From: Steve Grubb <sgrubb@redhat.com>
Date: 2008-09-28 10:26:22
Subject: Makefile cleanup (src/mt)
References: https://fedorahosted.org/audit/changeset/131
References: bnc#752346
Signed-off-by: Tony Jones <tonyj@suse.de>

Clean up src/mt makefile.  Dependancies on the previous copying rules were
incorrect so that files changed by patches were not being updated in src/mt

---
 src/mt/Makefile.am     |   88 ---
 src/mt/Makefile.in     |  535 ----------------------
 src/mt/audit_logging.c |  693 ----------------------------
 src/mt/deprecated.c    |  473 -------------------
 src/mt/libaudit.c      | 1180 -------------------------------------------------
 src/mt/libaudit.h      |  565 -----------------------
 src/mt/lookup_table.c  |  296 ------------
 src/mt/message.c       |   58 --
 src/mt/netlink.c       |  289 ------------
 src/mt/private.h       |  202 --------
 10 files changed, 16 insertions(+), 4363 deletions(-)

--- a/src/mt/Makefile.am
+++ b/src/mt/Makefile.am
@@ -23,83 +23,27 @@
 # daemon's own use.
 
 AUTOMAKE_OPTIONS = no-dependencies
-CONFIG_CLEAN_FILES = Makefile.in *.rej *.orig 
+INCLUDES = -I${top_srcdir}/lib -I${top_builddir}/lib
+CONFIG_CLEAN_FILES = *.rej *.orig
 AM_CFLAGS = -fPIC -DPIC -D_REENTRANT -D_GNU_SOURCE
 
 noinst_LIBRARIES = libauditmt.a
-noinst_HEADERS = libaudit.h private.h
 
-libauditmt_a_SOURCES = libaudit.c message.c netlink.c \
-lookup_table.c audit_logging.c deprecated.c
-libauditmt_a_HEADERS: ${top_builddir}/config.h libaudit.h private.h
+libauditmt_a_SOURCES = ${top_srcdir}/lib/libaudit.c \
+	${top_srcdir}/lib/message.c ${top_srcdir}/lib/netlink.c \
+	${top_srcdir}/lib/lookup_table.c ${top_srcdir}/lib/audit_logging.c \
+	${top_srcdir}/lib/deprecated.c
+libauditmt_a_HEADERS: ${top_builddir}/config.h ${top_srcdir}/lib/libaudit.h \
+	${top_srcdir}/lib/private.h
 libauditmt_a_DEPENDENCIES = $(libaudit_a_SOURCES) ${top_builddir}/config.h \
-	gen_tables.h i386_tables.h ia64_tables.h ppc_tables.h \
-	s390_tables.h s390x_tables.h x86_64_tables.h private.h \
-	actiontabs.h fieldtabs.h flagtabs.h ftypetabs.h \
-	machinetabs.h msg_typetabs.h optabs.h
+	${top_srcdir}/lib/gen_tables.h ${top_builddir}/lib/i386_tables.h \
+	${top_builddir}/lib/ia64_tables.h ${top_builddir}/lib/ppc_tables.h \
+	${top_builddir}/lib/s390_tables.h ${top_builddir}/lib/s390x_tables.h \
+	${top_builddir}/lib/x86_64_tables.h ${top_srcdir}/lib/private.h \
+	${top_builddir}/lib/actiontabs.h ${top_builddir}/lib/fieldtabs.h \
+	${top_builddir}/lib/flagtabs.h ${top_builddir}/lib/ftypetabs.h \
+	${top_builddir}/lib/machinetabs.h ${top_builddir}/lib/msg_typetabs.h \
+	${top_builddir}/lib/optabs.h
 AM_LDFLAGS = -Wl,-z,relro
 
 lib_OBJECTS = $(libauditmt_a_OBJECTS)
-
-libaudit.h:
-	cp ${top_srcdir}/lib/libaudit.h .
-libaudit.c: libaudit.h private.h errormsg.h
-	cp ${top_srcdir}/lib/libaudit.c .
-message.c: libaudit.h
-	cp ${top_srcdir}/lib/message.c .
-netlink.c: libaudit.h
-	cp ${top_srcdir}/lib/netlink.c .
-lookup_table.c: libaudit.h
-	cp ${top_srcdir}/lib/lookup_table.c .
-audit_logging.c: libaudit.h
-	cp ${top_srcdir}/lib/audit_logging.c .
-deprecated.c: libaudit.h private.h
-	cp ${top_srcdir}/lib/deprecated.c .
-gen_tables.h:
-	cp ${top_srcdir}/lib/gen_tables.h .
-i386_tables.h:
-	cp ${top_builddir}/lib/i386_tables.h .
-ia64_tables.h:
-	cp ${top_builddir}/lib/ia64_tables.h .
-ppc_tables.h:
-	cp ${top_builddir}/lib/ppc_tables.h .
-s390_tables.h:
-	cp ${top_builddir}/lib/s390_tables.h .
-s390x_tables.h:
-	cp ${top_builddir}/lib/s390x_tables.h .
-x86_64_tables.h:
-	cp ${top_builddir}/lib/x86_64_tables.h .
-private.h:
-	cp ${top_srcdir}/lib/private.h .
-alpha_tables.h:
-	cp ${top_builddir}/lib/alpha_tables.h .
-actiontabs.h:
-	cp ${top_builddir}/lib/actiontabs.h .
-fieldtabs.h:
-	cp ${top_builddir}/lib/fieldtabs.h .
-flagtabs.h:
-	cp ${top_builddir}/lib/flagtabs.h .
-ftypetabs.h:
-	cp ${top_builddir}/lib/ftypetabs.h .
-machinetabs.h:
-	cp ${top_builddir}/lib/machinetabs.h .
-msg_typetabs.h:
-	cp ${top_builddir}/lib/msg_typetabs.h .
-optabs.h:
-	cp ${top_builddir}/lib/optabs.h .
-errtabs.h:
-	cp ${top_builddir}/lib/errtabs.h .
-errormsg.h:
-	cp ${top_srcdir}/lib/errormsg.h .
-
-lookup_table.o: ${top_builddir}/config.h gen_tables.h i386_tables.h \
-	ia64_tables.h ppc_tables.h s390_tables.h s390x_tables.h \
-	x86_64_tables.h alpha_tables.h private.h actiontabs.h \
-	fieldtabs.h flagtabs.h ftypetabs.h machinetabs.h \
-	msg_typetabs.h optabs.h errtabs.h
-
-libauditmt.o: $(libauditmt_a_SOURCES)
-
-clean-generic:
-	rm -f *.h *.c
-
--- a/src/mt/Makefile.in
+++ /dev/null
@@ -1,535 +0,0 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
-# @configure_input@
-
-# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-@SET_MAKE@
-
-# Makefile.am -- 
-# Copyright 2005-06,2008 Red Hat Inc., Durham, North Carolina.
-# All Rights Reserved.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-# 
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-# 
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-# 
-# Authors:
-#   Steve Grubb <sgrubb@redhat.com>
-#
-# This make file builds a static multi-threaded libary for the audit
-# daemon's own use.
-
-
-VPATH = @srcdir@
-pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
-pkgincludedir = $(includedir)/@PACKAGE@
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = @build@
-host_triplet = @host@
-target_triplet = @target@
-subdir = src/mt
-DIST_COMMON = $(noinst_HEADERS) $(srcdir)/Makefile.am \
-	$(srcdir)/Makefile.in
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/src/libev/libev.m4 \
-	$(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-LIBRARIES = $(noinst_LIBRARIES)
-ARFLAGS = cru
-libauditmt_a_AR = $(AR) $(ARFLAGS)
-libauditmt_a_LIBADD =
-am_libauditmt_a_OBJECTS = libaudit.$(OBJEXT) message.$(OBJEXT) \
-	netlink.$(OBJEXT) lookup_table.$(OBJEXT) \
-	audit_logging.$(OBJEXT) deprecated.$(OBJEXT)
-libauditmt_a_OBJECTS = $(am_libauditmt_a_OBJECTS)
-DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
-depcomp =
-am__depfiles_maybe =
-COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
-	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
-	$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-CCLD = $(CC)
-LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
-	$(LDFLAGS) -o $@
-SOURCES = $(libauditmt_a_SOURCES)
-DIST_SOURCES = $(libauditmt_a_SOURCES)
-HEADERS = $(noinst_HEADERS)
-ETAGS = etags
-CTAGS = ctags
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-ACLOCAL = @ACLOCAL@
-AMTAR = @AMTAR@
-AR = @AR@
-AUTOCONF = @AUTOCONF@
-AUTOHEADER = @AUTOHEADER@
-AUTOMAKE = @AUTOMAKE@
-AWK = @AWK@
-CC = @CC@
-CCDEPMODE = @CCDEPMODE@
-CFLAGS = @CFLAGS@
-CPP = @CPP@
-CPPFLAGS = @CPPFLAGS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
-CYGPATH_W = @CYGPATH_W@
-DEFS = @DEFS@
-DEPDIR = @DEPDIR@
-ECHO = @ECHO@
-ECHO_C = @ECHO_C@
-ECHO_N = @ECHO_N@
-ECHO_T = @ECHO_T@
-EGREP = @EGREP@
-EXEEXT = @EXEEXT@
-F77 = @F77@
-FFLAGS = @FFLAGS@
-GREP = @GREP@
-INSTALL = @INSTALL@
-INSTALL_DATA = @INSTALL_DATA@
-INSTALL_PROGRAM = @INSTALL_PROGRAM@
-INSTALL_SCRIPT = @INSTALL_SCRIPT@
-INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-LDFLAGS = @LDFLAGS@
-LIBOBJS = @LIBOBJS@
-LIBS = @LIBS@
-LIBTOOL = @LIBTOOL@
-LIBTOOL_DEPS = @LIBTOOL_DEPS@
-LIBWRAP_LIBS = @LIBWRAP_LIBS@
-LN_S = @LN_S@
-LTLIBOBJS = @LTLIBOBJS@
-MAKEINFO = @MAKEINFO@
-MKDIR_P = @MKDIR_P@
-OBJEXT = @OBJEXT@
-PACKAGE = @PACKAGE@
-PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
-PACKAGE_NAME = @PACKAGE_NAME@
-PACKAGE_STRING = @PACKAGE_STRING@
-PACKAGE_TARNAME = @PACKAGE_TARNAME@
-PACKAGE_VERSION = @PACKAGE_VERSION@
-PATH_SEPARATOR = @PATH_SEPARATOR@
-PYTHON = @PYTHON@
-PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
-PYTHON_PLATFORM = @PYTHON_PLATFORM@
-PYTHON_PREFIX = @PYTHON_PREFIX@
-PYTHON_VERSION = @PYTHON_VERSION@
-RANLIB = @RANLIB@
-SED = @SED@
-SET_MAKE = @SET_MAKE@
-SHELL = @SHELL@
-STRIP = @STRIP@
-VERSION = @VERSION@
-abs_builddir = @abs_builddir@
-abs_srcdir = @abs_srcdir@
-abs_top_builddir = @abs_top_builddir@
-abs_top_srcdir = @abs_top_srcdir@
-ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
-am__include = @am__include@
-am__leading_dot = @am__leading_dot@
-am__quote = @am__quote@
-am__tar = @am__tar@
-am__untar = @am__untar@
-bindir = @bindir@
-build = @build@
-build_alias = @build_alias@
-build_cpu = @build_cpu@
-build_os = @build_os@
-build_vendor = @build_vendor@
-builddir = @builddir@
-datadir = @datadir@
-datarootdir = @datarootdir@
-docdir = @docdir@
-dvidir = @dvidir@
-exec_prefix = @exec_prefix@
-gss_libs = @gss_libs@
-host = @host@
-host_alias = @host_alias@
-host_cpu = @host_cpu@
-host_os = @host_os@
-host_vendor = @host_vendor@
-htmldir = @htmldir@
-includedir = @includedir@
-infodir = @infodir@
-install_sh = @install_sh@
-libdir = @libdir@
-libev_LIBS = @libev_LIBS@
-libexecdir = @libexecdir@
-localedir = @localedir@
-localstatedir = @localstatedir@
-mandir = @mandir@
-mkdir_p = @mkdir_p@
-oldincludedir = @oldincludedir@
-pdfdir = @pdfdir@
-pkgpyexecdir = @pkgpyexecdir@
-pkgpythondir = @pkgpythondir@
-prefix = @prefix@
-program_transform_name = @program_transform_name@
-psdir = @psdir@
-pyexecdir = @pyexecdir@
-pythondir = @pythondir@
-sbindir = @sbindir@
-sharedstatedir = @sharedstatedir@
-srcdir = @srcdir@
-subdirs = @subdirs@
-sysconfdir = @sysconfdir@
-target = @target@
-target_alias = @target_alias@
-target_cpu = @target_cpu@
-target_os = @target_os@
-target_vendor = @target_vendor@
-top_builddir = @top_builddir@
-top_srcdir = @top_srcdir@
-AUTOMAKE_OPTIONS = no-dependencies
-CONFIG_CLEAN_FILES = Makefile.in *.rej *.orig 
-AM_CFLAGS = -fPIC -DPIC -D_REENTRANT -D_GNU_SOURCE
-noinst_LIBRARIES = libauditmt.a
-noinst_HEADERS = libaudit.h private.h
-libauditmt_a_SOURCES = libaudit.c message.c netlink.c \
-lookup_table.c audit_logging.c deprecated.c
-
-libauditmt_a_DEPENDENCIES = $(libaudit_a_SOURCES) ${top_builddir}/config.h \
-	gen_tables.h i386_tables.h ia64_tables.h ppc_tables.h \
-	s390_tables.h s390x_tables.h x86_64_tables.h private.h \
-	actiontabs.h fieldtabs.h flagtabs.h ftypetabs.h \
-	machinetabs.h msg_typetabs.h optabs.h
-
-AM_LDFLAGS = -Wl,-z,relro
-lib_OBJECTS = $(libauditmt_a_OBJECTS)
-all: all-am
-
-.SUFFIXES:
-.SUFFIXES: .c .lo .o .obj
-$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
-	@for dep in $?; do \
-	  case '$(am__configure_deps)' in \
-	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
-	      exit 1;; \
-	  esac; \
-	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu  src/mt/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --gnu  src/mt/Makefile
-.PRECIOUS: Makefile
-Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
-	@case '$?' in \
-	  *config.status*) \
-	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
-	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
-	esac;
-
-$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-$(top_srcdir)/configure:  $(am__configure_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-clean-noinstLIBRARIES:
-	-test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES)
-libauditmt.a: $(libauditmt_a_OBJECTS) $(libauditmt_a_DEPENDENCIES) 
-	-rm -f libauditmt.a
-	$(libauditmt_a_AR) libauditmt.a $(libauditmt_a_OBJECTS) $(libauditmt_a_LIBADD)
-	$(RANLIB) libauditmt.a
-
-mostlyclean-compile:
-	-rm -f *.$(OBJEXT)
-
-distclean-compile:
-	-rm -f *.tab.c
-
-.c.o:
-	$(COMPILE) -c $<
-
-.c.obj:
-	$(COMPILE) -c `$(CYGPATH_W) '$<'`
-
-.c.lo:
-	$(LTCOMPILE) -c -o $@ $<
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
-
-ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
-	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	mkid -fID $$unique
-tags: TAGS
-
-TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
-		$(TAGS_FILES) $(LISP)
-	tags=; \
-	here=`pwd`; \
-	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
-	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
-	fi
-ctags: CTAGS
-CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
-		$(TAGS_FILES) $(LISP)
-	tags=; \
-	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
-	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
-
-GTAGS:
-	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
-
-distclean-tags:
-	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
-
-distdir: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	list='$(DISTFILES)'; \
-	  dist_files=`for file in $$list; do echo $$file; done | \
-	  sed -e "s|^$$srcdirstrip/||;t" \
-	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
-	case $$dist_files in \
-	  */*) $(MKDIR_P) `echo "$$dist_files" | \
-			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
-			   sort -u` ;; \
-	esac; \
-	for file in $$dist_files; do \
-	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  if test -d $$d/$$file; then \
-	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
-	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
-	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
-	    || exit 1; \
-	  fi; \
-	done
-check-am: all-am
-check: check-am
-all-am: Makefile $(LIBRARIES) $(HEADERS)
-installdirs:
-install: install-am
-install-exec: install-exec-am
-install-data: install-data-am
-uninstall: uninstall-am
-
-install-am: all-am
-	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
-
-installcheck: installcheck-am
-install-strip:
-	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	  install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	  `test -z '$(STRIP)' || \
-	    echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
-mostlyclean-generic:
-
-distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-
-maintainer-clean-generic:
-	@echo "This command is intended for maintainers to use"
-	@echo "it deletes files that may require special tools to rebuild."
