Only in aide-0.12_rc1: autom4te.cache
diff -rup aide-0.12_rc1-orig/config.h.in aide-0.12_rc1/config.h.in
--- aide-0.12_rc1-orig/config.h.in	2006-10-12 15:07:27.000000000 -0400
+++ aide-0.12_rc1/config.h.in	2006-10-12 15:22:46.000000000 -0400
@@ -252,6 +252,9 @@
 /* Define to 1 if you have the <zlib.h> header file. */
 #undef HAVE_ZLIB_H
 
+/* use audit system */
+#undef WITH_AUDIT
+
 /* send errors to stderr */
 #undef INITIALERRORSTO
 
diff -rup aide-0.12_rc1-orig/configure.in aide-0.12_rc1/configure.in
--- aide-0.12_rc1-orig/configure.in	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/configure.in	2006-10-12 15:22:46.000000000 -0400
@@ -729,6 +729,22 @@ AC_ARG_WITH(psql,
 
 AC_SUBST(PSQLLIB)
 
+
+# Check for Linux auditing API
+#
+AC_ARG_WITH(audit,
+       AC_HELP_STRING([--with-audit],
+               [use audit library]),
+       [AC_DEFINE(WITH_AUDIT,1,[use audit library])
+       AC_CHECK_HEADER(libaudit.h,,
+               AC_MSG_ERROR(You don't have libaudit properly installed. Install it if you need one.)
+       )
+       AUDITLIB="-laudit"
+       compoptionstring="${compoptionstring}WITH_AUDIT\\n"],
+       [with_audit=no]
+)
+AC_SUBST(AUDITLIB)
+
 AIDE_DO_LINK_FILES
 
 compoptionstring="${compoptionstring}CONFIG_FILE = \\\"${config_file}\\\"\\n"
Only in aide-0.12_rc1: configure.in.audit
diff -rup aide-0.12_rc1-orig/doc/Makefile.in aide-0.12_rc1/doc/Makefile.in
--- aide-0.12_rc1-orig/doc/Makefile.in	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/doc/Makefile.in	2006-10-12 15:24:55.000000000 -0400
@@ -78,6 +78,7 @@ AIDE_USE_LOCALE = @AIDE_USE_LOCALE@
 AMDEP_FALSE = @AMDEP_FALSE@
 AMDEP_TRUE = @AMDEP_TRUE@
 AMTAR = @AMTAR@
+AUDITLIB = @AUDITLIB@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
diff -rup aide-0.12_rc1-orig/include/be.h aide-0.12_rc1/include/be.h
--- aide-0.12_rc1-orig/include/be.h	2003-01-16 05:37:34.000000000 -0500
+++ aide-0.12_rc1/include/be.h	2006-10-12 15:22:46.000000000 -0400
@@ -22,6 +22,7 @@
 #define _BE_H_INCLUDED
 #include "db_config.h"
 
-FILE* be_init(int inout,url_t* u,int iszipped);
+/* just FILE * atm. ... I think */
+void* be_init(int inout,url_t* u,int iszipped);
 
 #endif /* _BE_H_INCLUDED */
Only in aide-0.12_rc1/include: be.h.audit
diff -rup aide-0.12_rc1-orig/Makefile.in aide-0.12_rc1/Makefile.in
--- aide-0.12_rc1-orig/Makefile.in	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/Makefile.in	2006-10-12 15:24:55.000000000 -0400
@@ -94,6 +94,7 @@ AIDE_USE_LOCALE = @AIDE_USE_LOCALE@
 AMDEP_FALSE = @AMDEP_FALSE@
 AMDEP_TRUE = @AMDEP_TRUE@
 AMTAR = @AMTAR@
+AUDITLIB = @AUDITLIB@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
diff -rup aide-0.12_rc1-orig/src/be.c aide-0.12_rc1/src/be.c
--- aide-0.12_rc1-orig/src/be.c	2006-03-29 08:27:50.000000000 -0500
+++ aide-0.12_rc1/src/be.c	2006-10-12 15:22:46.000000000 -0400
@@ -28,6 +28,7 @@
 #include "db_config.h"
 #include "db_file.h"
 #include "report.h"
+#include "be.h"
 #include "fopen.h"
 
 #ifdef WITH_PSQL
Only in aide-0.12_rc1/src: be.c.audit
diff -rup aide-0.12_rc1-orig/src/compare_db.c aide-0.12_rc1/src/compare_db.c
--- aide-0.12_rc1-orig/src/compare_db.c	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/src/compare_db.c	2006-10-12 15:22:46.000000000 -0400
@@ -25,6 +25,13 @@
 #include <sys/stat.h>
 #include <math.h>
 
