if plugins and 0 if none */
+ int libdisp_active(void)
+ {
+diff -urp audit-3.0.orig/audisp/Makefile.am audit-3.0/audisp/Makefile.am
+--- audit-3.0.orig/audisp/Makefile.am	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/audisp/Makefile.am	2018-12-06 20:01:06.922443361 -0500
+@@ -22,7 +22,7 @@
+ 
+ SUBDIRS = plugins 
+ CONFIG_CLEAN_FILES = *.rej *.orig
+-AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src
++AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src -I${top_srcdir}/src/libev
+ LIBS = -L${top_builddir}/lib -laudit 
+ LDADD = -lpthread
+ 
+@@ -30,5 +30,6 @@ noinst_HEADERS = audispd-pconfig.h audis
+ 	queue.h audispd-builtins.h libdisp.h
+ libdisp_a_SOURCES = audispd.c audispd-pconfig.c queue.c \
+ 	audispd-llist.c audispd-builtins.c
++libdisp_a_CFLAGS = -fno-strict-aliasing
+ noinst_LIBRARIES = libdisp.a
+ 
+diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
+--- audit-3.0.orig/src/auditd.c	2018-12-06 19:41:21.076570614 -0500
++++ audit-3.0/src/auditd.c	2018-12-06 20:01:06.923443360 -0500
+@@ -580,6 +580,7 @@ static void close_pipes(void)
+ 	close(pipefds[1]);
+ }
+ 
++struct ev_loop *loop;
+ int main(int argc, char *argv[])
+ {
+ 	struct sigaction sa;
+@@ -597,7 +598,6 @@ int main(int argc, char *argv[])
+ 	enum startup_state opt_startup = startup_enable;
+ 	extern char *optarg;
+ 	extern int optind;
+-	struct ev_loop *loop;
+ 	struct ev_io netlink_watcher;
+ 	struct ev_io pipe_watcher;
+ 	struct ev_signal sigterm_watcher;
+@@ -748,14 +748,6 @@ int main(int argc, char *argv[])
+ 		return 1;
+ 	}
+ 
+-	if (init_dispatcher(&config)) {
+-		if (pidfile)
+-			unlink(pidfile);
+-		tell_parent(FAILURE);
+-		free_config(&config);
+-		return 1;
+-	}
+-
+ 	/* Get machine name ready for use */
+ 	if (resolve_node(&config)) {
+ 		if (pidfile)
+@@ -891,6 +883,14 @@ int main(int argc, char *argv[])
+ 	/* Depending on value of opt_startup (-s) set initial audit state */
+ 	loop = ev_default_loop (EVFLAG_NOENV);
+ 
++	if (init_dispatcher(&config)) {
++		if (pidfile)
++			unlink(pidfile);
++		tell_parent(FAILURE);
++		free_config(&config);
++		return 1;
++	}
++
+ 	if (!opt_aggregate_only) {
+ 		ev_io_init (&netlink_watcher, netlink_handler, fd, EV_READ);
+ 		ev_io_start (loop, &netlink_watcher);
diff --git a/SOURCES/audit-3.0-auditd-stop.patch b/SOURCES/audit-3.0-auditd-stop.patch
new file mode 100644
index 0000000..bf28e7b
--- /dev/null
+++ b/SOURCES/audit-3.0-auditd-stop.patch
@@ -0,0 +1,12 @@
+diff -ur audit-3.0.orig/init.d/auditd.stop audit-3.0/init.d/auditd.stop
+--- audit-3.0.orig/init.d/auditd.stop	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/init.d/auditd.stop	2018-12-08 17:15:59.916950477 -0500
+@@ -10,7 +10,7 @@
+ . /etc/init.d/functions
+ 
+ printf "Stopping logging: "
+-killproc $prog -TERM
++killproc -d 1 $prog -TERM
+ RETVAL=$?
+ echo
+ exit $RETVAL
diff --git a/SOURCES/audit-3.0-ausearch-buffer-fix.patch b/SOURCES/audit-3.0-ausearch-buffer-fix.patch
new file mode 100644
index 0000000..b3cd57a
--- /dev/null
+++ b/SOURCES/audit-3.0-ausearch-buffer-fix.patch
@@ -0,0 +1,21 @@
+diff -urp audit-3.0.orig/src/ausearch-lol.c audit-3.0/src/ausearch-lol.c
+--- audit-3.0.orig/src/ausearch-lol.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/ausearch-lol.c	2018-12-06 19:38:21.208589916 -0500
+@@ -277,7 +277,7 @@ int lol_add_record(lol *lo, char *buff)
+ 			if (n.tlen > MAX_AUDIT_MESSAGE_LENGTH)
+ 				n.tlen = MAX_AUDIT_MESSAGE_LENGTH;
+ 		} else
+-			n.tlen = MAX_AUDIT_MESSAGE_LENGTH;
++			n.tlen = n.mlen;
+ 		fmt = LF_ENRICHED;
+ 	} else {
+ 		ptr = strrchr(n.message, 0x0a);
+@@ -287,7 +287,7 @@ int lol_add_record(lol *lo, char *buff)
+ 			if (n.mlen > MAX_AUDIT_MESSAGE_LENGTH)
+ 				n.mlen = MAX_AUDIT_MESSAGE_LENGTH;
+ 		} else
+-			n.mlen = MAX_AUDIT_MESSAGE_LENGTH;
++			n.mlen = strlen(n.message);
+ 		n.interp = NULL;
+ 		n.tlen = n.mlen;
+ 		fmt = LF_RAW;
diff --git a/SOURCES/audit-3.0-cap_audit_read.patch b/SOURCES/audit-3.0-cap_audit_read.patch
new file mode 100644
index 0000000..50565f8
--- /dev/null
+++ b/SOURCES/audit-3.0-cap_audit_read.patch
@@ -0,0 +1,12 @@
+diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
+--- audit-3.0.orig/src/auditd.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/auditd.c	2018-12-06 19:41:21.076570614 -0500
+@@ -665,7 +665,7 @@ int main(int argc, char *argv[])
+ #ifndef DEBUG
+ 	/* Make sure we can do our job. Containers may not give you
+ 	 * capabilities, so we revert to a uid check for that case. */
+-	if (!audit_can_control() || !audit_can_read()) {
++	if (!audit_can_control()) {
+ 		if (!config.local_events && geteuid() == 0)
+ 			;
+ 		else {
diff --git a/SOURCES/audit-3.0-docs.patch b/SOURCES/audit-3.0-docs.patch
new file mode 100644
index 0000000..ce0e40c
--- /dev/null
+++ b/SOURCES/audit-3.0-docs.patch
@@ -0,0 +1,104 @@
+diff -ur audit-3.0.orig/docs/auparse_normalize.3 audit-3.0/docs/auparse_normalize.3
+--- audit-3.0.orig/docs/auparse_normalize.3	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/docs/auparse_normalize.3	2018-12-06 19:27:33.636659407 -0500
+@@ -25,7 +25,8 @@
+ 
+ .SH "SEE ALSO"
+ 
+-.BR 
++.BR auparse_normalize_subject_primary (3) ,
++.BR auparse_normalize_object_primary (3).