-clean: clean-am
-
-clean-am: clean-generic clean-libtool clean-noinstLIBRARIES \
-	mostlyclean-am
-
-distclean: distclean-am
-	-rm -f Makefile
-distclean-am: clean-am distclean-compile distclean-generic \
-	distclean-tags
-
-dvi: dvi-am
-
-dvi-am:
-
-html: html-am
-
-info: info-am
-
-info-am:
-
-install-data-am:
-
-install-dvi: install-dvi-am
-
-install-exec-am:
-
-install-html: install-html-am
-
-install-info: install-info-am
-
-install-man:
-
-install-pdf: install-pdf-am
-
-install-ps: install-ps-am
-
-installcheck-am:
-
-maintainer-clean: maintainer-clean-am
-	-rm -f Makefile
-maintainer-clean-am: distclean-am maintainer-clean-generic
-
-mostlyclean: mostlyclean-am
-
-mostlyclean-am: mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool
-
-pdf: pdf-am
-
-pdf-am:
-
-ps: ps-am
-
-ps-am:
-
-uninstall-am:
-
-.MAKE: install-am install-strip
-
-.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
-	clean-libtool clean-noinstLIBRARIES ctags distclean \
-	distclean-compile distclean-generic distclean-libtool \
-	distclean-tags distdir dvi dvi-am html html-am info info-am \
-	install install-am install-data install-data-am install-dvi \
-	install-dvi-am install-exec install-exec-am install-html \
-	install-html-am install-info install-info-am install-man \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-strip installcheck installcheck-am installdirs \
-	maintainer-clean maintainer-clean-generic mostlyclean \
-	mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
-	pdf pdf-am ps ps-am tags uninstall uninstall-am
-
-libauditmt_a_HEADERS: ${top_builddir}/config.h libaudit.h private.h
-
-libaudit.h:
-	cp ${top_srcdir}/lib/libaudit.h .
-libaudit.c: libaudit.h private.h errormsg.h
-	cp ${top_srcdir}/lib/libaudit.c .
-message.c: libaudit.h
-	cp ${top_srcdir}/lib/message.c .
-netlink.c: libaudit.h
-	cp ${top_srcdir}/lib/netlink.c .
-lookup_table.c: libaudit.h
-	cp ${top_srcdir}/lib/lookup_table.c .
-audit_logging.c: libaudit.h
-	cp ${top_srcdir}/lib/audit_logging.c .
-deprecated.c: libaudit.h private.h
-	cp ${top_srcdir}/lib/deprecated.c .
-gen_tables.h:
-	cp ${top_srcdir}/lib/gen_tables.h .
-i386_tables.h:
-	cp ${top_builddir}/lib/i386_tables.h .
-ia64_tables.h:
-	cp ${top_builddir}/lib/ia64_tables.h .
-ppc_tables.h:
-	cp ${top_builddir}/lib/ppc_tables.h .
-s390_tables.h:
-	cp ${top_builddir}/lib/s390_tables.h .
-s390x_tables.h:
-	cp ${top_builddir}/lib/s390x_tables.h .
-x86_64_tables.h:
-	cp ${top_builddir}/lib/x86_64_tables.h .
-private.h:
-	cp ${top_srcdir}/lib/private.h .
-alpha_tables.h:
-	cp ${top_builddir}/lib/alpha_tables.h .
-actiontabs.h:
-	cp ${top_builddir}/lib/actiontabs.h .
-fieldtabs.h:
-	cp ${top_builddir}/lib/fieldtabs.h .
-flagtabs.h:
-	cp ${top_builddir}/lib/flagtabs.h .
-ftypetabs.h:
-	cp ${top_builddir}/lib/ftypetabs.h .
-machinetabs.h:
-	cp ${top_builddir}/lib/machinetabs.h .
-msg_typetabs.h:
-	cp ${top_builddir}/lib/msg_typetabs.h .
-optabs.h:
-	cp ${top_builddir}/lib/optabs.h .
-errtabs.h:
-	cp ${top_builddir}/lib/errtabs.h .
-errormsg.h:
-	cp ${top_srcdir}/lib/errormsg.h .
-
-lookup_table.o: ${top_builddir}/config.h gen_tables.h i386_tables.h \
-	ia64_tables.h ppc_tables.h s390_tables.h s390x_tables.h \
-	x86_64_tables.h alpha_tables.h private.h actiontabs.h \
-	fieldtabs.h flagtabs.h ftypetabs.h machinetabs.h \
-	msg_typetabs.h optabs.h errtabs.h
-
-libauditmt.o: $(libauditmt_a_SOURCES)
-
-clean-generic:
-	rm -f *.h *.c
-# Tell versions [3.59,3.63) of GNU make to not export all variables.
-# Otherwise a system limit (for SysV at least) may be exceeded.
-.NOEXPORT:
--- a/src/mt/audit_logging.c
+++ /dev/null
@@ -1,693 +0,0 @@
-/* audit_logging.c -- 
- * Copyright 2005-2008 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- */
-
-#include "config.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/stat.h>
-#include <errno.h>
-#include <netinet/in.h> // inet6 addrlen
-#include <netdb.h>	// gethostbyname
-#include <arpa/inet.h>	// inet_ntop
-#include <utmp.h>
-#include <limits.h>	// PATH_MAX
-
-#include "libaudit.h"
-#include "private.h"
-
-#define TTY_PATH	32
-#define MAX_USER	(UT_NAMESIZE * 2) + 8
-
-// NOTE: The kernel fills in pid, uid, and loginuid of sender. Therefore,
-// these routines do not need to send them.
-
-/*
- * resolve's the hostname - caller must pass a INET6_ADDRSTRLEN byte buffer
- * Returns string w/ numerical address, or "?" on failure
- */
-static void _resolve_addr(char buf[], const char *host)
-{
-	struct addrinfo *ai;
-	struct addrinfo hints;
-	int e;
-
-	buf[0] = '?';
-	buf[1] = 0;
-	if (host == NULL) /* Short circuit this lookup if NULL */
-		return;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_flags = AI_ADDRCONFIG;
-	hints.ai_socktype = SOCK_STREAM;
-
-	e = getaddrinfo(host, NULL, &hints, &ai);
-	if (e != 0) {
-		audit_msg(LOG_ERR, 
-			"resolve_addr: cannot resolve hostname %s (%s)",
-			host, gai_strerror(e));
-		return;
-	}
-	// What to do if more than 1 addr?
-	inet_ntop(ai->ai_family, ai->ai_family == AF_INET ?
-		(void *) &((struct sockaddr_in *)ai->ai_addr)->sin_addr :
-		(void *) &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
-		buf, INET6_ADDRSTRLEN);
-	freeaddrinfo(ai);
-}
-
-/*
- * This function checks a string to see if it needs encoding. It
- * return 1 if needed and 0 if not
- */
-int audit_value_needs_encoding(const char *str, unsigned int size)
-{
-	int i;
-
-	for (i=0; i<size; i++) {
-		if (str[i] == '"' || str[i] < 0x21 || str[i] > 0x7f)
-			return 1;
-	}
-	return 0;
-}
-
-/*
- * This function does encoding of "untrusted" names just like the kernel
- */
-char *audit_encode_value(char *final, const char *buf, unsigned int size)
-{
-	unsigned int i;
-	char *ptr = final;
-	const char *hex = "0123456789ABCDEF";
-
-	for (i=0; i<size; i++) {
-		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
-		*ptr++ = hex[buf[i] & 0x0F];      /* Lower nibble */
-	}
-	*ptr = 0;
-	return final;
-}
-
-char *audit_encode_nv_string(const char *name, const char *value,
-		unsigned int vlen)
-{
-	char *str;
-
-	if (vlen == 0)
-		vlen = strlen(value);
-
-	if (audit_value_needs_encoding(value, vlen)) {
-		char *tmp = malloc(2*vlen + 1);
-		audit_encode_value(tmp, value, vlen);
-		asprintf(&str, "%s=%s", name, tmp);
-		free(tmp);
-	} else
-		asprintf(&str, "%s=\"%s\"", name, value);
-	return str;
-}
-
-/*
- * Get the executable's name 
- */
-static char *_get_exename(char *exename, int size)
-{
-	int res;
-	char tmp[PATH_MAX];
-
-	/* get the name of the current executable */
-	if ((res = readlink("/proc/self/exe", tmp, PATH_MAX - 1)) == -1) {
-		strcpy(exename, "\"?\"");
-		audit_msg(LOG_ERR, "get_exename: cannot determine executable");
-	} else {
-		tmp[res] = '\0';
-		if (audit_value_needs_encoding(tmp, res))
-			return audit_encode_value(exename, tmp, res);
-		snprintf(exename, size, "\"%s\"", tmp);
-	}
-	return exename;
-}
-
-/*
- * Get the command line name 
- * NOTE: at the moment, this only escapes what the user sent
- */
-static char *_get_commname(const char *comm, char *commname, unsigned int size)
-{
-	unsigned int len;
-	
-	if (comm == NULL) {
-		strcpy(commname, "\"?\"");
-		return commname;
-	}
-
-	len = strlen(comm);
-	if (audit_value_needs_encoding(comm, len))
-		audit_encode_value(commname, comm, len);
-	else
-		snprintf(commname, size, "\"%s\"", comm);
-
-	return commname;
-}
-
-static int check_ttyname(const char *ttyn)
-{
-	struct stat statbuf;
-
-	if (lstat(ttyn, &statbuf)
-		|| !S_ISCHR(statbuf.st_mode)
-		|| (statbuf.st_nlink > 1 && strncmp(ttyn, "/dev/", 5))) {
-		audit_msg(LOG_ERR, "FATAL: bad tty %s", ttyn);
-		return 1;
-        }
-	return 0;
-}
-
-static const char *_get_tty(char *tname, int size)
-{
-	int rc, i, found = 0;
-
-	for (i=0; i<3 && !found; i++) {
-		rc = ttyname_r(i, tname, size);
-		if (rc == 0 && tname[0] != '\0')
-			found = 1;
-	}
-
-	if (!found)
-		return NULL;
-	
-	if (check_ttyname(tname)) 
-		return NULL;
-
-	if (strncmp(tname, "/dev/", 5) == 0)
-		return &tname[5];
-
-	return tname;
-}
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. This function should be used by all console apps that do
- * not manipulate accounts or groups.
- *
- * audit_fd - The fd returned by audit_open
- * type - type of message, ex: AUDIT_USER, AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
- * message - the message being sent
- * hostname - the hostname if known
- * addr - The network address of the user
- * tty - The tty of the user
- * result - 1 is "success" and 0 is "failed"
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_user_message(int audit_fd, int type, const char *message,
-	const char *hostname, const char *addr, const char *tty, int result)
-{
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char addrbuf[INET6_ADDRSTRLEN];
-	char exename[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	const char *success;
-	int ret;
-
-	if (audit_fd < 0)
-		return 0;
-
-	if (result)
-		success = "success";
-	else
-		success = "failed";
-
-	addrbuf[0] = 0;
-	if (addr == NULL || strlen(addr) == 0)
-		_resolve_addr(addrbuf, hostname);
-	else
-		strncat(addrbuf, addr, sizeof(addrbuf)-1);
-
-	_get_exename(exename, sizeof(exename));
-	if (tty == NULL) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	snprintf(buf, sizeof(buf),
-		"%s: exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)",
-		message, exename,
-		hostname ? hostname : "?",
-		addrbuf,
-		tty ? tty : "?",
-		success
-		);
-
-	errno = 0;
-	ret = audit_send_user_message( audit_fd, type, HIDE_IT, buf );
-	if ((ret < 1) && errno == 0)
-		errno = ret;
-	return ret;
-}
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. This function should be used by all console apps that do
- * not manipulate accounts or groups and are executing a script. An example
- * would be python or crond wanting to say what they are executing.
- *
- * audit_fd - The fd returned by audit_open
- * type - type of message, ex: AUDIT_USER, AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
- * message - the message being sent
- * comm - the program command line name
- * hostname - the hostname if known
- * addr - The network address of the user
- * tty - The tty of the user
- * result - 1 is "success" and 0 is "failed"
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_user_comm_message(int audit_fd, int type, const char *message,
-	const char *comm, const char *hostname, const char *addr,
-	const char *tty, int result)
-{
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char addrbuf[INET6_ADDRSTRLEN];
-	char exename[PATH_MAX*2];
-	char commname[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	const char *success;
-	int ret;
-
-	if (audit_fd < 0)
-		return 0;
-
-	if (result)
-		success = "success";
-	else
-		success = "failed";
-
-	addrbuf[0] = 0;
-	if (addr == NULL || strlen(addr) == 0)
-		_resolve_addr(addrbuf, hostname);
-	else
-		strncat(addrbuf, addr, sizeof(addrbuf)-1);
-	_get_exename(exename, sizeof(exename));
-	if (tty == NULL) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	_get_commname(comm, commname, sizeof(commname));
-
-	snprintf(buf, sizeof(buf),
-		"%s: comm=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)",
-		message, commname, exename,
-		hostname ? hostname : "?",
-		addrbuf,
-		tty ? tty : "?",
-		success
-		);
-
-	errno = 0;
-	ret = audit_send_user_message( audit_fd, type, HIDE_IT, buf );
-	if ((ret < 1) && errno == 0)
-		errno = ret;
-	return ret;
-}
-
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. It should be used for all account manipulation operations.
- * Parameter usage is as follows:
- *
- * audit_fd - The fd returned by audit_open
- * type - type of message: AUDIT_USER_CHAUTHTOK for changing any account
- *        attributes.
- * pgname - program's name
- * op  -  operation. "adding user", "changing finger info", "deleting group"
- * name - user's account or group name. If not available use NULL.
- * id  -  uid or gid that the operation is being performed on. This is used
- *        only when user is NULL.
- * host - The hostname if known
- * addr - The network address of the user
- * tty  - The tty of the user
- * result - 1 is "success" and 0 is "failed"
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_acct_message(int audit_fd, int type, const char *pgname,
-	const char *op, const char *name, unsigned int id, 
-	const char *host, const char *addr, const char *tty, int result)
-{
-	const char *success;
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char addrbuf[INET6_ADDRSTRLEN];
-	char exename[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	int ret;
-
-	if (audit_fd < 0)
-		return 0;
-
-	if (result)
-		success = "success";
-	else
-		success = "failed";
-
-	addrbuf[0] = 0;
-	if (addr == NULL || strlen(addr) == 0)
-		_resolve_addr(addrbuf, host);
-	else
-		strncat(addrbuf, addr, sizeof(addrbuf)-1);
-
-	if (pgname == NULL) {
-		_get_exename(exename, sizeof(exename));
-		pgname = exename;
-	}
-	if (tty == NULL) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	if (name) {
-		char user[MAX_USER];
-		const char *format;
-		size_t len;
-
-		user[0] = 0;
-		strncat(user, name, MAX_USER-1);
-		len = strnlen(user, UT_NAMESIZE);
-		user[len] = 0;
-		if (audit_value_needs_encoding(name, len)) {
-			audit_encode_value(user, name, len);
-			format = 
-	     "op=%s acct=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
-		} else
-			format = 
-	 "op=%s acct=\"%s\" exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
-
-		snprintf(buf, sizeof(buf), format,
-			op, user, pgname,
-			host ? host : "?",
-			addrbuf,
-			tty ? tty : "?",
-			success
-			);
-	} else
-		snprintf(buf, sizeof(buf),
-		"op=%s id=%u exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)",
-			op, id, pgname,
-			host ? host : "?",
-			addrbuf,
-			tty ? tty : "?",
-			success
-			);
-
-	errno = 0;
-	ret = audit_send_user_message(audit_fd, type, REAL_ERR, buf);
-	if ((ret < 1) && errno == 0)
-		errno = ret;
-	return ret;
-}
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. This function should be used by all apps that are SE Linux
- * object managers.