+#ifdef WITH_AUDIT
+#include <libaudit.h>
+#ifdef HAVE_SYSLOG
+#include <syslog.h>
+#endif
+#endif
+
 #include "base64.h"
 #include "report.h"
 #include "db_config.h"
@@ -39,6 +46,7 @@
 #include "locale-aide.h"
 /*for locale support*/
 
+#include "compare_db.h"
 #include "md.h"
 
 /*************/
@@ -53,11 +61,11 @@ const char* entry_format=        "  %-9s
 const char* entry_format_justnew="  %-9s: %-33c  %s\n";
 /*************/
 
-static int get_ignorelist() {
-  int ignorelist;
+static DB_ATTR_TYPE get_ignorelist() {
+  DB_ATTR_TYPE ignorelist;
   ignorelist=get_groupval("ignore_list");
 
-  if (ignorelist==-1) {
+  if (ignorelist==DB_ATTR_UNDEF) {
     ignorelist=0;
   }
 
@@ -1047,10 +1055,36 @@ void compare_db(list* new,db_config* con
   }
 }
 
+ /* Something changed, send audit anomaly message */
+void send_audit_report(long nadd, long nrem, long nchg)
+{
+#ifdef WITH_AUDIT
+  if(nadd!=0||nrem!=0||nchg!=0){
+    int fd=audit_open();
+    if (fd>=0){
+       char msg[64];
+
+       snprintf(msg, sizeof(msg), "added=%ld removed=%ld changed=%ld", 
+                nadd, nrem, nchg);
+
+       if (audit_log_user_message(fd, AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
+                                  msg, NULL, NULL, NULL, 0)<=0)
+#ifdef HAVE_SYSLOG
+          syslog(LOG_ERR, "Failed sending audit message:%s", msg);
+#else
+          ;
+#endif
+       close(fd);
+    }
+  }
+#endif /* WITH_AUDIT */
+}
+
+
 long report_tree(seltree* node,int stage, long* stat)
 {
   list* r=NULL;
-  int ignorelist=0;
+  DB_ATTR_TYPE ignorelist=0;
   int forced_attrs=0;
   int top=0;
 
@@ -1147,7 +1181,7 @@ long report_tree(seltree* node,int stage
       error(2,_("---------------------------------------------------\n\n"));
     }
     if(node->checked&NODE_CHANGED){
-      int localignorelist=(node->old_data->attr ^ node->new_data->attr)|ignorelist;
+      DB_ATTR_TYPE localignorelist=(node->old_data->attr ^ node->new_data->attr)|ignorelist;
       print_dbline_changes(node->old_data,node->new_data,localignorelist,forced_attrs);
     }
   }
@@ -1158,6 +1192,7 @@ long report_tree(seltree* node,int stage
   }
 
   if(top&&(stage==0)&&((stat[2]+stat[3]+stat[4])>0)){
+    send_audit_report(stat[2],stat[3],stat[4]);
     print_report_header(stat[1],stat[2],stat[3],stat[4]);
   }
   
Only in aide-0.12_rc1/src: compare_db.c.audit
diff -rup aide-0.12_rc1-orig/src/Makefile.am aide-0.12_rc1/src/Makefile.am
--- aide-0.12_rc1-orig/src/Makefile.am	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/src/Makefile.am	2006-10-12 15:22:46.000000000 -0400
@@ -50,7 +50,7 @@ aide_SOURCES =	\
 
 INCLUDES = -I$(top_srcdir)/include
 
-LDADD = @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@
+LDADD = @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@
 
 AM_LDFLAGS = @LDFLAGS@ @LD_STATIC_FLAG@ -lm
 
Only in aide-0.12_rc1/src: Makefile.am.audit
diff -rup aide-0.12_rc1-orig/src/Makefile.in aide-0.12_rc1/src/Makefile.in
--- aide-0.12_rc1-orig/src/Makefile.in	2006-10-12 15:07:28.000000000 -0400
+++ aide-0.12_rc1/src/Makefile.in	2006-10-12 15:24:55.000000000 -0400
@@ -101,6 +101,7 @@ AIDE_USE_LOCALE = @AIDE_USE_LOCALE@
 AMDEP_FALSE = @AMDEP_FALSE@
 AMDEP_TRUE = @AMDEP_TRUE@
 AMTAR = @AMTAR@
+AUDITLIB = @AUDITLIB@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
@@ -209,7 +210,7 @@ aide_SOURCES = \
 		aide.c
 
 INCLUDES = -I$(top_srcdir)/include
-LDADD = @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@
+LDADD = @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@
 AM_LDFLAGS = @LDFLAGS@ @LD_STATIC_FLAG@ -lm
 AM_CFLAGS = @CFLAGS@ @MAINTAINER_MODE_TRUE@ -Wall -g
 CLEANFILES = conf_yacc.h conf_yacc.c conf_lex.c db_lex.c *~
Only in aide-0.12_rc1: version.m4
Only in aide-0.12_rc1: version.m4~