+ 
+ .SH AUTHOR
+ Steve Grubb
+diff -ur audit-3.0.orig/rules/30-ospp-v42.rules audit-3.0/rules/30-ospp-v42.rules
+--- audit-3.0.orig/rules/30-ospp-v42.rules	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/rules/30-ospp-v42.rules	2018-12-06 19:27:33.656659405 -0500
+@@ -3,20 +3,28 @@
+ ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.
+ 
+ ## Unsuccessful file creation (open with O_CREAT)
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
++-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+ -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+ -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+ -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+ -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
+ 
+ ## Unsuccessful file modifications (open for write or truncate)
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
++-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+ -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+ -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+ -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
+@@ -47,16 +55,30 @@
+ -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+ 
+ ## User add delete modify. This is covered by pam. However, someone could
+-## open a file and directly create a user, so we'll watch passwd for writes
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
++## open a file and directly create or modify a user, so we'll watch passwd and
++## shadow for writes
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
++-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
+ 
+ ## User enable and disable. This is entirely handled by pam.
+ 
+ ## Group add delete modify. This is covered by pam. However, someone could
+-## open a file and directly create a user, so we'll watch group for writes
+--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
+--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
++## open a file and directly create or modify a user, so we'll watch group and
++## gshadow for writes
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
++-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
+ 
+ ## Use of special rights for config changes. This would be use of setuid
+ ## programs that relate to user accts. This is not all setuid apps because
+diff -ur audit-3.0.orig/rules/30-pci-dss-v31.rules audit-3.0/rules/30-pci-dss-v31.rules
+--- audit-3.0.orig/rules/30-pci-dss-v31.rules	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/rules/30-pci-dss-v31.rules	2018-12-06 19:27:33.656659405 -0500
+@@ -41,8 +41,8 @@
+ ##   ausearch --start today -m user_auth,user_chauthtok -i
+ 
+ ## 10.2.5.b All elevation of privileges is logged
+--a always,exit -F arch=b64 -S setuid -Fa0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
+--a always,exit -F arch=b32 -S setuid -Fa0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
++-a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
++-a always,exit -F arch=b32 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
+ -a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session
+ -a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session
+ -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=10.2.5.b-elevated-privs-setuid
diff --git a/SOURCES/audit-3.0-libev-remove-cold.patch b/SOURCES/audit-3.0-libev-remove-cold.patch
new file mode 100644
index 0000000..95241e5
--- /dev/null
+++ b/SOURCES/audit-3.0-libev-remove-cold.patch
@@ -0,0 +1,12 @@
+diff -urp audit-3.0.orig/src/libev/ev.c audit-3.0/src/libev/ev.c
+--- audit-3.0.orig/src/libev/ev.c	2019-01-03 12:25:16.000000000 -0500
++++ audit-3.0/src/libev/ev.c	2019-01-09 10:58:20.437560972 -0500
+@@ -901,7 +901,7 @@ typedef int ecb_bool;
+ #if ECB_GCC_VERSION(4,3)
+   #define ecb_artificial ecb_attribute ((__artificial__))
+   #define ecb_hot        ecb_attribute ((__hot__))
+-  #define ecb_cold       ecb_attribute ((__cold__))
++  #define ecb_cold
+ #else
+   #define ecb_artificial
+   #define ecb_hot
diff --git a/SOURCES/audit-3.0-network-orig-events.patch b/SOURCES/audit-3.0-network-orig-events.patch
new file mode 100644
index 0000000..b1f6a82
--- /dev/null
+++ b/SOURCES/audit-3.0-network-orig-events.patch
@@ -0,0 +1,232 @@
+diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
+--- audit-3.0.orig/src/auditd.c	2018-12-06 20:01:06.923443360 -0500