- *
- * audit_fd - The fd returned by audit_open
- * type - type of message, ex: AUDIT_USER, AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
- * message - the message being sent
- * hostname - the hostname if known
- * addr - The network address of the user
- * tty - The tty of the user
- * uid - The auid of the person related to the avc message
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_user_avc_message(int audit_fd, int type, const char *message,
-	const char *hostname, const char *addr, const char *tty, uid_t uid)
-{
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char addrbuf[INET6_ADDRSTRLEN];
-	char exename[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	int retval;
-
-	if (audit_fd < 0)
-		return 0;
-
-	addrbuf[0] = 0;
-	if (addr == NULL || strlen(addr) == 0)
-		_resolve_addr(addrbuf, hostname);
-	else
-		strncat(addrbuf, addr, sizeof(addrbuf)-1);
-	_get_exename(exename, sizeof(exename));
-	if (tty == NULL) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	snprintf(buf, sizeof(buf),
-	    "%s: exe=%s (sauid=%d, hostname=%s, addr=%s, terminal=%s)",
-		message, exename, uid,
-		hostname ? hostname : "?",
-		addrbuf,
-		tty ? tty : "?"
-		);
-
-	errno = 0;
-	retval = audit_send_user_message( audit_fd, type, REAL_ERR, buf );
-	if (retval == -EPERM && getuid() != 0) {
-		syslog(LOG_ERR, "Can't send to audit system: %s %s",
-			audit_msg_type_to_name(type), buf);
-		return 0;
-	}
-	if ((retval < 1) && errno == 0)
-		errno = retval;
-	return retval;
-}
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. It should be used for all SE linux user and role 
- * manipulation operations.
- * Parameter usage is as follows:
- *
- * type - type of message: AUDIT_USER_ROLE_CHANGE for changing any SE Linux
- *        user or role attributes.
- * pgname - program's name
- * op  -  operation. "adding user", "changing finger info", "deleting group"
- * name - user's account or group name. If not available use NULL.
- * id  -  uid or gid that the operation is being performed on. This is used
- *        only when user is NULL.
- * new_seuser - the new seuser that the login user is getting
- * new_role - the new_role that the login user is getting
- * new_range - the new mls range that the login user is getting
- * old_seuser - the old seuser that the login usr had
- * old_role - the old role that the login user had
- * old_range - the old mls range that the login usr had
- * host - The hostname if known
- * addr - The network address of the user
- * tty  - The tty of the user
- * result - 1 is "success" and 0 is "failed"
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_semanage_message(int audit_fd, int type, const char *pgname,
-	const char *op, const char *name, unsigned int id, 
-	const char *new_seuser, const char *new_role, const char *new_range,
-	const char *old_seuser, const char *old_role, const char *old_range,
-	const char *host, const char *addr,
-	const char *tty, int result)
-{
-	const char *success;
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char addrbuf[INET6_ADDRSTRLEN];
-	char exename[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	int ret;
-
-	if (audit_fd < 0)
-		return 0;
-
-	if (result)
-		success = "success";
-	else
-		success = "failed";
-
-	addrbuf[0] = 0;
-	if (addr == NULL || strlen(addr) == 0)
-		_resolve_addr(addrbuf, host);
-	else
-		strncat(addrbuf, addr, sizeof(addrbuf)-1);
-
-	if (pgname == NULL || strlen(pgname) == 0) {
-		_get_exename(exename, sizeof(exename));
-		pgname = exename;
-	}
-	if (tty == NULL || strlen(tty) == 0) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	if (name && strlen(name) > 0) {
-		size_t len;
-		const char *format;
-		char user[MAX_USER];
-
-		user[0] = 0;
-		strncat(user, name, MAX_USER-1);
-		len = strnlen(user, UT_NAMESIZE);
-		user[len] = 0;
-		if (audit_value_needs_encoding(name, len)) {
-			audit_encode_value(user, name, len);
-			format = "op=%s acct=%s old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
-		} else
-			format = "op=%s acct=\"%s\" old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
-		snprintf(buf, sizeof(buf), format, op, user, 
-			old_seuser && strlen(old_seuser) ? old_seuser : "?",
-			old_role && strlen(old_role) ? old_role : "?",
-			old_range && strlen(old_range) ? old_range : "?",
-			new_seuser && strlen(new_seuser) ? new_seuser : "?",
-			new_role && strlen(new_role) ? new_role : "?",
-			new_range && strlen(new_range) ? new_range : "?",
-			pgname,
-			host && strlen(host) ? host : "?",
-			addrbuf,
-			tty && strlen(tty) ? tty : "?",
-			success
-			);
-	} else
-		snprintf(buf, sizeof(buf),
-		"op=%s id=%u old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)",
-			op, id,
-			old_seuser && strlen(old_seuser) ? old_seuser : "?",
-			old_role && strlen(old_role) ? old_role : "?",
-			old_range && strlen(old_range) ? old_range : "?",
-			new_seuser && strlen(new_seuser) ? new_seuser : "?",
-			new_role && strlen(new_role) ? new_role : "?",
-			new_range && strlen(new_range) ? new_range : "?",
-			pgname,
-			host && strlen(host) ? host : "?",
-			addrbuf,
-			tty && strlen(tty) ? tty : "?",
-			success
-			);
-
-	errno = 0;
-	ret = audit_send_user_message(audit_fd, type, REAL_ERR, buf);
-	if ((ret < 1) && errno == 0)
-		errno = ret;
-	return ret;
-}
-
-/*
- * This function will log a message to the audit system using a predefined
- * message format. This function should be used by all console apps that do
- * not manipulate accounts or groups.
- *
- * audit_fd - The fd returned by audit_open
- * type - type of message, ex: AUDIT_USER_CMD
- * command - the command line being logged
- * tty - The tty of the user
- * result - 1 is "success" and 0 is "failed"
- *
- * It returns the sequence number which is > 0 on success or <= 0 on error.
- */
-int audit_log_user_command(int audit_fd, int type, const char *command,
-	const char *tty, int result)
-{
-	char *p;
-	char buf[MAX_AUDIT_MESSAGE_LENGTH];
-	char commname[PATH_MAX*2];
-	char cwdname[PATH_MAX*2];
-	char ttyname[TTY_PATH];
-	char format[64];
-	const char *success;
-	char *cmd;
-	int ret, cwdenc=0, cmdenc=0;
-	unsigned int len;
-
-	if (audit_fd < 0)
-		return 0;
-
-	if (result)
-		success = "success";
-	else
-		success = "failed";
-
-	if (tty == NULL) 
-		tty = _get_tty(ttyname, TTY_PATH);
-
-	/* Trim leading spaces */
-	while (*command == ' ')
-		command++;
-
-	cmd = strdup(command);
-	if (cmd == NULL)
-		return -1;
-
-	// We borrow the commname buffer
-	if (getcwd(commname, PATH_MAX) == NULL)
-		strcpy(commname, "?");
-	len = strlen(commname);
-	if (audit_value_needs_encoding(commname, len)) {
-		audit_encode_value(cwdname, commname, len);
-		cwdenc = 1;
-	} else
-		strcpy(cwdname, commname);
-
-	len = strlen(cmd);
-	// Trim the trailing carriage return and spaces
-	while (len && (cmd[len-1] == 0x0A || cmd[len-1] == ' ')) {
-		cmd[len-1] = 0;
-		len--;
-	}
-
-	if (len >= PATH_MAX) {
-		cmd[PATH_MAX] = 0;
-		len = PATH_MAX-1;
-	}
-	if (audit_value_needs_encoding(cmd, len)) {
-		audit_encode_value(commname, cmd, len);
-		cmdenc = 1;
-	}
-	if (cmdenc == 0)
-		strcpy(commname, cmd);
-	free(cmd);
-
-	// Make the format string
-	if (cwdenc)
-		p=stpcpy(format, "cwd=%s ");
-	else
-		p=stpcpy(format, "cwd=\"%s\" ");
-
-	if (cmdenc)
-		p = stpcpy(p, "cmd=%s ");
-	else
-		p = stpcpy(p, "cmd=\"%s\" ");
-
-	strcpy(p, "(terminal=%s res=%s)");
-
-	// now use the format string to make the event
-	snprintf(buf, sizeof(buf), format,
-			cwdname, commname,
-			tty ? tty : "?",
-			success
-		);
-
-	errno = 0;
-	ret = audit_send_user_message( audit_fd, type, HIDE_IT, buf );
-	if ((ret < 1) && errno == 0)
-		errno = ret;
-	return ret;
-}
-
--- a/src/mt/deprecated.c
+++ /dev/null
@@ -1,473 +0,0 @@
-/* deprecated.c -- This file is the trash heap of things about to leave 
- * Copyright 2006-07 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- */
-
-#include "config.h"
-#include <errno.h>
-#include <string.h>
-#include <pwd.h>
-#include <grp.h>
-#include <ctype.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include "libaudit.h"
-#include "private.h"
-
-extern int audit_archadded hidden;
-extern int audit_syscalladded hidden;
-extern unsigned int audit_elf hidden;
-extern int audit_priority(int xerrno) hidden;
-
-int audit_request_rules_list(int fd)
-{
-	int rc = audit_send(fd, AUDIT_LIST, NULL, 0);
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending rule list request (%s)", 
-			strerror(-rc));
-	return rc;
-}
-hidden_def(audit_request_rules_list)
-
-int audit_add_rule(int fd, struct audit_rule *rule, int flags, int action)
-{
-	int rc;
-
-	rule->flags  = flags;
-	rule->action = action;
-	rc = audit_send(fd, AUDIT_ADD, rule, sizeof(struct audit_rule));
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending add rule request (%s)",
-				errno == EEXIST ?
-				"Rule exists" :	strerror(-rc));
-	return rc;
-}
-hidden_def(audit_add_rule)
-
-int audit_delete_rule(int fd, struct audit_rule *rule, int flags, int action)
-{
-	int rc;
-
-	rule->flags  = flags;
-	rule->action = action;
-	rc = audit_send(fd, AUDIT_DEL, rule, sizeof(struct audit_rule));
-	if (rc < 0) {
-		if (rc == -ENOENT)
-			audit_msg(LOG_WARNING,
-			"Error sending delete rule request (No rule matches)");
-		else
-			audit_msg(audit_priority(errno),
-				"Error sending delete rule request (%s)",
-				strerror(-rc));
-	}
-	return rc;
-}
-hidden_def(audit_delete_rule)
-
-/*
- * This function will send a user space message to the kernel.
- * It returns the sequence number which is > 0 on success  
- * or <= 0 on error. (pam uses this) This is the main audit sending
- * function now.
- */
-int audit_send_user_message(int fd, int type, hide_t hide_error,
-	const char *message)
-{
-	int retry_cnt = 0;
-	int rc;
-retry:
-	rc = audit_send(fd, type, message, strlen(message)+1);
-	if (rc == -ECONNREFUSED) {
-		/* This is here to let people that build their own kernel
-		   and disable the audit system get in. ECONNREFUSED is
-		   issued by the kernel when there is "no on listening". */
-		return 0;
-	} else if (rc == -EPERM && getuid() != 0 && hide_error == HIDE_IT) {
-		/* If we get this, then the kernel supports auditing
-		 * but we don't have enough privilege to write to the
-		 * socket. Therefore, we have already been authenticated
-		 * and we are a common user. Just act as though auditing
-		 * is not enabled. Any other error we take seriously.
-		 * This is here basically to satisfy Xscreensaver. */
-		return 0;
-	} else if (rc == -EINVAL) {
-		/* If we get this, the kernel doesn't understand the
-		 * netlink message type. This is most likely due to
-		 * being an old kernel. Use the old message type. */
-		if (type >= AUDIT_FIRST_USER_MSG && 
-				type <= AUDIT_LAST_USER_MSG && !retry_cnt) {
-
-			/* do retry */
-			type = AUDIT_USER;
-			retry_cnt++;
-			goto retry;
-		} 
-	}
-	return rc;
-}
-hidden_def(audit_send_user_message)
-
-int audit_rule_syscall(struct audit_rule *rule, int scall)
-{
-	int word = AUDIT_WORD(scall);
-	int bit  = AUDIT_BIT(scall);
-
-	if (word >= (AUDIT_BITMASK_SIZE-1)) 
-		return -1;
-	rule->mask[word] |= bit;
-	return 0;
-}
-hidden_def(audit_rule_syscall)
-
-int audit_rule_syscallbyname(struct audit_rule *rule,
-                             const char *scall)
-{
-	int nr, i;
-	int machine;
-
-	if (!strcmp(scall, "all")) {
-		for (i = 0; i < (AUDIT_BITMASK_SIZE-1); i++) 
-			rule->mask[i] = ~0;
-		return 0;
-	}
-	if (!audit_elf)
-		machine = audit_detect_machine();
-	else
-		machine = audit_elf_to_machine(audit_elf);
-	if (machine < 0)
-		return -2;
-	nr = audit_name_to_syscall(scall, machine);
-	if (nr < 0) {
-		if (isdigit(scall[0]))
-			nr = strtol(scall, NULL, 0);
-	}
-	if (nr >= 0) 
-		return audit_rule_syscall(rule, nr);
-	return -1;
-}
-hidden_def(audit_rule_syscallbyname)
-
-// Delete this with audit_rule_fieldpair
-static int name_to_uid(const char *name, uid_t *uid)
-{
-        struct passwd *pw;
-
-        pw = getpwnam(name);
-        if (pw == NULL)
-                return 1;
-
-        memset(pw->pw_passwd, ' ', strlen(pw->pw_passwd));
-        *uid = pw->pw_uid;
-        return 0;
-}
-
-// Delete this with audit_rule_fieldpair
-static int name_to_gid(const char *name, gid_t *gid)
-{
-        struct group *gr;
-
-        gr = getgrnam(name);
-        if (gr == NULL)
-                return 1;
-
-        *gid = gr->gr_gid;
-        return 0;
-}
-
-int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
-{
-	const char *f = pair;
-	char       *v;
-	int        op;
-	int        field;
-	int        vlen;
-    
-	if (f == NULL)
-		return -1;
-
-	/* look for 2-char operators first
-	   then look for 1-char operators afterwards
-	   when found, null out the bytes under the operators to split
-	   and set value pointer just past operator bytes
-	*/
-	if ( (v = strstr(pair, "!=")) ) {
-		*v++ = '\0';
-		*v++ = '\0';
-		op = AUDIT_NEGATE; // legacy
-		// op = AUDIT_NOT_EQUAL;
-	} else if ( (v = strstr(pair, ">")) ) {
-		return -10;
-	} else if ( (v = strstr(pair, "<")) ) {
-		return -10;
-	} else if ( (v = strstr(pair, "&")) ) {
-		return -10;
-	} else if ( (v = strstr(pair, "=")) ) {
-		*v++ = '\0';
-		op = 0; // legacy 
-		// op = AUDIT_EQUAL;
-	}
-
-	if (v == NULL)
-		return -1;
-	
-	if (*f == 0)
-		return -22;
-
-	if (*v == 0)
-		return -20;
-
-	audit_msg(LOG_DEBUG,"pair=%s\n", f);
-	if ((field = audit_name_to_field(f)) < 0) 
-		return -2;
-
-	/* Exclude filter can be used only with MSGTYPE field */
-	if (flags == AUDIT_FILTER_EXCLUDE && field != AUDIT_MSGTYPE)
-		return -12; 
-
-	audit_msg(LOG_DEBUG,"f%d%s%s\n", field, audit_operator_to_symbol(op),v);
-	rule->fields[rule->field_count] = field | op;
-	switch (field)
-	{
-		case AUDIT_UID:
-		case AUDIT_EUID:
-		case AUDIT_SUID:
-		case AUDIT_FSUID:
-		case AUDIT_LOGINUID:
-			vlen = strlen(v);
-			if (isdigit((char)*(v))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else {
-				if (name_to_uid(v, 
-					&rule->values[rule->field_count])) {
-					audit_msg(LOG_ERR, "Unknown user: %s",
-						v);
-					return -2;
-				}
-			}
-			break;
-		case AUDIT_GID:
-		case AUDIT_EGID:
-		case AUDIT_SGID:
-		case AUDIT_FSGID:
-			if (isdigit((char)*(v))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else {
-				if (name_to_gid(v, 
-					&rule->values[rule->field_count])) {
-					audit_msg(LOG_ERR, "Unknown group: %s",
-						v);
-					return -2;
-				}
-			}
-			break;
-		case AUDIT_EXIT:
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			vlen = strlen(v);
-			if (isdigit((char)*(v)))
-				rule->values[rule->field_count] =
-					strtol(v, NULL, 0);
-			else if (vlen >= 2 && *(v)=='-' &&
-					(isdigit((char)*(v+1))))
-				rule->values[rule->field_count] =
-					strtol(v, NULL, 0);
-			else {
-				rule->values[rule->field_count] =
-						audit_name_to_errno(v);
-				if (rule->values[rule->field_count] == 0) 
-					return -15;
-			}
-			break;
-		case AUDIT_MSGTYPE:
-			if (flags != AUDIT_FILTER_EXCLUDE)
-				return -9;
-
-			if (isdigit((char)*(v)))
-				rule->values[rule->field_count] =
-					strtol(v, NULL, 0);
-			else
-				if (audit_name_to_msg_type(v) > 0)
-					rule->values[rule->field_count] =
-						audit_name_to_msg_type(v);
-				else
-					return -8;
-			break;
-		case AUDIT_ARCH:
-			if (audit_syscalladded) 
-				return -3;
-			if (!(op == AUDIT_NEGATE || op == 0))
-				return -13;
-			if (isdigit((char)*(v))) {
-				int machine;
-
-				errno = 0;
-				audit_elf = strtoul(v, NULL, 0);
-				if (errno) 
-					return -5;
-
-				// Make sure we have a valid mapping
-				machine = audit_elf_to_machine(audit_elf);
-				if (machine < 0)
-					return -5;
-			}
-			else {
-				// what do we want? i686, x86_64, ia64
-				// or b64, b32
-				int machine;
-				unsigned int bits=0, elf;
-				const char *arch=v;
-				if (strcasecmp("b64", arch) == 0) {
-					bits = __AUDIT_ARCH_64BIT;
-					machine = audit_detect_machine();
-				} else if (strcasecmp("b32", arch) == 0) {
-					bits = ~__AUDIT_ARCH_64BIT;
-					machine = audit_detect_machine();
-				} 
-				else 
-					machine = audit_name_to_machine(arch);
-
-				if (machine < 0) 
-					return -4;
-
-				/* Here's where we fixup the machine.