++++ audit-3.0/src/auditd.c	2018-12-06 20:17:19.030339043 -0500
+@@ -214,24 +214,35 @@ static void cont_handler(struct ev_loop
+ 
+ static int extract_type(const char *str)
+ {
+-	const char *tptr, *ptr2, *ptr = str;
++	char tmp, *ptr2, *ptr = str;
++	int type;
+ 	if (*str == 'n') {
+ 		ptr = strchr(str+1, ' ');
+ 		if (ptr == NULL)
+ 			return -1; // Malformed - bomb out
+ 		ptr++;
+ 	}
++
+ 	// ptr should be at 't'
+ 	ptr2 = strchr(ptr, ' ');
+-	// get type=xxx in a buffer
+-	tptr = strndupa(ptr, ptr2 - ptr);
++
+ 	// find =
+-	str = strchr(tptr, '=');
+-	if (str == NULL)
++	str = strchr(ptr, '=');
++	if (str == NULL || str >= ptr2)
+ 		return -1; // Malformed - bomb out
++
+ 	// name is 1 past
+ 	str++;
+-	return audit_name_to_msg_type(str);
++
++	// Save character & terminate string
++	tmp = *ptr2;
++	*ptr2 = 0;
++
++	type = audit_name_to_msg_type(str);
++
++	*ptr2 = tmp; // Restore character
++
++	return type;
+ }
+ 
+ void distribute_event(struct auditd_event *e)
+@@ -250,18 +261,22 @@ void distribute_event(struct auditd_even
+ 			route = 0;
+ 		else {	// We only need the original type if its being routed
+ 			e->reply.type = extract_type(e->reply.message);
+-			char *p = strchr(e->reply.message,
+-					AUDIT_INTERP_SEPARATOR);
+-			if (p)
+-				proto = AUDISP_PROTOCOL_VER2;
+-			else
+-				proto = AUDISP_PROTOCOL_VER;
+ 
++			// Treat everything from the network as VER2
++			// because they are already formatted. This is
++			// important when it gets to the dispatcher which
++			// can strip node= when its VER1.
++			proto = AUDISP_PROTOCOL_VER2;
+ 		}
+-	} else if (e->reply.type != AUDIT_DAEMON_RECONFIG)
+-		// All other events need formatting
++	} else if (e->reply.type != AUDIT_DAEMON_RECONFIG) {
++		// All other local events need formatting
+ 		format_event(e);
+-	else
++
++		// If the event has been formatted with node, upgrade
++		// to VER2 so that the dispatcher honors the formatting
++		if (config.node_name_format != N_NONE)
++			proto = AUDISP_PROTOCOL_VER2;
++	} else
+ 		route = 0; // Don't DAEMON_RECONFIG events until after enqueue
+ 
+ 	/* End of Event is for realtime interface - skip local logging of it */
+@@ -748,6 +763,17 @@ int main(int argc, char *argv[])
+ 		return 1;
+ 	}
+ 
++	/* Startup libev and dispatcher */
++	loop = ev_default_loop(EVFLAG_NOENV);
++	if (init_dispatcher(&config)) {
++		if (pidfile)
++			unlink(pidfile);
++		tell_parent(FAILURE);
++		free_config(&config);
++		ev_default_destroy();
++		return 1;
++	}
++
+ 	/* Get machine name ready for use */
+ 	if (resolve_node(&config)) {
+ 		if (pidfile)
+@@ -755,6 +781,7 @@ int main(int argc, char *argv[])
+ 		shutdown_dispatcher();
+ 		tell_parent(FAILURE);
+ 		free_config(&config);
++		ev_default_destroy();
+ 		return 1;
+ 	}
+ 
+@@ -766,6 +793,7 @@ int main(int argc, char *argv[])
+ 		shutdown_dispatcher();
+ 		tell_parent(FAILURE);
+ 		free_config(&config);
++		ev_default_destroy();
+ 		return 1;
+ 	}
+ 	fcntl(pipefds[0], F_SETFD, FD_CLOEXEC);
+@@ -785,6 +813,7 @@ int main(int argc, char *argv[])
+ 			tell_parent(FAILURE);
+ 			close_pipes();
+ 			free_config(&config);
++			ev_default_destroy();
+ 			return 1;
+ 		}
+ 		if (getsubj(subj))
+@@ -811,6 +840,7 @@ int main(int argc, char *argv[])
+ 			tell_parent(FAILURE);
+ 			close_pipes();
+ 			free_config(&config);
++			ev_default_destroy();
+ 			return 1;
+ 		}
+ 	}
+@@ -821,6 +851,7 @@ int main(int argc, char *argv[])
+ 	/* let config manager init */
+ 	init_config_manager();
+ 
++	/* Depending on value of opt_startup (-s) set initial audit state */
+ 	if (opt_startup != startup_nochange && !opt_aggregate_only &&
+ 			(audit_is_enabled(fd) < 2) &&
+ 			audit_set_enabled(fd, (int)opt_startup) < 0) {
+@@ -849,6 +880,7 @@ int main(int argc, char *argv[])
+ 		tell_parent(FAILURE);
+ 		close_pipes();
+ 		free_config(&config);
++		ev_default_destroy();
+ 		return 1;
+ 	}
+ 
+@@ -877,20 +909,11 @@ int main(int argc, char *argv[])
+ 		tell_parent(FAILURE);
+ 		close_pipes();
+ 		free_config(&config);
++		ev_default_destroy();
+ 		return 1;
+ 	}
+ 
+-	/* Depending on value of opt_startup (-s) set initial audit state */
+-	loop = ev_default_loop (EVFLAG_NOENV);
+-
+-	if (init_dispatcher(&config)) {
+-		if (pidfile)
+-			unlink(pidfile);
+-		tell_parent(FAILURE);
+-		free_config(&config);
+-		return 1;
+-	}
+-
++	/* Start up all the handlers */
+ 	if (!opt_aggregate_only) {
+ 		ev_io_init (&netlink_watcher, netlink_handler, fd, EV_READ);
+ 		ev_io_start (loop, &netlink_watcher);
+diff -urp audit-3.0.orig/src/auditd-dispatch.c audit-3.0/src/auditd-dispatch.c
+--- audit-3.0.orig/src/auditd-dispatch.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/auditd-dispatch.c	2018-12-06 20:17:09.769340037 -0500
+@@ -70,6 +70,7 @@ int dispatch_event(const struct audit_re
+ 	if (!libdisp_active())
+ 		return 0;
+ 
++	// Translate event into dispatcher format
+ 	e = malloc(sizeof(event_t));
+ 	if (e == NULL)
+ 		return -1;
+@@ -78,6 +79,7 @@ int dispatch_event(const struct audit_re
+ 	e->hdr.hlen = sizeof(struct audit_dispatcher_header);
+ 	e->hdr.type = rep->type;
+ 
++	// Network originating events have data at rep->message
+ 	if (protocol_ver == AUDISP_PROTOCOL_VER) {
+ 		e->hdr.size = rep->msg.nlh.nlmsg_len;
+ 		memcpy(e->data, (void*)rep->msg.data, e->hdr.size);
+diff -urp audit-3.0.orig/src/auditd-event.c audit-3.0/src/auditd-event.c
+--- audit-3.0.orig/src/auditd-event.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/auditd-event.c	2018-12-06 20:17:09.769340037 -0500
+@@ -225,8 +225,10 @@ static void replace_event_msg(struct aud
+ 			e->reply.message = strndup(buf, MAX_AUDIT_MESSAGE_LENGTH-1);
+ 			len = MAX_AUDIT_MESSAGE_LENGTH;
+ 		}
+-		e->reply.msg.nlh.nlmsg_len = e->reply.len;
+-		e->reply.len = len;
++		// For network originating events, len should be used
++		if (!from_network(e)) // V1 protocol msg size
++			e->reply.msg.nlh.nlmsg_len = e->reply.len;
++		e->reply.len = len; // V2 protocol msg size
+ 	}
+ }
+ 
+@@ -500,7 +502,7 @@ struct auditd_event *create_event(char *
+ 	e->sequence_id = sequence_id;
+ 
+ 	/* Network originating events need things adjusted to mimic netlink. */
+-	if (e->ack_func)
++	if (from_network(e))
+ 		replace_event_msg(e, msg);
+ 
+ 	return e;
+@@ -570,7 +572,7 @@ void handle_event(struct auditd_event *e
+ static void send_ack(const struct auditd_event *e, int ack_type,
+ 			const char *msg)
+ {
+-	if (e->ack_func) {
++	if (from_network(e)) {
+ 		unsigned char header[AUDIT_RMW_HEADER_SIZE];
+ 
+ 		AUDIT_RMW_PACK_HEADER(header, 0, ack_type, strlen(msg),
+diff -urp audit-3.0.orig/src/auditd-event.h audit-3.0/src/auditd-event.h
+--- audit-3.0.orig/src/auditd-event.h	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/auditd-event.h	2018-12-06 20:17:09.769340037 -0500
+@@ -36,6 +36,9 @@ struct auditd_event {
+ 	unsigned long sequence_id;
+ };
+ 
++static inline int from_network(const struct auditd_event *e) 
++{ if (e && e->ack_func) return 1; return 0; };
++
+ #include "auditd-config.h"
+ 
+ int dispatch_network_events(void);
diff --git a/SOURCES/audit-3.0-queue-report.patch b/SOURCES/audit-3.0-queue-report.patch
new file mode 100644
index 0000000..31f62c9
--- /dev/null
+++ b/SOURCES/audit-3.0-queue-report.patch
@@ -0,0 +1,21 @@
+diff -urp audit-3.0.orig/audisp/queue.c audit-3.0/audisp/queue.c
+--- audit-3.0.orig/audisp/queue.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/audisp/queue.c	2018-12-06 20:21:22.184312950 -0500
+@@ -231,11 +231,12 @@ void increase_queue_depth(unsigned int s
+ 
+ void write_queue_state(FILE *f)
+ {
+-	fprintf(f, "current queue depth = %u\n", currently_used);
+-	fprintf(f, "max queue depth used = %u\n", max_used);
+-	fprintf(f, "queue size = %u\n", q_depth);
+-	fprintf(f, "queue overflow detected = %s\n",overflowed ? "yes" : "no");
+-	fprintf(f, "queueing suspended = %s\n",
++	fprintf(f, "current plugin queue depth = %u\n", currently_used);
++	fprintf(f, "max plugin queue depth used = %u\n", max_used);
++	fprintf(f, "plugin queue size = %u\n", q_depth);
++	fprintf(f, "plugin queue overflow detected = %s\n",
++				overflowed ? "yes" : "no");
++	fprintf(f, "plugin queueing suspended = %s\n",
+ 				processing_suspended ? "yes" : "no");
+ }
+ 
diff --git a/SOURCES/audit-3.0-user_avc.patch b/SOURCES/audit-3.0-user_avc.patch
new file mode 100644
index 0000000..f364111
--- /dev/null
+++ b/SOURCES/audit-3.0-user_avc.patch
@@ -0,0 +1,97 @@
+diff -ur audit-3.0.orig/src/aureport-options.c audit-3.0/src/aureport-options.c
+--- audit-3.0.orig/src/aureport-options.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/aureport-options.c	2018-12-06 19:31:26.945634371 -0500