-				 * for example, they give x86_64 & want 32 bits.
-				 * we translate that to i686. */
-				if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_86_64)
-						machine = MACH_X86;
-				else if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_PPC64)
-						machine = MACH_PPC;
-				else if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_S390X)
-						machine = MACH_S390;
-
-				/* Check for errors - return -6 
-				 * We don't allow 32 bit machines to specify 
-				 * 64 bit. */
-				switch (machine)
-				{
-					case MACH_X86:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_IA64:
-						if (bits == ~__AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_PPC:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_S390:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_86_64: /* fallthrough */
-					case MACH_PPC64: /* fallthrough */
-					case MACH_S390X: /* fallthrough */
-						break;
-					default:
-						return -6;
-				}
-
-				/* OK, we have the machine type, now convert
-				   to elf. */
-				elf = audit_machine_to_elf(machine);
-				if (elf == 0)
-					return -5;
-
-				audit_elf = elf;
-			}
-			rule->values[rule->field_count] = audit_elf;
-			audit_archadded = 1;
-			break;
-		case AUDIT_FILETYPE:
-			if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)
-				return -17;
-			rule->values[rule->field_count] =
-				audit_name_to_ftype(v);
-			if (rule->values[rule->field_count] < 0) {
-				return -16;
-			}
-			break;
-		/* These are strings */
-		case AUDIT_SUBJ_USER:
-		case AUDIT_SUBJ_ROLE:
-		case AUDIT_SUBJ_TYPE:
-		case AUDIT_SUBJ_SEN:
-		case AUDIT_SUBJ_CLR:
-		case AUDIT_OBJ_USER:
-		case AUDIT_OBJ_ROLE:
-		case AUDIT_OBJ_TYPE:
-		case AUDIT_OBJ_LEV_LOW:
-		case AUDIT_OBJ_LEV_HIGH:
-		case AUDIT_WATCH:
-		case AUDIT_PERM:
-		case AUDIT_DIR:
-		case AUDIT_FILTERKEY:
-			return -10;
-                case AUDIT_DEVMAJOR...AUDIT_INODE:
-                case AUDIT_SUCCESS:
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			/* fallthrough */
-		default:
-			if (field == AUDIT_INODE) {
-				if (!(op == AUDIT_NEGATE || op == 0))
-					return -13;
-			}
-			if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT
-				|| flags != AUDIT_FILTER_ENTRY))
-				return -17;
-			
-			if (flags == AUDIT_FILTER_EXCLUDE)
-				return -18;
-			
-			if (!isdigit((char)*(v)))
-				return -21;
-
-			rule->values[rule->field_count] = strtol(v, NULL, 0);
-			break;
-	}
-	++rule->field_count;
-	return 0;
-}
-hidden_def(audit_rule_fieldpair)
-
-void audit_rule_free(struct audit_rule *rule)
-{
-	free(rule);
-}
-hidden_def(audit_rule_free)
-
-// FIXME: delete this function after bumping the SONAME NUMBER
-int audit_log_avc(int fd, int type, const char *fmt, va_list ap)
-{
-	type = fd;
-        return 0;
-}
-hidden_def(audit_log_avc)
-
--- a/src/mt/libaudit.c
+++ /dev/null
@@ -1,1180 +0,0 @@
-/* libaudit.c -- 
- * Copyright 2004-2007 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- *      Rickard E. (Rik) Faith <faith@redhat.com>
- */
-
-#include "config.h"
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <ctype.h>
-#include <time.h>
-#include <pwd.h>
-#include <grp.h>
-#include <errno.h>
-#include <sys/poll.h>
-#include <sys/utsname.h>
-#include <fcntl.h>	/* O_NOFOLLOW needs gnu defined */
-#include <limits.h>	/* for PATH_MAX */
-
-#include "libaudit.h"
-#include "private.h"
-#include "errormsg.h"
-
-/* #defines for the audit failure query  */
-#define CONFIG_FILE "/etc/libaudit.conf"
-
-/* Local prototypes */
-struct nv_pair
-{
-        const char *name;
-        const char *value;
-};
-
-struct kw_pair
-{
-        const char *name;
-        int (*parser)(const char *, int);
-};
-
-struct nv_list
-{
-        const char *name;
-        int option;
-};
-
-struct libaudit_conf
-{
-        auditfail_t failure_action;
-};
-
-static const struct nv_list failure_actions[] =
-{
-  {"ignore",		FAIL_IGNORE },
-  {"log",		FAIL_LOG },
-  {"terminate",		FAIL_TERMINATE },
-  { NULL,		0 }
-};
-
-int audit_permadded hidden = 0;
-int audit_archadded hidden = 0;
-int audit_syscalladded hidden = 0;
-unsigned int audit_elf hidden = 0U;
-static struct libaudit_conf config;
-
-static int audit_failure_parser(const char *val, int line);
-static int audit_name_to_uid(const char *name, uid_t *uid);
-static int audit_name_to_gid(const char *name, gid_t *gid);
-
-static const struct kw_pair keywords[] =
-{
-  {"failure_action",	audit_failure_parser },
-  { NULL,		NULL }
-};
-
-/* FIXME: Make this static again after deprecated functions no longer need it */
-int hidden audit_priority(int xerrno)
-{
-	/* If they've compiled their own kernel and did not include
-	 * the audit susbsystem, they will get ECONNREFUSED. We'll
-	 * demote the message to debug so its not lost entirely. */
-	if (xerrno == ECONNREFUSED)
-		return LOG_DEBUG;
-	else
-		return LOG_WARNING;
-}
-
-int audit_request_status(int fd)
-{
-	int rc = audit_send(fd, AUDIT_GET, NULL, 0);
-	if (rc < 0) 
-		audit_msg(audit_priority(errno),
-			"Error sending status request (%s)", strerror(-rc));
-	return rc;
-}
-hidden_def(audit_request_status)
-
-/*
- * Set everything to its default value
- */
-static void clear_config(void)
-{
-        config.failure_action = FAIL_IGNORE;
-}
-
-/* Get 1 line from file */
-static char *get_line(FILE *f, char *buf, size_t len)
-{
-	if (fgets(buf, len, f)) {
-		/* remove newline */
-		char *ptr = strchr(buf, 0x0a);
-		if (ptr)
-			*ptr = 0;
-		return buf;
-	}
-	return NULL;
-}
-
-static int nv_split(char *buf, struct nv_pair *nv)
-{
-	/* Get the name part */
-	char *ptr, *saved=NULL;
-
-	nv->name = NULL;
-	nv->value = NULL;
-	ptr = strtok_r(buf, " ", &saved);
-	if (ptr == NULL)
-		return 0; /* If there's nothing, go to next line */
-	if (ptr[0] == '#')
-		return 0; /* If there's a comment, go to next line */
-	nv->name = ptr;
-
-	/* Check for a '=' */
-	ptr = strtok_r(NULL, " ", &saved);
-	if (ptr == NULL)
-		return 1;
-	if (strcmp(ptr, "=") != 0)
-		return 2;
-
-	/* get the value */
-	ptr = strtok_r(NULL, " ", &saved);
-	if (ptr == NULL)
-		return 1;
-	nv->value = ptr;
-
-	/* Make sure there's nothing else */
-	ptr = strtok_r(NULL, " ", &saved);
-	if (ptr)
-		return 1;
-
-	/* Everything is OK */
-	return 0;
-}
-
-static const struct kw_pair *kw_lookup(const char *val)
-{
-        int i = 0;
-        while (keywords[i].name != NULL) {
-                if (strcasecmp(keywords[i].name, val) == 0)
-                        break;
-                i++;
-        }
-        return &keywords[i];
-}
-
-static int audit_failure_parser(const char *val, int line)
-{
-	int i;
-
-	audit_msg(LOG_DEBUG, "audit_failure_parser called with: %s", val);
-	for (i=0; failure_actions[i].name != NULL; i++) {
-		if (strcasecmp(val, failure_actions[i].name) == 0) {
-			config.failure_action = failure_actions[i].option;
-			return 0;
-		}
-	}
-	audit_msg(LOG_ERR, "Option %s not found - line %d", val, line);
-	return 1;
-}
-
-/*
- *  Read the /etc/libaudit.conf file and all tunables.
- */
-static int load_libaudit_config(const char *path)
-{
-	int fd, rc, lineno = 1;
-	struct stat st;
-	FILE *f;
-	char buf[128];
-
-	/* open the file */
-	rc = open(path, O_NOFOLLOW|O_RDONLY);
-	if (rc < 0) {
-		if (errno != ENOENT) {
-			audit_msg(LOG_ERR, "Error opening %s (%s)",
-				path, strerror(errno));
-			return 1;
-		}
-		audit_msg(LOG_WARNING,
-			"Config file %s doesn't exist, skipping", path);
-		return 0;
-	}
-	fd = rc;
-
-	/* check the file's permissions: owned by root, not world writable,
-	 * not symlink.
-	 */
-	audit_msg(LOG_DEBUG, "Config file %s opened for parsing", path);
-	if (fstat(fd, &st) < 0) {
-		audit_msg(LOG_ERR, "Error fstat'ing %s (%s)",
-			path, strerror(errno));
-		return 1;
-	}
-	if (st.st_uid != 0) {
-		audit_msg(LOG_ERR, "Error - %s isn't owned by root", path);
-		return 1;
-	}
-	if ((st.st_mode & S_IWOTH) == S_IWOTH) {
-		audit_msg(LOG_ERR, "Error - %s is world writable", path);
-		return 1;
-	}
-	if (!S_ISREG(st.st_mode)) {
-		audit_msg(LOG_ERR, "Error - %s is not a regular file", path);
-		return 1;
-	}
-
-	/* it's ok, read line by line */
-	f = fdopen(fd, "r");
-	if (f == NULL) {
-		audit_msg(LOG_ERR, "Error - fdopen failed (%s)",
-			strerror(errno));
-		return 1;
-	}
-
-	while (get_line(f, buf, sizeof(buf))) {
-		// convert line into name-value pair
-		const struct kw_pair *kw;
-		struct nv_pair nv;
-		rc = nv_split(buf, &nv);
-		switch (rc) {
-			case 0: // fine
-				break;
-			case 1: // not the right number of tokens.
-				audit_msg(LOG_ERR,
-				"Wrong number of arguments for line %d in %s",
-					lineno, path);
-				break;
-			case 2: // no '=' sign
-				audit_msg(LOG_ERR,
-					"Missing equal sign for line %d in %s",
-					lineno, path);
-				break;
-			default: // something else went wrong...
-				audit_msg(LOG_ERR,
-					"Unknown error for line %d in %s",
-					lineno, path);
-				break;
-		}
-		if (nv.name == NULL) {
-			lineno++;
-			continue;
-		}
-		if (nv.value == NULL)
-			return 1; 
-
-		/* identify keyword or error */
-		kw = kw_lookup(nv.name);
-		if (kw->name == NULL) {
-			audit_msg(LOG_ERR,
-				"Unknown keyword \"%s\" in line %d of %s",
-				nv.name, lineno, path);
-			fclose(f);
-			return 1;
-		}
-
-		/* dispatch to keyword's local parser */
-		rc = kw->parser(nv.value, lineno);
-		if (rc != 0) {
-			fclose(f);
-			return 1; // local parser puts message out
-		}
-
-		lineno++;
-	}
-
-	fclose(f);
-	return 0;
-}
-
-
-/*
- * This function is called to get the value of the failure_action 
- * tunable stored in /etc/libaudit.conf.  The function returns 1 if
- * the tunable is not found or there is an error. If the tunable is found,
- * 0 is returned the the tunable value is saved in the failmode parameter.
- */
-int get_auditfail_action(auditfail_t *failmode)
-{
-	clear_config();
-
-	if (load_libaudit_config(CONFIG_FILE)) {
-		*failmode = config.failure_action;
-		return 1;
-	}
-
-	*failmode = config.failure_action;
-	return 0;
-}
-
-int audit_set_enabled(int fd, uint32_t enabled)
-{
-	int rc;
-	struct audit_status s;
-
-	memset(&s, 0, sizeof(s));
-	s.mask    = AUDIT_STATUS_ENABLED;
-	s.enabled = enabled;
-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending enable request (%s)", strerror(-rc));
-	return rc;
-}
-
-/* 
- * This function will return 0 if auditing is NOT enabled and
- * 1 if enabled, and -1 on error.
- */
-int audit_is_enabled(int fd)
-{
-	int rc;
-
-	if (fd < 0)
-		return 0;
-
-	if ((rc = audit_request_status(fd)) > 0) {
-		struct audit_reply rep;
-		int i;
-		int timeout = 40; /* tenths of seconds */
-		struct pollfd pfd[1];
-
-		pfd[0].fd = fd;
-		pfd[0].events = POLLIN;
-
-	        for (i = 0; i < timeout; i++) {
-			do {
-				rc = poll(pfd, 1, 100);
-			} while (rc < 0 && errno == EINTR);
-
-			rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
-			if (rc > 0) {
-                	        /* If we get done or error, break out */
-                        	if (rep.type == NLMSG_DONE || 
-					rep.type == NLMSG_ERROR)
-	                                break;
-
-        	                /* If its not status, keep looping */
-	                        if (rep.type != AUDIT_GET)
-        	                        continue;
-
-				/* Found it... */
-				return rep.status->enabled;
-			}
-		}
-	}
-	if (rc == -ECONNREFUSED) {
-		/* This is here to let people that build their own kernel
-		   and disable the audit system get in. ECONNREFUSED is
-		   issued by the kernel when there is "no on listening". */
-		return 0;
-	} else if (rc == -EPERM && getuid() != 0) {
-		/* If we get this, then the kernel supports auditing
-		 * but we don't have enough privilege to write to the
-		 * socket. Therefore, we have already been authenticated
-		 * and we are a common user. Just act as though auditing
-		 * is not enabled. Any other error we take seriously.
-		 * This is here basically to satisfy Xscreensaver. */
-		return 0;
-	}
-	return -1;
-}
-
-int audit_set_failure(int fd, uint32_t failure)
-{
-	int rc;
-	struct audit_status s;
-
-	memset(&s, 0, sizeof(s));
-	s.mask    = AUDIT_STATUS_FAILURE;
-	s.failure = failure;
-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
-	if (rc < 0)
-		audit_msg(audit_priority(errno), 
-			"Error sending failure mode request (%s)", 
-			strerror(-rc));
-	return rc;
-}
-
-/*
- * This function returns -1 on error and 1 on success.