+@@ -85,7 +85,8 @@
+ 	R_AVCS, R_SYSCALLS, R_PIDS, R_EVENTS, R_ACCT_MODS,  
+ 	R_INTERPRET, R_HELP, R_ANOMALY, R_RESPONSE, R_SUMMARY_DET, R_CRYPTO,
+ 	R_MAC, R_FAILED, R_SUCCESS, R_ADD, R_DEL, R_AUTH, R_NODE, R_IN_LOGS,
+-	R_KEYS, R_TTY, R_NO_CONFIG, R_COMM, R_VIRT, R_INTEG, R_ESCAPE };
++	R_KEYS, R_TTY, R_NO_CONFIG, R_COMM, R_VIRT, R_INTEG, R_ESCAPE,
++	R_DEBUG };
+ 
+ static struct nv_pair optiontab[] = {
+ 	{ R_AUTH, "-au" },
+@@ -98,6 +99,7 @@
+ 	{ R_CONFIGS, "--config" },
+ 	{ R_CRYPTO, "-cr" },
+ 	{ R_CRYPTO, "--crypto" },
++	{ R_DEBUG, "--debug" },
+ 	{ R_DEL, "--delete" },
+ 	{ R_EVENTS, "-e" },
+ 	{ R_EVENTS, "--event" },
+@@ -731,6 +733,9 @@
+ 		case R_DEL:
+ 			event_conf_act = C_DEL;
+ 			break;
++		case R_DEBUG:
++			event_debug = 1;
++			break;
+ 		case R_IN_LOGS:
+ 			force_logs = 1;
+ 			break;
+diff -ur audit-3.0.orig/src/ausearch-parse.c audit-3.0/src/ausearch-parse.c
+--- audit-3.0.orig/src/ausearch-parse.c	2018-08-31 17:05:48.000000000 -0400
++++ audit-3.0/src/ausearch-parse.c	2018-12-06 19:31:26.945634371 -0500
+@@ -102,7 +102,8 @@
+ 				ret = parse_path(n, s);
+ 				break;
+ 			case AUDIT_USER:
+-			case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
++			case AUDIT_FIRST_USER_MSG...AUDIT_USER_END:
++			case AUDIT_USER_CHAUTHTOK...AUDIT_LAST_USER_MSG:
+ 			case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
+ 				ret = parse_user(n, s);
+ 				break;
+@@ -136,6 +137,7 @@
+ 				avc_parse_path(n, s);
+ 				break;
+ 			case AUDIT_AVC:
++			case AUDIT_USER_AVC:
+ 				ret = parse_avc(n, s);
+ 				break;
+ 			case AUDIT_NETFILTER_PKT:
+@@ -1867,6 +1869,20 @@
+ 		*term = ' ';
+ 	}
+ 
++	// User AVC's are not formatted like a kernel AVC
++	if (n->type == AUDIT_USER_AVC) {
++		rc = parse_user(n, s);
++		if (rc > 20)
++			rc = 0;
++		if (audit_avc_init(s) == 0) {
++			alist_append(s->avc, &an);
++		} else {
++			rc = 10;
++			goto err;
++		}
++		return rc;
++	}
++
+ 	// get pid
+ 	if (event_pid != -1) {
+ 		str = strstr(term, "pid=");
+diff -urp audit-3.0.orig/src/ausearch-parse.c audit-3.0/src/ausearch-parse.c
+--- audit-3.0.orig/src/ausearch-parse.c	2018-10-03 19:46:52.000000000 -0400
++++ audit-3.0/src/ausearch-parse.c	2018-12-08 15:48:54.350009208 -0500
+@@ -1839,8 +1839,10 @@ static int parse_avc(const lnode *n, sea
+ 	if (str) {
+ 		str += 5;
+ 		term = strchr(str, '{');
+-		if (term == NULL)
+-			return 1;
++		if (term == NULL) {
++			term = n->message;
++			goto other_avc;
++		}
+ 		if (event_success != S_UNSET) {
+ 			*term = 0;
+ 			// FIXME. Do not override syscall success if already
+@@ -1869,6 +1871,7 @@ static int parse_avc(const lnode *n, sea
+ 		*term = ' ';
+ 	}
+ 
++other_avc:
+ 	// User AVC's are not formatted like a kernel AVC
+ 	if (n->type == AUDIT_USER_AVC) {
+ 		rc = parse_user(n, s);
diff --git a/SOURCES/lgpl-2.1.txt b/SOURCES/lgpl-2.1.txt
new file mode 100644
index 0000000..4362b49
--- /dev/null
+++ b/SOURCES/lgpl-2.1.txt
@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/SPECS/audit.spec b/SPECS/audit.spec
new file mode 100644
index 0000000..174a79e
--- /dev/null
+++ b/SPECS/audit.spec
@@ -0,0 +1,500 @@
+%{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
+
+Summary: User space tools for 2.6 kernel auditing
+Name: audit
+Version: 3.0
+Release: 0.10.20180831git0047a6c%{?dist}
+License: GPLv2+
+URL: http://people.redhat.com/sgrubb/audit/
+Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}-alpha5.tar.gz
+Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
+# Update documentation and rules
+Patch1: audit-3.0-docs.patch
+# 1628626 - lightly parse USER_AVC events
+Patch2: audit-3.0-user_avc.patch
+# Fix a buffer length calculation in ausearch
+Patch3: audit-3.0-ausearch-buffer-fix.patch
+# Remove CAP_AUDIT_READ from daemon permission checks
+Patch4: audit-3.0-cap_audit_read.patch
+# Port af_unix plugin to libev
+Patch5: audit-3.0-af_unix-plugin.patch
+# Make all network originating events VER2 dispatcher protocol
+Patch6: audit-3.0-network-orig-events.patch
+# Adjust state report for plugin queue
+Patch7: audit-3.0-queue-report.patch
+# 1643567 - auditd wasn't quite stopped when it was supposed to be
+Patch8: audit-3.0-auditd-stop.patch
+# In libev, cold functions cause annocheck failures. Remove them.