- */
-int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode)
-{
-	struct audit_status s;
-	struct audit_reply rep;
-	struct pollfd pfd[1];
-	int rc;
-
-	memset(&s, 0, sizeof(s));
-	s.mask    = AUDIT_STATUS_PID;
-	s.pid     = pid;
-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
-	if (rc < 0) {
-		audit_msg(audit_priority(errno), 
-			"Error setting audit daemon pid (%s)", 
-			strerror(-rc));
-		return rc;
-	}
-	if (wmode == WAIT_NO)
-		return 1;
-
-	/* Now we'll see if there's any reply message. This only
-           happens on error. It is not fatal if there is no message.
-	   As a matter of fact, we don't do anything with the message
-	   besides gobble it. */
-	pfd[0].fd = fd;
-	pfd[0].events = POLLIN;
-	do {
-		rc = poll(pfd, 1, 100);	/* .1 second */
-	} while (rc < 0 && errno == EINTR);
-
-	(void)audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, 0);
-	return 1;
-}
-
-int audit_set_rate_limit(int fd, uint32_t limit)
-{
-	int rc;
-	struct audit_status s;
-
-	memset(&s, 0, sizeof(s));
-	s.mask       = AUDIT_STATUS_RATE_LIMIT;
-	s.rate_limit = limit;
-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending rate limit request (%s)", 
-			strerror(-rc));
-	return rc;
-}
-
-int audit_set_backlog_limit(int fd, uint32_t limit)
-{
-	int rc;
-	struct audit_status s;
-
-	memset(&s, 0, sizeof(s));
-	s.mask          = AUDIT_STATUS_BACKLOG_LIMIT;
-	s.backlog_limit = limit;
-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending backlog limit request (%s)", 
-			strerror(-rc));
-	return rc;
-}
-
-int audit_request_rules_list_data(int fd)
-{
-	int rc = audit_send(fd, AUDIT_LIST_RULES, NULL, 0);
-	if (rc < 0 && rc != -EINVAL)
-		audit_msg(audit_priority(errno),
-			"Error sending rule list data request (%s)", 
-			strerror(-rc));
-	return rc;
-}
-
-int audit_request_signal_info(int fd)
-{
-	int rc = audit_send(fd, AUDIT_SIGNAL_INFO, NULL, 0);
-	if (rc < 0)
-		audit_msg(LOG_WARNING,
-			"Error sending signal_info request (%s)",
-			strerror(-rc));
-	return rc;
-}
-
-int audit_update_watch_perms(struct audit_rule_data *rule, int perms)
-{
-	int i, done=0;
-
-	if (rule->field_count < 1)
-		return -1;
-
-	// First see if we have an entry we are updating
-	for (i=0; i< rule->field_count; i++) {
-		if (rule->fields[i] == AUDIT_PERM) {
-			rule->values[i] = perms;
-			done = 1;
-		}
-	}
-	if (!done) {
-		// If not check to see if we have room to add a field
-		if (rule->field_count >= (AUDIT_MAX_FIELDS - 1))
-			return -2;
-	
-		// Add the perm
-		rule->fields[rule->field_count] = AUDIT_PERM;
-		rule->fieldflags[rule->field_count] = AUDIT_EQUAL;
-		rule->values[rule->field_count] = perms;
-		rule->field_count++;
-	}
-	return 0;
-}
-
-int audit_add_watch(struct audit_rule_data **rulep, const char *path)
-{
-	return audit_add_watch_dir(AUDIT_WATCH, rulep, path);
-}
-
-int audit_add_dir(struct audit_rule_data **rulep, const char *path)
-{
-	return audit_add_watch_dir(AUDIT_DIR, rulep, path);
-}
-
-int audit_add_watch_dir(int type, struct audit_rule_data **rulep,
-			const char *path)
-{
-	size_t len = strlen(path);
-	struct audit_rule_data *rule = *rulep;
-
-	if (rule && rule->field_count) {
-		audit_msg(LOG_ERR, "Rule is not empty\n");
-		return -1;
-	}
-	if (type != AUDIT_WATCH && type != AUDIT_DIR) {
-		audit_msg(LOG_ERR, "Invalid type used\n");
-		return -1;
-	}
-
-	*rulep = realloc(rule, len + sizeof(*rule));
-	if (*rulep == NULL) {
-		free(rule);
-		audit_msg(LOG_ERR, "Cannot realloc memory!\n");
-		return -1;
-	}
-	rule = *rulep;
-	memset(rule, 0, len + sizeof(*rule));
-
-	rule->flags = AUDIT_FILTER_EXIT;
-	rule->action = AUDIT_ALWAYS;
-	audit_rule_syscallbyname_data(rule, "all");
-	rule->field_count = 2;
-	rule->fields[0] = type;
-	rule->values[0] = len;
-	rule->fieldflags[0] = AUDIT_EQUAL;
-	rule->buflen = len;
-	memcpy(&rule->buf[0], path, len);
-
-	// Default to all permissions
-	rule->fields[1] = AUDIT_PERM;
-	rule->fieldflags[1] = AUDIT_EQUAL;
-	rule->values[1] = AUDIT_PERM_READ | AUDIT_PERM_WRITE |
-				AUDIT_PERM_EXEC | AUDIT_PERM_ATTR;
-	
-	audit_permadded = 1;
-
-	return  0;
-}
-hidden_def(audit_add_watch_dir)
-
-int audit_add_rule_data(int fd, struct audit_rule_data *rule,
-                        int flags, int action)
-{
-	int rc;
-
-	rule->flags  = flags;
-	rule->action = action;
-	rc = audit_send(fd, AUDIT_ADD_RULE, rule, 
-			sizeof(struct audit_rule_data) + rule->buflen);
-	if (rc < 0)
-		audit_msg(audit_priority(errno),
-			"Error sending add rule data request (%s)",
-				errno == EEXIST ? 
-				"Rule exists" : strerror(-rc));
-	return rc;
-}
-
-int audit_delete_rule_data(int fd, struct audit_rule_data *rule,
-                           int flags, int action)
-{
-	int rc;
-
-	rule->flags  = flags;
-	rule->action = action;
-	rc = audit_send(fd, AUDIT_DEL_RULE, rule, 
-			sizeof(struct audit_rule_data) + rule->buflen);
-	if (rc < 0) {
-		if (rc == -ENOENT)
-			audit_msg(LOG_WARNING,
-			"Error sending delete rule request (No rule matches)");
-		else
-			audit_msg(audit_priority(errno),
-				"Error sending delete rule data request (%s)",
-				strerror(-rc));
-	}
-	return rc;
-}
-
-/*
- * This function is part of the directory auditing code
- */
-int audit_trim_subtrees(int fd)
-{
-	int rc = audit_send(fd, AUDIT_TRIM, NULL, 0);
-	if (rc < 0) 
-		audit_msg(audit_priority(errno),
-			"Error sending trim subtrees command (%s)",
-			strerror(-rc));
-	return rc;
-}
-
-/*
- * This function is part of the directory auditing code
- */
-int audit_make_equivalent(int fd, const char *mount_point,
-			 const char *subtree)
-{
-	int rc;
-	size_t len1 = strlen(mount_point);
-	size_t len2 = strlen(subtree);
- 	struct {
- 		uint32_t sizes[2];
- 		unsigned char buf[];
- 	} *cmd = malloc(sizeof(*cmd) + len1 + len2);
-
- 	memset(cmd, 0, sizeof(*cmd) + len1 + len2);
-
- 	cmd->sizes[0] = len1;
- 	cmd->sizes[1] = len2;
- 	memcpy(&cmd->buf[0], mount_point, len1);
- 	memcpy(&cmd->buf[len1], subtree, len2);
-
- 	rc = audit_send(fd, AUDIT_MAKE_EQUIV, cmd, sizeof(*cmd) + len1 + len2);
-	if (rc < 0) 
-		audit_msg(audit_priority(errno),
-			"Error sending make_equivalent command (%s)",
-			strerror(-rc));
-	return rc;
-}
-
-/*
- * This function will retreive the loginuid or -1 if there
- * is an error.
- */
-uid_t audit_getloginuid(void)
-{
-	uid_t uid;
-	int len, in;
-	char buf[16];
-
-	errno = 0;
-	in = open("/proc/self/loginuid", O_NOFOLLOW|O_RDONLY);
-	if (in < 0)
-		return -1;
-	do {
-		len = read(in, buf, sizeof(buf));
-	} while (len < 0 && errno == EINTR);
-	close(in);
-	if (len < 0 || len >= sizeof(buf))
-		return -1;
-	buf[len] = 0;
-	errno = 0;
-	uid = strtol(buf, 0, 10);
-	if (errno)
-		return -1;
-	else
-		return uid;
-}
-
-/*
- * This function returns 0 on success and 1 on failure
- */
-int audit_setloginuid(uid_t uid)
-{
-	char loginuid[16];
-	int o, count, rc = 0;
-
-	errno = 0;
-	count = snprintf(loginuid, sizeof(loginuid), "%u", uid);
-	o = open("/proc/self/loginuid", O_NOFOLLOW|O_WRONLY|O_TRUNC);
-	if (o >= 0) {
-		int block, offset = 0;
-
-		while (count > 0) {
-			block = write(o, &loginuid[offset], (unsigned)count);
-
-			if (block < 0) {
-				if (errno == EINTR)
-					continue;
-				audit_msg(LOG_ERR, "Error writing loginuid");
-				close(o);
-				return 1;
-			}
-			offset += block;
-			count -= block;
-		}
-		close(o);
-	} else {
-		audit_msg(LOG_ERR, "Error opening /proc/self/loginuid");
-		rc = 1;
-	}
-	return rc;
-}
-
-int audit_rule_syscall_data(struct audit_rule_data *rule, int scall)
-{
-	int word = AUDIT_WORD(scall);
-	int bit  = AUDIT_BIT(scall);
-
-	if (word >= (AUDIT_BITMASK_SIZE-1)) 
-		return -1;
-	rule->mask[word] |= bit;
-	return 0;
-}
-hidden_def(audit_rule_syscall_data)
-
-int audit_rule_syscallbyname_data(struct audit_rule_data *rule,
-                                  const char *scall)
-{
-	int nr, i;
-	int machine;
-
-	if (!strcmp(scall, "all")) {
-		for (i = 0; i < (AUDIT_BITMASK_SIZE-1); i++) 
-			rule->mask[i] = ~0;
-		return 0;
-	}
-	if (!audit_elf)
-		machine = audit_detect_machine();
-	else
-		machine = audit_elf_to_machine(audit_elf);
-	if (machine < 0)
-		return -2;
-	nr = audit_name_to_syscall(scall, machine);
-	if (nr < 0) {
-		if (isdigit(scall[0]))
-			nr = strtol(scall, NULL, 0);
-	}
-	if (nr >= 0) 
-		return audit_rule_syscall_data(rule, nr);
-	return -1;
-}
-hidden_def(audit_rule_syscallbyname_data)
-
-int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
-                              int flags)
-{
-	const char *f = pair;
-	char       *v;
-	int        op;
-	int        field;
-	int        vlen;
-	int        offset;
-	struct audit_rule_data *rule = *rulep;
-
-	if (f == NULL)
-		return -1;
-
-	/* look for 2-char operators first
-	   then look for 1-char operators afterwards
-	   when found, null out the bytes under the operators to split
-	   and set value pointer just past operator bytes
-	*/
-	if ( (v = strstr(pair, "!=")) ) {
-		*v++ = '\0';
-		*v++ = '\0';
-		op = AUDIT_NOT_EQUAL;
-	} else if ( (v = strstr(pair, ">=")) ) {
-		*v++ = '\0';
-		*v++ = '\0';
-		op = AUDIT_GREATER_THAN_OR_EQUAL;
-	} else if ( (v = strstr(pair, "<=")) ) {
-		*v++ = '\0';
-		*v++ = '\0';
-		op = AUDIT_LESS_THAN_OR_EQUAL;
-	} else if ( (v = strstr(pair, "&=")) ) {
-		*v++ = '\0';
-		*v++ = '\0';
-		op = AUDIT_BIT_TEST;
-	} else if ( (v = strstr(pair, "=")) ) {
-		*v++ = '\0';
-		op = AUDIT_EQUAL;
-	} else if ( (v = strstr(pair, ">")) ) {
-		*v++ = '\0';
-		op = AUDIT_GREATER_THAN;
-	} else if ( (v = strstr(pair, "<")) ) {
-		*v++ = '\0';
-		op = AUDIT_LESS_THAN;
-	} else if ( (v = strstr(pair, "&")) ) {
-		*v++ = '\0';
-		op = AUDIT_BIT_MASK;
-	}
-
-	if (v == NULL)
-		return -1;
-	
-	if (*f == 0)
-		return -22;
-
-	if (*v == 0)
-		return -20;
-
-	if ((field = audit_name_to_field(f)) < 0) 
-		return -2;
-
-	/* Exclude filter can be used only with MSGTYPE field */
-	if (flags == AUDIT_FILTER_EXCLUDE && field != AUDIT_MSGTYPE)
-		return -12; 
-
-	rule->fields[rule->field_count] = field;
-	rule->fieldflags[rule->field_count] = op;
-	switch (field)
-	{
-		case AUDIT_UID:
-		case AUDIT_EUID:
-		case AUDIT_SUID:
-		case AUDIT_FSUID:
-		case AUDIT_LOGINUID:
-			vlen = strlen(v);
-			if (isdigit((char)*(v))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else {
-				if (audit_name_to_uid(v, 
-					&rule->values[rule->field_count])) {
-					audit_msg(LOG_ERR, "Unknown user: %s",
-						v);
-					return -2;
-				}
-			}
-			break;
-		case AUDIT_GID:
-		case AUDIT_EGID:
-		case AUDIT_SGID:
-		case AUDIT_FSGID:
-			if (isdigit((char)*(v))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else {
-				if (audit_name_to_gid(v, 
-					&rule->values[rule->field_count])) {
-					audit_msg(LOG_ERR, "Unknown group: %s",
-						v);
-					return -2;
-				}
-			}
-			break;
-		case AUDIT_EXIT:
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			vlen = strlen(v);
-			if (isdigit((char)*(v))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else if (vlen >= 2 && *(v)=='-' && 
-						(isdigit((char)*(v+1)))) 
-				rule->values[rule->field_count] = 
-					strtol(v, NULL, 0);
-			else {
-				rule->values[rule->field_count] = 
-						audit_name_to_errno(v);
-				if (rule->values[rule->field_count] == 0) 
-					return -15;
-			}
-			break;
-		case AUDIT_MSGTYPE:
-			if (flags != AUDIT_FILTER_EXCLUDE)
-				return -9;
-
-			if (isdigit((char)*(v)))
-				rule->values[rule->field_count] =
-					strtol(v, NULL, 0);
-			else
-				if (audit_name_to_msg_type(v) > 0)
-					rule->values[rule->field_count] =
-						audit_name_to_msg_type(v);
-				else
-					return -8;
-			break;
-		/* These next few are strings */
-		case AUDIT_OBJ_USER:
-		case AUDIT_OBJ_ROLE:
-		case AUDIT_OBJ_TYPE:
-		case AUDIT_OBJ_LEV_LOW:
-		case AUDIT_OBJ_LEV_HIGH:
-		case AUDIT_WATCH:
-		case AUDIT_DIR:
-			/* Watch & object filtering is invalid on anything
-			 * but exit */
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			/* fallthrough */
-		case AUDIT_SUBJ_USER:
-		case AUDIT_SUBJ_ROLE:
-		case AUDIT_SUBJ_TYPE:
-		case AUDIT_SUBJ_SEN:
-		case AUDIT_SUBJ_CLR:
-		case AUDIT_FILTERKEY:
-			if (field == AUDIT_FILTERKEY && !(audit_syscalladded || audit_permadded))
-                                return -19;
-			vlen = strlen(v);
-			if (field == AUDIT_FILTERKEY &&
-					vlen > AUDIT_MAX_KEY_LEN)
-				return -11;
-			else if (vlen > PATH_MAX)
-				return -11;
-			rule->values[rule->field_count] = vlen;
-			offset = rule->buflen;
-			rule->buflen += vlen;
-			*rulep = realloc(rule, sizeof(*rule) + rule->buflen);
-			if (*rulep == NULL) {
-				free(rule);
-				audit_msg(LOG_ERR, "Cannot realloc memory!\n");
-				return -3;
-			} else {
-				rule = *rulep;
-			}
-			strncpy(&rule->buf[offset], v, vlen);
-
-			if(flags && (AUDIT_WATCH || AUDIT_DIR))
-				audit_permadded = 1;
-
-			break;
-		case AUDIT_ARCH:
-			if (audit_syscalladded) 
-				return -3;
-			if (!(op == AUDIT_NEGATE || op == AUDIT_EQUAL))
-				return -13;
-			if (isdigit((char)*(v))) {
-				int machine;
-
-				errno = 0;
-				audit_elf = strtoul(v, NULL, 0);
-				if (errno) 
-					return -5;
-
-				// Make sure we have a valid mapping
-				machine = audit_elf_to_machine(audit_elf);
-				if (machine < 0)
-					return -5;
-			}
-			else {
-				// what do we want? i686, x86_64, ia64
-				// or b64, b32
-				int machine;
-				unsigned int bits=0, elf;
-				const char *arch=v;
-				if (strcasecmp("b64", arch) == 0) {
-					bits = __AUDIT_ARCH_64BIT;
-					machine = audit_detect_machine();
-				} else if (strcasecmp("b32", arch) == 0) {
-					bits = ~__AUDIT_ARCH_64BIT;
-					machine = audit_detect_machine();
-				} 
-				else 
-					machine = audit_name_to_machine(arch);
-
-				if (machine < 0) 
-					return -4;
-
-				/* Here's where we fixup the machine.