+Patch9: audit-3.0-libev-remove-cold.patch
+# Next BuildRequires is only needed for the patching - remove in the future
+BuildRequires: autoconf automake
+
+BuildRequires: gcc swig
+BuildRequires: openldap-devel
+BuildRequires: krb5-devel libcap-ng-devel
+BuildRequires: kernel-headers >= 2.6.29
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+BuildRequires: systemd
+Requires(post): systemd coreutils
+Requires(preun): systemd
+Requires(postun): systemd coreutils
+
+%description
+The audit package contains the user space utilities for
+storing and searching the audit records generated by
+the audit subsystem in the Linux 2.6 and later kernels.
+
+%package libs
+Summary: Dynamic library for libaudit
+License: LGPLv2+
+
+%description libs
+The audit-libs package contains the dynamic libraries needed for 
+applications to use the audit framework.
+
+%package libs-devel
+Summary: Header files for libaudit
+License: LGPLv2+
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires: kernel-headers >= 2.6.29
+
+%description libs-devel
+The audit-libs-devel package contains the header files needed for
+developing applications that need to use the audit framework libraries.
+
+%package -n python3-audit
+Summary: Python3 bindings for libaudit
+License: LGPLv2+
+BuildRequires: python3-devel
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Provides: audit-libs-python3 = %{version}-%{release}
+Provides: audit-libs-python3%{?_isa} = %{version}-%{release}
+Obsoletes: audit-libs-python3 < %{version}-%{release}
+
+%description -n python3-audit
+The python3-audit package contains the bindings so that libaudit
+and libauparse can be used by python3.
+
+%package -n audispd-plugins
+Summary: Plugins for the audit event dispatcher
+License: GPLv2+
+Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+
+%description -n audispd-plugins
+The audispd-plugins package provides plugins for the real-time
+interface to the audit system, audispd. These plugins can do things
+like relay events to remote machines.
+
+%package -n audispd-plugins-zos
+Summary: z/OS plugin for the audit event dispatcher
+License: GPLv2+
+Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires: openldap
+
+%description -n audispd-plugins-zos
+The audispd-plugins-zos package provides a plugin that will forward all
+incoming audit events, as they happen, to a configured z/OS SMF (Service
+Management Facility) database, through an IBM Tivoli Directory Server
+(ITDS) set for Remote Audit service.
+
+%enable_gotoolset7
+
+%prep
+%setup -q
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1
+%patch9 -p1
+cp %{SOURCE1} .
+autoreconf
+
+%build
+%configure --sbindir=/sbin --libdir=/%{_lib} --with-python=no \
+           --with-python3=yes \
+	   --enable-gssapi-krb5=yes --with-arm --with-aarch64 \
+	   --with-libcap-ng=yes --enable-zos-remote \
+           --enable-systemd
+
+make CFLAGS="%{optflags}" %{?_smp_mflags}
+
+%install
+mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audit/plugins.d,etc/audit/rules.d}
+mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
+mkdir -p $RPM_BUILD_ROOT/%{_lib}
+mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
+mkdir -p --mode=0700 $RPM_BUILD_ROOT/%{_var}/log/audit
+mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit
+make DESTDIR=$RPM_BUILD_ROOT install
+
+mkdir -p $RPM_BUILD_ROOT/%{_libdir}
+curdir=`pwd`
+cd $RPM_BUILD_ROOT/%{_libdir}
+LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.1.*.*\``
+ln -s ../../%{_lib}/$LIBNAME libaudit.so
+LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.0.*.*\``
+ln -s ../../%{_lib}/$LIBNAME libauparse.so
+cd $curdir
+# Remove these items so they don't get picked up.
+rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
+rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
+rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.a
+rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.a
+
+find $RPM_BUILD_ROOT -name '*.la' -delete
+find $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages -name '*.a' -delete
+
+# Move the pkgconfig file
+mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
+
+# On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
+touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
+touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
+
+%check
+make check
+# Get rid of make files so that they don't get packaged.