-				 * for example, they give x86_64 & want 32 bits.
-				 * we translate that to i686. */
-				if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_86_64)
-						machine = MACH_X86;
-				else if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_PPC64)
-						machine = MACH_PPC;
-				else if (bits == ~__AUDIT_ARCH_64BIT &&
-					machine == MACH_S390X)
-						machine = MACH_S390;
-
-				/* Check for errors - return -6 
-				 * We don't allow 32 bit machines to specify 
-				 * 64 bit. */
-				switch (machine)
-				{
-					case MACH_X86:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_IA64:
-						if (bits == ~__AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_PPC:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_S390:
-						if (bits == __AUDIT_ARCH_64BIT)
-							return -6;
-						break;
-					case MACH_86_64: /* fallthrough */
-					case MACH_PPC64: /* fallthrough */
-					case MACH_S390X: /* fallthrough */
-						break;
-					default:
-						return -6;
-				}
-
-				/* OK, we have the machine type, now convert
-				   to elf. */
-				elf = audit_machine_to_elf(machine);
-				if (elf == 0)
-					return -5;
-
-				audit_elf = elf;
-			}
-			rule->values[rule->field_count] = audit_elf; 
-			audit_archadded = 1;
-			break;
-		case AUDIT_PERM:
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			else if (op != AUDIT_EQUAL)
-				return -13;
-			else {
-				unsigned int i, len, val = 0;
-
-				len = strlen(v);
-				if (len > 4)
-					return -11;
-
-				for (i = 0; i < len; i++) {
-					switch (tolower(v[i])) {
-						case 'r':
-							val |= AUDIT_PERM_READ;
-							break;
-						case 'w':
-							val |= AUDIT_PERM_WRITE;
-							break;
-						case 'x':
-							val |= AUDIT_PERM_EXEC;
-							break;
-						case 'a':
-							val |= AUDIT_PERM_ATTR;
-							break;
-						default:
-							return -14;
-					}
-				}
-				rule->values[rule->field_count] = val;
-			}
-			break;
-		case AUDIT_FILETYPE:
-			if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)
-				return -17;
-			rule->values[rule->field_count] = 
-				audit_name_to_ftype(v);
-			if (rule->values[rule->field_count] < 0) {
-				return -16;
-			}
-			break;
-		case AUDIT_DEVMAJOR...AUDIT_INODE:
-		case AUDIT_SUCCESS:
-			if (flags != AUDIT_FILTER_EXIT)
-				return -7;
-			/* fallthrough */
-		default:
-			if (field == AUDIT_INODE) {
-				if (!(op == AUDIT_NEGATE || op == AUDIT_EQUAL))
-					return -13;
-			}
-
-			if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT 
-				|| flags != AUDIT_FILTER_ENTRY))
-				return -17;
-			
-			if (flags == AUDIT_FILTER_EXCLUDE)
-				return -18;
-
-			if (!isdigit((char)*(v)))
-				return -21;
-
-			rule->values[rule->field_count] = strtol(v, NULL, 0);
-			break;
-	}
-	rule->field_count++;
-	return 0;
-}
-
-void audit_rule_free_data(struct audit_rule_data *rule)
-{
-	free(rule);
-}
-
-static int audit_name_to_uid(const char *name, uid_t *uid)
-{
-	struct passwd *pw;
-
-	pw = getpwnam(name);
-	if (pw == NULL) 
-		return 1;
-
-	memset(pw->pw_passwd, ' ', strlen(pw->pw_passwd));
-	*uid = pw->pw_uid;
-	return 0;
-}
-
-static int audit_name_to_gid(const char *name, gid_t *gid)
-{
-	struct group *gr;
-
-	gr = getgrnam(name);
-	if (gr == NULL) 
-		return 1;
- 
-	*gid = gr->gr_gid;
-	return 0;
-}
-
-int audit_detect_machine(void)
-{
-	struct utsname uts;
-	if (uname(&uts) == 0)
-//		strcpy(uts.machine, "x86_64");
-		return audit_name_to_machine(uts.machine);
-	return -1;
-}
-hidden_def(audit_detect_machine)
-
-void audit_number_to_errmsg(int errnumber, const char *opt)
-{
-	unsigned int i;
-	
-	for (i = 0; i < sizeof(err_msgtab)/sizeof(struct msg_tab); i++) {
-		if (err_msgtab[i].key == errnumber) {
-			switch (err_msgtab[i].position)
-			{
-				case 0:
-					fprintf(stderr, "%s\n",
-						err_msgtab[i].cvalue);
-					break;
-				case 1:
-					fprintf(stderr, "%s %s\n", opt,
-						err_msgtab[i].cvalue);
-					break;
-				case 2:
-					fprintf(stderr, "%s %s\n",
-						err_msgtab[i].cvalue, opt);
-					break;
-				default:
-					break;
-			}
-			return;
-		}
-	}
-}
--- a/src/mt/libaudit.h
+++ /dev/null
@@ -1,565 +0,0 @@
-/* libaudit.h -- 
- * Copyright 2004-2007 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- * 
- * Authors:
- *	Steve Grubb <sgrubb@redhat.com>
- *	Rickard E. (Rik) Faith <faith@redhat.com>
- */
-#ifndef _LIBAUDIT_H_
-#define _LIBAUDIT_H_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-
-#include <asm/types.h>
-#include <stdint.h>
-#include <sys/socket.h>
-#include <linux/netlink.h>
-#include <linux/audit.h>
-#include <stdarg.h>
-#include <syslog.h>
-
-
-/* Audit message types:
- * 1000 - 1099 are for commanding the audit system
- * 1100 - 1199 user space trusted application messages
- * 1200 - 1299 messages internal to the audit daemon
- * 1300 - 1399 audit event messages
- * 1400 - 1499 kernel SE Linux use
- * 1500 - 1599 AppArmor events
- * 1600 - 1699 kernel crypto events
- * 1700 - 1799 kernel anomaly records
- * 1800 - 1999 future kernel use (maybe integrity labels and related events)
- * 2001 - 2099 unused (kernel)
- * 2100 - 2199 user space anomaly records
- * 2200 - 2299 user space actions taken in response to anomalies
- * 2300 - 2399 user space generated LSPP events
- * 2400 - 2499 user space crypto events
- * 2500 - 2999 future user space (maybe integrity labels and related events)
- */
-
-#define AUDIT_FIRST_USER_MSG    1100    /* First user space message */
-#define AUDIT_LAST_USER_MSG     1199    /* Last user space message */
-#define AUDIT_USER_AUTH         1100    /* User space authentication */
-#define AUDIT_USER_ACCT         1101    /* User space acct change */
-#define AUDIT_USER_MGMT         1102    /* User space acct management */
-#define AUDIT_CRED_ACQ          1103    /* User space credential acquired */
-#define AUDIT_CRED_DISP         1104    /* User space credential disposed */
-#define AUDIT_USER_START        1105    /* User space session start */
-#define AUDIT_USER_END          1106    /* User space session end */
-#define AUDIT_USER_AVC          1107    /* User space avc message */
-#define AUDIT_USER_CHAUTHTOK	1108	/* User space acct attr changed */
-#define AUDIT_USER_ERR		1109	/* User space acct state err */
-#define AUDIT_CRED_REFR         1110    /* User space credential refreshed */
-#define AUDIT_USYS_CONFIG       1111    /* User space system config change */
-#define AUDIT_USER_LOGIN	1112    /* User space user has logged in */
-#define AUDIT_USER_LOGOUT	1113    /* User space user has logged out */
-#define AUDIT_ADD_USER		1114    /* User space user account added */
-#define AUDIT_DEL_USER		1115    /* User space user account deleted */
-#define AUDIT_ADD_GROUP		1116    /* User space group added */
-#define AUDIT_DEL_GROUP		1117    /* User space group deleted */
-#define AUDIT_DAC_CHECK		1118    /* User space DAC check results */
-#define AUDIT_CHGRP_ID		1119    /* User space group ID changed */
-#define AUDIT_TEST		1120	/* Used for test success messages */
-#define AUDIT_TRUSTED_APP	1121	/* Trusted app msg - freestyle text */
-#define AUDIT_USER_SELINUX_ERR	1122	/* SE Linux user space error */
-#define AUDIT_USER_CMD		1123	/* User shell command and args */
-#define AUDIT_USER_TTY		1124	/* Non-ICANON TTY input meaning */
-#define AUDIT_CHUSER_ID		1125	/* Changed user ID supplemental data */
-#define AUDIT_GRP_AUTH		1126	/* Authentication for group password */
-
-#define AUDIT_FIRST_DAEMON	1200
-#define AUDIT_LAST_DAEMON	1299
-#define AUDIT_DAEMON_RECONFIG	1204	/* Auditd should reconfigure */
-#define AUDIT_DAEMON_ROTATE	1205	/* Auditd should rotate logs */
-#define AUDIT_DAEMON_RESUME	1206	/* Auditd should resume logging */
-#define AUDIT_DAEMON_ACCEPT	1207    /* Auditd accepted remote connection */
-#define AUDIT_DAEMON_CLOSE	1208    /* Auditd closed remote connection */
-
-#define AUDIT_FIRST_EVENT	1300
-#define AUDIT_LAST_EVENT	1399
-#ifndef AUDIT_KERNEL_OTHER
-#define AUDIT_CWD               1307    /* Current working directory */
-#define AUDIT_EXECVE            1309    /* execve arguments */
-#define AUDIT_IPC_SET_PERM      1311    /* IPC new permissions record type */
-#define AUDIT_MQ_OPEN           1312    /* POSIX MQ open record type */
-#define AUDIT_MQ_SENDRECV       1313    /* POSIX MQ send/receive record type */
-#define AUDIT_MQ_NOTIFY         1314    /* POSIX MQ notify record type */
-#define AUDIT_MQ_GETSETATTR     1315    /* POSIX MQ get/set attribute record type */
-#define AUDIT_KERNEL_OTHER      1316    /* For use by 3rd party modules */
-#endif
-#ifndef AUDIT_FD_PAIR
-#define AUDIT_FD_PAIR		1317	/* audit record for pipe/socketpair */
-#endif
-#ifndef AUDIT_OBJ_PID
-#define AUDIT_OBJ_PID		1318	/* signal or ptrace target */
-#endif
-#ifndef AUDIT_TTY
-#define AUDIT_TTY		1319	/* Input on an administrative TTY */
-#endif
-#ifndef AUDIT_EOE
-#define AUDIT_EOE		1320	/* End of event */
-#endif
-
-#define AUDIT_FIRST_SELINUX	1400
-#define AUDIT_LAST_SELINUX	1499
-
-/* For new kernel messages */
-#ifndef AUDIT_MAC_POLICY_LOAD
-#define AUDIT_MAC_POLICY_LOAD	1403    /* Policy file load */
-#define AUDIT_MAC_STATUS	1404    /* Changed enforcing,permissive,off */
-#define AUDIT_MAC_CONFIG_CHANGE	1405    /* Changes to booleans */
-#endif
-#ifndef AUDIT_MAC_UNLBL_ALLOW
-#define AUDIT_MAC_UNLBL_ALLOW	1406    /* NetLabel: allow unlabeled traffic */
-#define AUDIT_MAC_CIPSOV4_ADD	1407    /* NetLabel: add CIPSOv4 DOI entry */
-#define AUDIT_MAC_CIPSOV4_DEL	1408    /* NetLabel: del CIPSOv4 DOI entry */
-#define AUDIT_MAC_MAP_ADD	1409    /* NetLabel: add LSM domain mapping */
-#define AUDIT_MAC_MAP_DEL	1410    /* NetLabel: del LSM domain mapping */
-#endif
-#ifndef AUDIT_MAC_IPSEC_ADDSA
-#define AUDIT_MAC_IPSEC_ADDSA	1411    /* Add a XFRM state */
-#define AUDIT_MAC_IPSEC_DELSA	1412    /* Delete a XFRM state */
-#define AUDIT_MAC_IPSEC_ADDSPD	1413    /* Add a XFRM policy */
-#define AUDIT_MAC_IPSEC_DELSPD	1414    /* Delete a XFRM policy */
-#endif
-#define AUDIT_FIRST_APPARMOR		1500
-#define AUDIT_LAST_APPARMOR		1599
-#ifndef AUDIT_AA
-#define AUDIT_AA			1500	/* Not upstream yet */
-#define AUDIT_APPARMOR_AUDIT		1501
-#define AUDIT_APPARMOR_ALLOWED		1502
-#define AUDIT_APPARMOR_DENIED		1503
-#define AUDIT_APPARMOR_HINT		1504
-#define AUDIT_APPARMOR_STATUS		1505
-#define AUDIT_APPARMOR_ERROR		1506
-#endif
-
-#define AUDIT_FIRST_KERN_CRYPTO_MSG	1600
-#define AUDIT_LAST_KERN_CRYPTO_MSG	1699
-
-#ifndef AUDIT_ANOM_PROMISCUOUS
-#define AUDIT_FIRST_KERN_ANOM_MSG	1700
-#define AUDIT_LAST_KERN_ANOM_MSG	1799
-#define AUDIT_ANOM_PROMISCUOUS		1700 // Device changed promiscuous mode
-#endif
-#ifndef AUDIT_ANOM_ABEND
-#define AUDIT_ANOM_ABEND		1701 /* Process ended abnormally */
-#endif
-#define AUDIT_FIRST_ANOM_MSG		2100
-#define AUDIT_LAST_ANOM_MSG		2199
-#define AUDIT_ANOM_LOGIN_FAILURES	2100 // Failed login limit reached
-#define AUDIT_ANOM_LOGIN_TIME		2101 // Login attempted at bad time
-#define AUDIT_ANOM_LOGIN_SESSIONS	2102 // Max concurrent sessions reached
-#define AUDIT_ANOM_LOGIN_ACCT		2103 // Login attempted to watched acct
-#define AUDIT_ANOM_LOGIN_LOCATION	2104 // Login from forbidden location
-#define AUDIT_ANOM_MAX_DAC		2105 // Max DAC failures reached
-#define AUDIT_ANOM_MAX_MAC		2106 // Max MAC failures reached
-#define AUDIT_ANOM_AMTU_FAIL		2107 // AMTU failure
-#define AUDIT_ANOM_RBAC_FAIL		2108 // RBAC self test failure
-#define AUDIT_ANOM_RBAC_INTEGRITY_FAIL	2109 // RBAC file integrity failure
-#define AUDIT_ANOM_CRYPTO_FAIL		2110 // Crypto system test failure
-#define AUDIT_ANOM_ACCESS_FS		2111 // Access of file or dir
-#define AUDIT_ANOM_EXEC			2112 // Execution of file
-#define AUDIT_ANOM_MK_EXEC		2113 // Make an executable
-#define AUDIT_ANOM_ADD_ACCT		2114 // Adding an acct
-#define AUDIT_ANOM_DEL_ACCT		2115 // Deleting an acct
-#define AUDIT_ANOM_MOD_ACCT		2116 // Changing an acct
-#define AUDIT_ANOM_ROOT_TRANS		2117 // User became root
-
-#define AUDIT_FIRST_ANOM_RESP		2200
-#define AUDIT_LAST_ANOM_RESP		2299
-#define AUDIT_RESP_ANOMALY		2200 /* Anomaly not reacted to */
-#define AUDIT_RESP_ALERT		2201 /* Alert email was sent */
-#define AUDIT_RESP_KILL_PROC		2202 /* Kill program */
-#define AUDIT_RESP_TERM_ACCESS		2203 /* Terminate session */
-#define AUDIT_RESP_ACCT_REMOTE		2204 /* Acct locked from remote access*/
-#define AUDIT_RESP_ACCT_LOCK_TIMED	2205 /* User acct locked for time */
-#define AUDIT_RESP_ACCT_UNLOCK_TIMED	2206 /* User acct unlocked from time */
-#define AUDIT_RESP_ACCT_LOCK		2207 /* User acct was locked */
-#define AUDIT_RESP_TERM_LOCK		2208 /* Terminal was locked */
-#define AUDIT_RESP_SEBOOL		2209 /* Set an SE Linux boolean */
-#define AUDIT_RESP_EXEC			2210 /* Execute a script */
-#define AUDIT_RESP_SINGLE		2211 /* Go to single user mode */
-#define AUDIT_RESP_HALT			2212 /* take the system down */
-
-#define AUDIT_FIRST_USER_LSPP_MSG	2300
-#define AUDIT_LAST_USER_LSPP_MSG	2399