+rm -f rules/Makefile*
+
+%post
+# Copy default rules into place on new installation
+files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
+if [ "$files" -eq 0 ] ; then
+  if [ -e /usr/share/doc/audit/rules/10-base-config.rules ] ; then
+    cp /usr/share/doc/audit/rules/10-base-config.rules /etc/audit/rules.d/audit.rules
+  else
+    touch /etc/audit/rules.d/audit.rules
+  fi
+  chmod 0600 /etc/audit/rules.d/audit.rules
+fi
+%systemd_post auditd.service
+
+%preun
+%systemd_preun auditd.service
+
+%postun
+if [ $1 -ge 1 ]; then
+   /sbin/service auditd condrestart > /dev/null 2>&1 || :
+fi
+
+%files libs
+%{!?_licensedir:%global license %%doc}
+%license lgpl-2.1.txt
+/%{_lib}/libaudit.so.1*
+/%{_lib}/libauparse.*
+%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
+%{_mandir}/man5/libaudit.conf.5.gz
+
+%files libs-devel
+%doc contrib/plugin
+%{_libdir}/libaudit.so
+%{_libdir}/libauparse.so
+%{_includedir}/libaudit.h
+%{_includedir}/auparse.h
+%{_includedir}/auparse-defs.h
+%{_datadir}/aclocal/audit.m4
+%{_libdir}/pkgconfig/audit.pc
+%{_libdir}/pkgconfig/auparse.pc
+%{_mandir}/man3/*
+
+%files -n python3-audit
+%attr(755,root,root) %{python3_sitearch}/*
+
+%files
+%doc README ChangeLog rules init.d/auditd.cron
+%{!?_licensedir:%global license %%doc}
+%license COPYING
+%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
+%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
+%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
+%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
+%attr(644,root,root) %{_mandir}/man8/autrace.8.gz
+%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
+%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
+%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
+%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
+%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
+%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
+%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
+%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
+%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
+%attr(755,root,root) /sbin/auditctl
+%attr(755,root,root) /sbin/auditd
+%attr(755,root,root) /sbin/ausearch
+%attr(755,root,root) /sbin/aureport
+%attr(750,root,root) /sbin/autrace
+%attr(750,root,root) /sbin/augenrules
+%attr(755,root,root) %{_bindir}/aulast
+%attr(755,root,root) %{_bindir}/aulastlog
+%attr(755,root,root) %{_bindir}/ausyscall
+%attr(755,root,root) %{_bindir}/auvirt
+%attr(644,root,root) %{_unitdir}/auditd.service
+%attr(750,root,root) %dir %{_libexecdir}/initscripts/legacy-actions/auditd
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/condrestart
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/reload
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/restart
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/resume
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/rotate
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/state
+%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/stop
+%ghost %{_localstatedir}/run/auditd.state
+%attr(750,root,root) %dir %{_var}/log/audit
+%attr(750,root,root) %dir /etc/audit
+%attr(750,root,root) %dir /etc/audit/rules.d
+%attr(750,root,root) %dir /etc/audit/plugins.d
+%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
+%ghost %config(noreplace) %attr(600,root,root) /etc/audit/rules.d/audit.rules
+%ghost %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
+%config(noreplace) %attr(640,root,root) /etc/audit/audit-stop.rules
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/af_unix.conf
+
+%files -n audispd-plugins
+%config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-remote.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
+%attr(750,root,root) /sbin/audisp-remote
+%attr(750,root,root) /sbin/audisp-syslog
+%attr(700,root,root) %dir %{_var}/spool/audit
+%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
+%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
+%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz
+
+%files -n audispd-plugins-zos
+%attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
+%attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/audispd-zos-remote.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/zos-remote.conf
+%attr(750,root,root) /sbin/audispd-zos-remote
+
+%changelog
+* Wed Jan 09 2019 Steve Grubb <sgrubb@redhat.com> 3.0-0.10.20180831git0047a6c
+resolves: rhbz#1655270] Message "audit: backlog limit exceeded" reported
+- Fix annobin failure
+
+* Fri Dec 07 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.8.20180831git0047a6c
+resolves: rhbz#1639745 - build requires go-toolset-7 which is not available
+resolves: rhbz#1643567 - service auditd stop exits prematurely
+resolves: rhbz#1616428 - Update git snapshot of audit package
+- Remove static libs subpackage
+
+* Fri Aug 31 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.5.20180831git0047a6c
+resolves: rhbz#1616428 - Update git snapshot of audit package
+
+* Wed Aug 08 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.2.20180808git77fbcf3
+resolves: rhbz#1567357 New upstream feature prerelease
+
+* Tue Jul 17 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.1.20180717gitacd53d1
+- New upstream feature prerelease
+
+* Tue Jun 26 2018 Steve Grubb <sgrubb@redhat.com> 2.8.4-2
+- Fix segfault on shutdown
+
+* Tue Jun 19 2018 Steve Grubb <sgrubb@redhat.com> 2.8.4-1
+- New upstream bugfix release
+
+* Wed May 30 2018 Steve Grubb <sgrubb@redhat.com> 2.8.3-1
+- New upstream bugfix release
+- Remove Python2 support
+
+* Fri Apr 13 2018 Tom Stellard <tstellar@redhat.com> - 2.7.8-2
+- Use go-toolset-7 instead of golang
+- Package now must be built with: rhpkg --release rhel-8.0-go-toolset
+
+* Mon Sep 18 2017 Steve Grubb <sgrubb@redhat.com> 2.7.8-1
+- New upstream bugfix release
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.7-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Jul 14 2017 Steve Grubb <sgrubb@redhat.com> 2.7.7-3
+- undo scratch build
+
+* Fri Jun 16 2017 Steve Grubb <sgrubb@redhat.com> 2.7.7-1
+- New upstream bugfix release