-#define AUDIT_USER_ROLE_CHANGE		2300 /* User changed to a new role */
-#define AUDIT_ROLE_ASSIGN		2301 /* Admin assigned user to role */
-#define AUDIT_ROLE_REMOVE		2302 /* Admin removed user from role */
-#define AUDIT_LABEL_OVERRIDE		2303 /* Admin is overriding a label */
-#define AUDIT_LABEL_LEVEL_CHANGE	2304 /* Object's level was changed */
-#define AUDIT_USER_LABELED_EXPORT	2305 /* Object exported with label */
-#define AUDIT_USER_UNLABELED_EXPORT	2306 /* Object exported without label */
-#define AUDIT_DEV_ALLOC			2307 /* Device was allocated */
-#define AUDIT_DEV_DEALLOC		2308 /* Device was deallocated */
-#define AUDIT_FS_RELABEL		2309 /* Filesystem relabeled */
-#define AUDIT_USER_MAC_POLICY_LOAD	2310 /* Userspc daemon loaded policy */
-
-#define AUDIT_FIRST_CRYPTO_MSG		2400
-#define AUDIT_LAST_CRYPTO_MSG		2499
-
-#ifndef AUDIT_FIRST_USER_MSG2
-#define AUDIT_FIRST_USER_MSG2  2100    /* More userspace messages */
-#define AUDIT_LAST_USER_MSG2   2999
-#endif
-
-/* These are from the watching subtrees patch */
-#ifndef AUDIT_TRIM
-#define AUDIT_TRIM              1014    /* Trim junk from watched tree */
-#define AUDIT_MAKE_EQUIV        1015    /* Append to watched tree */
-#endif
-
-/* These are from the audit by tty patch */
-#ifndef AUDIT_TTY_GET
-#define AUDIT_TTY_GET		1016	/* Get TTY auditing status */
-#define AUDIT_TTY_SET		1017	/* Set TTY audit status */
-#endif
-
-#ifndef AUDIT_MAC_IPSEC_EVENT
-#define AUDIT_MAC_IPSEC_EVENT   1415    /* Audit an IPSec event */
-#endif
-#ifndef AUDIT_MAC_UNLBL_STCADD
-#define AUDIT_MAC_UNLBL_STCADD  1416    /* NetLabel: add a static label */
-#define AUDIT_MAC_UNLBL_STCDEL  1417    /* NetLabel: del a static label */
-#endif
-
-
-/* This is for the new operator patch */
-#ifndef AUDIT_BIT_MASK
-#define AUDIT_BIT_MASK			0x08000000
-#endif
-#ifndef AUDIT_LESS_THAN 
-#define AUDIT_LESS_THAN			0x10000000
-#define AUDIT_GREATER_THAN		0x20000000
-#define AUDIT_NOT_EQUAL			0x30000000
-#define AUDIT_EQUAL			0x40000000
-#define AUDIT_LESS_THAN_OR_EQUAL	(AUDIT_LESS_THAN|AUDIT_EQUAL)
-#define AUDIT_GREATER_THAN_OR_EQUAL	(AUDIT_GREATER_THAN|AUDIT_EQUAL)
-#define AUDIT_OPERATORS			(AUDIT_EQUAL|AUDIT_NOT_EQUAL)
-#endif
-#ifndef AUDIT_BIT_TEST
-#define AUDIT_BIT_TEST		(AUDIT_BIT_MASK|AUDIT_EQUAL)
-#undef  AUDIT_OPERATORS
-#define AUDIT_OPERATORS		(AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK)
-#endif
-
-/* This is for the new rule field definitions */
-#ifndef AUDIT_MSGTYPE
-#define AUDIT_MSGTYPE 12
-#endif
-
-/* This is from the audit by role patch */
-#ifndef AUDIT_SUBJ_USER
-#define AUDIT_SUBJ_USER     13
-#define AUDIT_SUBJ_ROLE     14
-#define AUDIT_SUBJ_TYPE     15
-#define AUDIT_SUBJ_SEN      16
-#define AUDIT_SUBJ_CLR      17
-#define AUDIT_OBJ_USER      19
-#define AUDIT_OBJ_ROLE      20
-#define AUDIT_OBJ_TYPE      21
-#define AUDIT_OBJ_LEV_LOW   22
-#define AUDIT_OBJ_LEV_HIGH  23
-#endif
-
-#ifndef AUDIT_PPID
-#define AUDIT_PPID          18
-#endif
-
-/* This is from the file system auditing patch */
-#ifndef AUDIT_WATCH
-#define AUDIT_WATCH         105	/* This is a field in syscall rule */
-#endif
-
-/* Defines for syscall classes - watch permissions */
-#ifndef AUDIT_PERM
-#define AUDIT_PERM		106	/* This is a field in syscall rule */
-#define AUDIT_PERM_EXEC		1
-#define AUDIT_PERM_WRITE	2
-#define AUDIT_PERM_READ		4
-#define AUDIT_PERM_ATTR		8
-#endif
-
-/* This is from the directory auditing patch */
-#ifndef AUDIT_DIR
-#define AUDIT_DIR           107
-#endif
-
-/* This is from the filetype patch */
-#ifndef AUDIT_FILETYPE
-#define AUDIT_FILETYPE      108
-#endif
-
-/* This is from filterkey patch */
-#ifndef AUDIT_FILTERKEY
-#define AUDIT_FILTERKEY     210
-#define AUDIT_MAX_KEY_LEN   32
-#endif
-#define AUDIT_KEY_SEPARATOR 0x01
-
-/* This is new list defines from audit.h */
-#ifndef AUDIT_FILTER_USER
-#define AUDIT_FILTER_USER       0x00    /* Apply rule to user-generated messages */
-#endif
-#ifndef AUDIT_FILTER_TASK
-#define AUDIT_FILTER_TASK       0x01    /* Apply rule at task creation (not syscall) */
-#endif
-#ifndef AUDIT_FILTER_ENTRY
-#define AUDIT_FILTER_ENTRY      0x02    /* Apply rule at syscall entry */
-#endif
-#ifndef AUDIT_FILTER_EXIT
-#define AUDIT_FILTER_EXIT       0x04    /* Apply rule at syscall exit */
-#endif
-#ifndef AUDIT_FILTER_EXCLUDE
-#define AUDIT_FILTER_EXCLUDE    0x05    /* Remove event type before sending */
-#endif
-#define AUDIT_FILTER_MASK	0x07	/* Mask to get actual filter */
-#ifndef AUDIT_FILTER_PREPEND
-#define AUDIT_FILTER_PREPEND    0x10    /* Prepend to front of list */
-#endif
-#define AUDIT_FILTER_UNSET	0x80	/* This value means filter is unset */
-
-/* This is the machine type list */
-typedef enum {
-	MACH_X86=0,
-	MACH_86_64,
-	MACH_IA64,
-	MACH_PPC64,
-	MACH_PPC,
-	MACH_S390X,
-	MACH_S390,
-        MACH_ALPHA
-} machine_t;
-
-/* These are the valid audit failure tunable enum values */
-typedef enum {
-	FAIL_IGNORE=0,
-	FAIL_LOG,
-	FAIL_TERMINATE
-} auditfail_t;
-
-/*
- * audit_rule_data supports filter rules with both integer and string
- * fields. It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and
- * AUDIT_LIST_RULES requests.
- */
-#ifndef AUDIT_ADD_RULE
-#define AUDIT_ADD_RULE		1011    /* Add syscall filtering rule */
-#define AUDIT_DEL_RULE		1012    /* Delete syscall filtering rule */
-#define AUDIT_LIST_RULES	1013    /* List syscall filtering rules */
-
-struct audit_rule_data {
-	uint32_t	flags;  /* AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND */
-	uint32_t	action; /* AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS */
-	uint32_t	field_count;
-	uint32_t	mask[AUDIT_BITMASK_SIZE];
-	uint32_t	fields[AUDIT_MAX_FIELDS];
-	uint32_t	values[AUDIT_MAX_FIELDS];
-	uint32_t	fieldflags[AUDIT_MAX_FIELDS];
-	uint32_t	buflen; /* total length of string fields */
-	char		buf[0]; /* string fields buffer */
-};
-#endif
-
-//////////////////////////////////////////////////////
-// This is an external ABI. Any changes in here will
-// likely affect pam_loginuid. There might be other
-// apps that use this low level interface, but I don't
-// know of any.
-//
-/* data structure for who signaled the audit daemon */
-struct audit_sig_info {
-        uid_t           uid;
-        pid_t           pid;
-	char		ctx[0];
-};
-
-/* defines for audit subsystem */
-#define MAX_AUDIT_MESSAGE_LENGTH    8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1
-struct audit_message {
-	struct nlmsghdr nlh;
-	char   data[MAX_AUDIT_MESSAGE_LENGTH];
-};
-
-// internal - forward declaration
-struct daemon_conf;
-
-struct audit_reply {
-	int                      type;
-	int                      len;
-	struct nlmsghdr         *nlh;
-	struct audit_message     msg;
-
-	/* Using a union to compress this structure since only one of
-	 * the following should be valid for any packet. */
-	union {
-	struct audit_status     *status;
-	struct audit_rule       *rule;
-	struct audit_rule_data  *ruledata;
-	struct audit_login      *login;
-	const char              *message;
-	struct nlmsgerr         *error;
-	struct audit_sig_info   *signal_info;
-	struct daemon_conf      *conf;
-	};
-};
-
-//
-// End of ABI control
-//////////////////////////////////////////////////////
-
-//////////////////////////////////////////////////////
-// audit dispatcher interface
-//
-/* audit_dispatcher_header: This header is versioned. If anything gets
- * added to it, it must go at the end and the version number bumped.
- * This MUST BE fixed size for compatibility. If you are going to add
- * new member then add them into _structure_ part.
- */
-struct audit_dispatcher_header {
-	uint32_t	ver;	/* The version of this protocol */
-	uint32_t	hlen;	/* Header length */
-	uint32_t	type;	/* Message type */
-	uint32_t	size;	/* Size of data following the header */
-};
-
-#define AUDISP_PROTOCOL_VER 0
-
-///////////////////////////////////////////////////
-// Libaudit API
-//
-/* Messages */
-typedef enum { MSG_STDERR, MSG_SYSLOG, MSG_QUIET } message_t;
-typedef enum { DBG_NO, DBG_YES } debug_message_t;
-void set_aumessage_mode(message_t mode, debug_message_t debug);
-
-/* General */
-typedef enum { GET_REPLY_BLOCKING=0, GET_REPLY_NONBLOCKING } reply_t;
-extern int  audit_open(void);
-extern void audit_close(int fd);
-extern int  audit_get_reply(int fd, struct audit_reply *rep, reply_t block, 
-		int peek);
-extern uid_t audit_getloginuid(void);
-extern int  audit_setloginuid(uid_t uid);
-extern int  audit_detect_machine(void);
-
-/* Translation functions */
-extern int        audit_name_to_field(const char *field);
-extern const char *audit_field_to_name(int field);
-extern int        audit_name_to_syscall(const char *sc, int machine);
-extern const char *audit_syscall_to_name(int sc, int machine);
-extern int        audit_name_to_flag(const char *flag);
-extern const char *audit_flag_to_name(int flag);
-extern int        audit_name_to_action(const char *action);
-extern const char *audit_action_to_name(int action);
-extern int        audit_name_to_msg_type(const char *msg_type);
-extern const char *audit_msg_type_to_name(int msg_type);
-extern int        audit_name_to_machine(const char *machine);
-extern const char *audit_machine_to_name(int machine);
-extern unsigned int audit_machine_to_elf(int machine);
-extern int          audit_elf_to_machine(unsigned int elf);
-extern const char *audit_operator_to_symbol(int op);
-extern int        audit_name_to_errno(const char *error);
-extern const char *audit_errno_to_name(int error);
-extern int        audit_name_to_ftype(const char *name);
-extern const char *audit_ftype_to_name(int ftype); 
-extern void audit_number_to_errmsg(int errnumber, const char *opt);
-
-/* AUDIT_GET */
-extern int audit_request_status(int fd);
-extern int audit_is_enabled(int fd);
-extern int get_auditfail_action(auditfail_t *failmode);
-
-/* AUDIT_SET */
-typedef enum { WAIT_NO, WAIT_YES } rep_wait_t;
-extern int  audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode);
-extern int  audit_set_enabled(int fd, uint32_t enabled);
-extern int  audit_set_failure(int fd, uint32_t failure);
-extern int  audit_set_rate_limit(int fd, uint32_t limit);
-extern int  audit_set_backlog_limit(int fd, uint32_t limit);
-
-/* AUDIT_LIST */
-extern int  audit_request_rules_list_data(int fd);
-
-/* SIGNAL_INFO */
-extern int audit_request_signal_info(int fd);
-
-/* AUDIT_WATCH */
-extern int audit_update_watch_perms(struct audit_rule_data *rule, int perms);
-extern int audit_add_watch(struct audit_rule_data **rulep, const char *path);
-extern int audit_add_dir(struct audit_rule_data **rulep, const char *path);
-extern int audit_add_watch_dir(int type, struct audit_rule_data **rulep,
-				const char *path);
-extern int audit_trim_subtrees(int fd);
-extern int audit_make_equivalent(int fd, const char *mount_point,
-				const char *subtree);
-
-/* AUDIT_ADD */
-extern int  audit_add_rule_data(int fd, struct audit_rule_data *rule,
-                                int flags, int action);
-
-/* AUDIT_DEL */
-extern int  audit_delete_rule_data(int fd, struct audit_rule_data *rule,
-                                   int flags, int action);
-
-/* The following are for standard formatting of messages */
-extern int audit_value_needs_encoding(const char *str, unsigned int len);
-extern char *audit_encode_value(char *final,const char *buf,unsigned int size);
-extern char *audit_encode_nv_string(const char *name, const char *value,
-	unsigned int vlen);
-extern int audit_log_user_message(int audit_fd, int type, const char *message,
-        const char *hostname, const char *addr, const char *tty, int result);
-extern int audit_log_user_comm_message(int audit_fd, int type,
-	const char *message, const char *comm, const char *hostname,
-	const char *addr, const char *tty, int result);
-extern int audit_log_acct_message(int audit_fd, int type, const char *pgname,
-        const char *op, const char *name, unsigned int id,
-        const char *host, const char *addr, const char *tty, int result);
-extern int audit_log_user_avc_message(int audit_fd, int type, 
-	const char *message, const char *hostname, const char *addr, 
-	const char *tty, uid_t uid);
-extern int audit_log_semanage_message(int audit_fd, int type,
-	const char *pgname, const char *op, const char *name, unsigned int id,
-        const char *new_seuser, const char *new_role, const char *new_range,
-	const char *old_seuser, const char *old_role, const char *old_range,
-	const char *host, const char *addr,
-        const char *tty, int result);
-extern int audit_log_user_command(int audit_fd, int type, const char *command,
-        const char *tty, int result);
-
-/* Rule-building helper functions */
-extern int  audit_rule_syscall_data(struct audit_rule_data *rule, int scall);
-extern int  audit_rule_syscallbyname_data(struct audit_rule_data *rule,
-                                          const char *scall);