+
+* Wed Apr 19 2017 Steve Grubb <sgrubb@redhat.com> 2.7.6-1
+- New upstream bugfix release
+
+* Mon Apr 10 2017 Steve Grubb <sgrubb@redhat.com> 2.7.5-1
+- New upstream bugfix release
+
+* Tue Mar 28 2017 Steve Grubb <sgrubb@redhat.com> 2.7.4-1
+- New upstream feature and bugfix release
+
+* Fri Feb 24 2017 Steve Grubb <sgrubb@redhat.com> 2.7.3-1
+- New upstream feature and bugfix release
+
+* Mon Feb 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.2-2
+- Fix ausearch csv output
+
+* Mon Feb 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.2-1
+- New upstream feature and bugfix release
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Fri Jan 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.1-1
+- New upstream bugfix release
+
+* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 2.7-2
+- Rebuild for Python 3.6
+
+* Thu Dec 15 2016 Steve Grubb <sgrubb@redhat.com> 2.7-1
+- New upstream feature release
+
+* Sun Sep 11 2016 Steve Grubb <sgrubb@redhat.com> 2.6.7-1
+- New upstream bugfix release
+
+* Mon Aug 01 2016 Steve Grubb <sgrubb@redhat.com> 2.6.6-1
+- New upstream bugfix release
+
+* Thu Jul 21 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6.5-3
+- https://fedoraproject.org/wiki/Changes/golang1.7
+
+* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6.5-2
+- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
+
+* Thu Jul 14 2016 Steve Grubb <sgrubb@redhat.com> 2.6.5-1
+- New upstream bugfix release
+
+* Fri Jul 08 2016 Steve Grubb <sgrubb@redhat.com> 2.6.4-2
+- Correct size information of dispatched event
+
+* Fri Jul 08 2016 Steve Grubb <sgrubb@redhat.com> 2.6.4-1
+- New upstream bugfix release
+
+* Tue Jul 05 2016 Steve Grubb <sgrubb@redhat.com> 2.6.3-2
+- Fix sockaddr event interpretation
+
+* Tue Jul 05 2016 Steve Grubb <sgrubb@redhat.com> 2.6.3-1
+- New upstream bugfix release
+
+* Fri Jul 01 2016 Steve Grubb <sgrubb@redhat.com> 2.6.2-1
+- New upstream bugfix release
+- Fixes 1351954 - prevents virtual machine from starting up in GNOME Boxes
+
+* Tue Jun 28 2016 Steve Grubb <sgrubb@redhat.com> 2.6.1-1
+- New upstream bugfix release
+
+* Wed Jun 22 2016 Steve Grubb <sgrubb@redhat.com> 2.6-3
+- New upstream release
+
+* Fri Apr 29 2016 Steve Grubb <sgrubb@redhat.com> 2.5.2-1
+- New upstream release
+
+* Thu Apr 28 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-2
+- Refactor plugins to split out zos-remote to lower dependencies
+
+* Wed Apr 13 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-1
+- New upstream release
+
+* Fri Mar 18 2016 Steve Grubb <sgrubb@redhat.com> 2.5-4
+- Fixes #1313152 - post script fails on dnf --setopt=tsflags=nodocs install
+
+* Mon Feb 22 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.5-3
+- https://fedoraproject.org/wiki/Changes/golang1.6
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Mon Jan 11 2016 Steve Grubb <sgrubb@redhat.com> 2.5-1
+- New upstream release
+- Fixes #1241565 - still logs way too much
+- Fixes #1238051 - audit.rules should be generated from by augenrules
+
+* Fri Dec 18 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
+- New upstream bugfix release
+
+* Wed Nov 04 2015 Robert Kuska <rkuska@redhat.com> - 2.4.4-3
+- Rebuilt for Python3.5 rebuild
+
+* Wed Sep 16 2015 Peter Robinson <pbrobinson@fedoraproject.org> 2.4.4-2
+- Fix FTBFS with hardened flags by using the distro CFLAGS
+- Tighten deps with the _isa macro
+- Use goarches macro to define supported GO architectures
+- Minor cleanups
+
+* Thu Aug 13 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
+- New upstream bugfix release
+- Fixes CVE-2015-5186 Audit: log terminal emulator escape sequences handling
+
+* Thu Jul 16 2015 Steve Grubb <sgrubb@redhat.com> 2.4.3-1
+- New upstream bugfix release
+- Adds python3 support
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue Apr 28 2015 Steve Grubb <sgrubb@redhat.com> 2.4.2-1
+- New upstream bugfix release
+
+* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.4.1-2
+- Rebuilt for Fedora 23 Change
+  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
+
+* Tue Oct 28 2014 Steve Grubb <sgrubb@redhat.com> 2.4.1-1
+- New upstream feature and bugfix release
+
+* Mon Oct 06 2014 Karsten Hopp <karsten@redhat.com> 2.4-2
+- bump release and rebuild for upgradepath
+
+* Sun Aug 24 2014 Steve Grubb <sgrubb@redhat.com> 2.4-1
+- New upstream feature and bugfix release
+
+* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.8-0.3.svn20140803
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Mon Aug  4 2014 Peter Robinson <pbrobinson@fedoraproject.org> 2.3.8-0.2.svn20140803
+- aarch64/PPC/s390 don't have golang
+
+* Sat Aug 02 2014 Steve Grubb <sgrubb@redhat.com> 2.3.8-0.1.svn20140803
+- New upstream svn snapshot
+
+* Tue Jul 22 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-4
+- Bug 1117953 - Per fesco#1311, please disable syscall auditing by default
+
+* Fri Jul 11 2014 Tom Callaway <spot@fedoraproject.org> - 2.3.7-3
+- mark license files properly
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Tue Jun 03 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-1
+- New upstream bugfix release
+
+* Fri Apr 11 2014 Steve Grubb <sgrubb@redhat.com> 2.3.6-1
+- New upstream bugfix/enhancement release
+
+* Mon Mar 17 2014 Steve Grubb <sgrubb@redhat.com> 2.3.5-1
+- New upstream bugfix/enhancement release
+
+* Thu Feb 27 2014 Steve Grubb <sgrubb@redhat.com> 2.3.4-1
+- New upstream bugfix/enhancement release
+
+* Thu Jan 16 2014 Steve Grubb <sgrubb@redhat.com> 2.3.3-1
+- New upstream bugfix/enhancement release
+
+* Mon Jul 29 2013 Steve Grubb <sgrubb@redhat.com> 2.3.2-1
+- New upstream bugfix/enhancement release
+
+* Fri Jun 21 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-3
+- Drop prelude support
+
+* Fri May 31 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-2
+- Fix unknown lvalue in auditd.service (#969345)
+
+* Thu May 30 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-1
+- New upstream bugfix/enhancement release
+
+* Fri May 03 2013 Steve Grubb <sgrubb@redhat.com> 2.3-2
+- If no rules exist, copy shipped rules into place
+