-/* Note that the following function takes a **, where audit_rule_fieldpair()
- * takes just a *.  That structure may need to be reallocated as a result of
- * adding new fields */
-extern int  audit_rule_fieldpair_data(struct audit_rule_data **rulep,
-                                      const char *pair, int flags);
-extern void audit_rule_free_data(struct audit_rule_data *rule);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
--- a/src/mt/lookup_table.c
+++ /dev/null
@@ -1,296 +0,0 @@
-/* lookup_table.c -- 
- * Copyright 2004-2008 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- *      Rickard E. (Rik) Faith <faith@redhat.com>
- */
-
-#include "config.h"
-#include <stddef.h>
-#include <stdint.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <errno.h>
-
-#include "libaudit.h"
-#include "gen_tables.h"
-#include "private.h"
-
-#include "alpha_tables.h"
-#include "i386_tables.h"
-#include "ia64_tables.h"
-#include "ppc_tables.h"
-#include "s390_tables.h"
-#include "s390x_tables.h"
-#include "x86_64_tables.h"
-#include "actiontabs.h"
-#include "errtabs.h"
-#include "fieldtabs.h"
-#include "flagtabs.h"
-#include "ftypetabs.h"
-#include "machinetabs.h"
-#include "msg_typetabs.h"
-#include "optabs.h"
-
-struct int_transtab {
-    int        key;
-    unsigned int  lvalue;
-};
-
-static const struct int_transtab elftab[] = {
-    { MACH_X86,     AUDIT_ARCH_I386   },
-    { MACH_86_64,   AUDIT_ARCH_X86_64 },
-    { MACH_IA64,    AUDIT_ARCH_IA64   },
-    { MACH_PPC64,   AUDIT_ARCH_PPC64  },
-    { MACH_PPC,     AUDIT_ARCH_PPC    },
-    { MACH_S390X,   AUDIT_ARCH_S390X  },
-    { MACH_S390,    AUDIT_ARCH_S390   },
-    { MACH_ALPHA,   AUDIT_ARCH_ALPHA  }
-};
-#define AUDIT_ELF_NAMES (sizeof(elftab)/sizeof(elftab[0]))
-
-int audit_name_to_field(const char *field)
-{
-	int res;
-
-	if (field_s2i(field, &res) != 0)
-		return res;
-	return -1;
-}
-hidden_def(audit_name_to_field)
-
-const char *audit_field_to_name(int field)
-{
-	return field_i2s(field);
-}
-
-int audit_name_to_syscall(const char *sc, int machine)
-{
-	int res, found;
-
-	switch (machine)
-	{
-		case MACH_X86:
-			found = i386_syscall_s2i(sc, &res);
-			break;
-		case MACH_86_64:
-			found = x86_64_syscall_s2i(sc, &res);
-			break;
-		case MACH_IA64:
-			found = ia64_syscall_s2i(sc, &res);
-			break;
-		case MACH_PPC64:
-		case MACH_PPC:
-			found = ppc_syscall_s2i(sc, &res);
-			break;
-		case MACH_S390X:
-			found = s390x_syscall_s2i(sc, &res);
-			break;
-		case MACH_S390:
-			found = s390_syscall_s2i(sc, &res);
-			break;
-	        case MACH_ALPHA:
-			found = alpha_syscall_s2i(sc, &res);
-			break;
-		default:
-			return -1;
-	}
-	if (found)
-		return res;
-	return -1;
-}
-hidden_def(audit_name_to_syscall)
-
-const char *audit_syscall_to_name(int sc, int machine)
-{
-	switch (machine)
-	{
-		case MACH_X86:
-			return i386_syscall_i2s(sc);
-		case MACH_86_64:
-			return x86_64_syscall_i2s(sc);
-		case MACH_IA64:
-			return ia64_syscall_i2s(sc);
-		case MACH_PPC64:
-		case MACH_PPC:
-			return ppc_syscall_i2s(sc);
-		case MACH_S390X:
-			return s390x_syscall_i2s(sc);
-		case MACH_S390:
-			return s390_syscall_i2s(sc);
-	        case MACH_ALPHA:
-			return alpha_syscall_i2s(sc);
-	}
-	return NULL;
-}
-
-int audit_name_to_flag(const char *flag)
-{
-	int res;
-
-	if (flag_s2i(flag, &res) != 0)
-		return res;
-	return -1;
-}
-
-const char *audit_flag_to_name(int flag)
-{
-	return flag_i2s(flag);
-}
-
-int audit_name_to_action(const char *action)
-{
-	int res;
-
-	if (action_s2i(action, &res) != 0)
-		return res;
-	return -1;
-}
-
-const char *audit_action_to_name(int action)
-{
-	return action_i2s(action);
-}
-
-// On the critical path for ausearch parser
-int audit_name_to_msg_type(const char *msg_type)
-{
-	int rc;
-
-	if (msg_type_s2i(msg_type, &rc) != 0)
-		return rc;
-
-	/* Take a stab at converting */
-	if (strncmp(msg_type, "UNKNOWN[", 8) == 0) {
-		int len;
-		char buf[8];
-		const char *end = strchr(msg_type + 8, ']');
-		if (end == NULL)
-			return -1;
-
-		len = end - (msg_type + 8);
-		if (len > 7)
-			len = 7;
-		memset(buf, 0, sizeof(buf));
-		strncpy(buf, msg_type + 8, len);
-		errno = 0;
-		return strtol(buf, NULL, 10);
-	} else if (isdigit(*msg_type)) {
-		errno = 0;
-		return strtol(msg_type, NULL, 10);
-	}
-	return -1;
-}
-hidden_def(audit_name_to_msg_type)
-
-const char *audit_msg_type_to_name(int msg_type)
-{
-	return msg_type_i2s(msg_type);
-}
-hidden_def(audit_msg_type_to_name)
-
-int audit_name_to_machine(const char *machine)
-{
-	int res;
-
-	if (machine_s2i(machine, &res) != 0)
-		return res;
-	return -1;
-}
-hidden_def(audit_name_to_machine)
-
-const char *audit_machine_to_name(int machine)
-{
-	return machine_i2s(machine);
-}
-
-unsigned int audit_machine_to_elf(int machine)
-{
-	unsigned int i;
-    
-	for (i = 0; i < AUDIT_ELF_NAMES; i++)
-		if (elftab[i].key == machine) 
-			return elftab[i].lvalue;
-	return 0;
-}
-hidden_def(audit_machine_to_elf)
-
-int audit_elf_to_machine(unsigned int elf)
-{
-	unsigned int i;
-    
-	for (i = 0; i < AUDIT_ELF_NAMES; i++) 
-		if (elftab[i].lvalue == elf) return elftab[i].key;
-	return -1;
-}
-hidden_def(audit_elf_to_machine)
-
-const char *audit_operator_to_symbol(int op)
-{
-	/* Convert legacy ops */
-	if (op == 0)
-		op = AUDIT_EQUAL;
-	else if (op & AUDIT_NEGATE)
-		op = AUDIT_NOT_EQUAL;
-	return op_i2s(op);
-}
-hidden_def(audit_operator_to_symbol)
-
-/* This function returns 0 on error, otherwise the converted value */
-int audit_name_to_errno(const char *error)
-{
-	int rc, minus = 1;
-
-	if (*error == '-') {
-		minus = -1;
-		error++;
-	}
-	if (err_s2i(error, &rc) == 0)
-		rc = 0;
-
-	return rc*minus;
-}
-hidden_def(audit_name_to_errno)
-
-/* This function does not handle negative numbers yet */
-const char *audit_errno_to_name(int error)
-{
-	if (error < 0)
-		return NULL;
-
-        return err_i2s(error);
-}
-
-int audit_name_to_ftype(const char *name)
-{
-	int res;
-
-	if (ftype_s2i(name, &res) != 0)
-		return res;
-	return -1;
-}
-hidden_def(audit_name_to_ftype)
-
-const char *audit_ftype_to_name(int ftype)
-{
-	return ftype_i2s(ftype);
-}
-
--- a/src/mt/message.c
+++ /dev/null
@@ -1,58 +0,0 @@
-/* message.c --
- * Copyright 2004, 2005 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- */
-
-#include "config.h"
-#include <stdio.h>
-#include <stdarg.h>
-#include "libaudit.h"
-#include "private.h"
-
-/* The message mode refers to where informational messages go
-   0 - stderr, 1 - syslog, 2 - quiet. The default is quiet. */
-static message_t message_mode = MSG_QUIET;
-static debug_message_t debug_message = DBG_NO;
-
-void set_aumessage_mode(message_t mode, debug_message_t debug)
-{
-        message_mode = mode;
-	debug_message = debug;
-}
-
-void audit_msg(int priority, const char *fmt, ...)
-{
-        va_list   ap;
-
-	if (message_mode == MSG_QUIET)
-		return;
-
-	if (priority == LOG_DEBUG && debug_message == DBG_NO)
-		return;
-
-        va_start(ap, fmt);
-        if (message_mode == MSG_SYSLOG)
-                vsyslog(priority, fmt, ap);
-        else {
-                vfprintf(stderr, fmt, ap);
-		fputc('\n', stderr);
-	}
-        va_end( ap );
-}
--- a/src/mt/netlink.c
+++ /dev/null
@@ -1,289 +0,0 @@
-/* netlink.c --
- * Copyright 2004, 2005 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * Authors:
- *      Steve Grubb <sgrubb@redhat.com>
- *      Rickard E. (Rik) Faith <faith@redhat.com>
- */
-
-#include "config.h"
-#include <unistd.h>
-#include <string.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <time.h>
-#include <sys/poll.h>
-#include "libaudit.h"
-#include "private.h"
-
-#ifndef NETLINK_AUDIT
-#define NETLINK_AUDIT 9
-#endif
-
-static int adjust_reply(struct audit_reply *rep, int len);
-static int check_ack(int fd, int seq);
-
-/*
- * This function opens a connection to the kernel's audit
- * subsystem. You must be root for the call to succeed. On error,
- * a negative value is returned. On success, the file descriptor is
- * returned - which can be 0 or higher.
- */
-int audit_open(void)
-{
-	int saved_errno;
-	int fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
-
-	if (fd < 0) {
-		saved_errno = errno;
-		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-				errno == EAFNOSUPPORT)
-			audit_msg(LOG_ERR,
-				"Error - audit support not in kernel"); 
-		else
-			audit_msg(LOG_ERR,
-				"Error opening audit netlink socket (%s)", 
-				strerror(errno));
-		errno = saved_errno;
-		return fd;
-	}
-	if (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1) {
-		saved_errno = errno;
-		close(fd);
-		audit_msg(LOG_ERR, 
-			"Error setting audit netlink socket CLOEXEC flag (%s)", 
-			strerror(errno));
-		errno = saved_errno;
-		return -1;
-	}
-	return fd;
-}
-
-
-void audit_close(int fd)
-{
-	if (fd >= 0)
-		close(fd);
-}
-
-
-/*
- * This function returns -1 on error, 0 if error response received,
- * and > 0 if packet OK.
- */
-int audit_get_reply(int fd, struct audit_reply *rep, reply_t block, int peek)
-{
-	int len;
-	struct sockaddr_nl nladdr;
-	socklen_t nladdrlen = sizeof(nladdr);
-
-	if (fd < 0)
-		return -EBADF;
-
-	if (block == GET_REPLY_NONBLOCKING)
-		block = MSG_DONTWAIT;
-
-retry:
-	len = recvfrom(fd, &rep->msg, sizeof(rep->msg), block|peek,
-		(struct sockaddr*)&nladdr, &nladdrlen);
-
-	if (len < 0) {
-		if (errno == EINTR)
-			goto retry;
-		if (errno != EAGAIN) {
-			int saved_errno = errno;
-			audit_msg(LOG_ERR, 
-				"Error receiving audit netlink packet (%s)", 
-				strerror(errno));
-			errno = saved_errno;
-		}
-		return -errno;
-	}
-	if (nladdrlen != sizeof(nladdr)) {
-		audit_msg(LOG_ERR, 
-			"Bad address size reading audit netlink socket");
-		return -EPROTO;
-	}
-	if (nladdr.nl_pid) {
-		audit_msg(LOG_ERR, 
-			"Spoofed packet received on audit netlink socket");
-		return -EINVAL;
-	}
-
-	len = adjust_reply(rep, len);
-	if (len == 0)
-		len = -errno;
-	return len; 
-}
-hidden_def(audit_get_reply)
-
-
-/* 
- * This function returns 0 on error and len on success.
- */
-static int adjust_reply(struct audit_reply *rep, int len)
-{
-	rep->type     = rep->msg.nlh.nlmsg_type;
-	rep->len      = rep->msg.nlh.nlmsg_len;
-	rep->nlh      = &rep->msg.nlh;
-	rep->status   = NULL;
-	rep->rule     = NULL;
-	rep->login    = NULL;
-	rep->message  = NULL;
-	rep->error    = NULL;
-	rep->signal_info = NULL;
-	rep->conf     = NULL;
-	if (!NLMSG_OK(rep->nlh, (unsigned int)len)) {
-		if (len == sizeof(rep->msg)) {
-			audit_msg(LOG_ERR, 
-				"Netlink event from kernel is too big");
-			errno = EFBIG;
-		} else {
-			audit_msg(LOG_ERR, 
-			"Netlink message from kernel was not OK");
-			errno = EBADE;
-		}
-		return 0;
-	}
-
-	/* Next we'll set the data structure to point to msg.data. This is
-	 * to avoid having to use casts later. */
-	switch (rep->type) {
-		case NLMSG_ERROR: 
-			rep->error   = NLMSG_DATA(rep->nlh); 
-			break;
-		case AUDIT_GET:   
-			rep->status  = NLMSG_DATA(rep->nlh); 
-			break;
-		case AUDIT_LIST:  
-			rep->rule    = NLMSG_DATA(rep->nlh); 
-			break;
-		case AUDIT_LIST_RULES:  
-			rep->ruledata = NLMSG_DATA(rep->nlh); 
-			break;
-		case AUDIT_USER:
-		case AUDIT_LOGIN:
-		case AUDIT_KERNEL:
-		case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
-		case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
-		case AUDIT_FIRST_EVENT...AUDIT_LAST_KERN_ANOM_MSG:
-			rep->message = NLMSG_DATA(rep->nlh); 
-			break;
-		case AUDIT_SIGNAL_INFO:
-			rep->signal_info = NLMSG_DATA(rep->nlh);
-			break;
-	}
-	return len;
-}
-
-
-/*
- *  Return values:   success: positive non-zero sequence number
- *                   error:   -errno
- *                   short:   0
- */
-int audit_send(int fd, int type, const void *data, unsigned int size)
-{
-	static int sequence = 0;
-	struct audit_message req;
-	int retval;
-	struct sockaddr_nl addr;
-
-	/* Due to user space library callbacks, there's a chance that
-	   a -1 for the fd could be passed. Just check for and handle it. */
-	if (fd < 0) {
-		errno = EBADF;
-		return -errno;
-	}
-
-	if (NLMSG_SPACE(size) > MAX_AUDIT_MESSAGE_LENGTH) {
-		errno = EINVAL;
-		return -errno;
-	}
-
-	if (++sequence < 0) 
-		sequence = 1;
-
-	memset(&req, 0, sizeof(req));
-	req.nlh.nlmsg_len = NLMSG_SPACE(size);
-	req.nlh.nlmsg_type = type;
-	req.nlh.nlmsg_flags = NLM_F_REQUEST|NLM_F_ACK;
-	req.nlh.nlmsg_seq = sequence;
-	if (size && data)
-		memcpy(NLMSG_DATA(&req.nlh), data, size);
-	memset(&addr, 0, sizeof(addr));
-	addr.nl_family = AF_NETLINK;
-	addr.nl_pid = 0;
-	addr.nl_groups = 0;
-
-	do {
-		retval = sendto(fd, &req, req.nlh.nlmsg_len, 0,
-			(struct sockaddr*)&addr, sizeof(addr));
-	} while (retval < 0 && errno == EINTR);
-	if (retval == (int)req.nlh.nlmsg_len) {
-		if ((retval = check_ack(fd, sequence)) == 0)
-			return sequence;
-		else
-			return retval; 
-	}
-	if (retval < 0) 
-		return -errno;
-
-	return 0;
-}
-
-/*
- * This function will take a peek into the next packet and see if there's
- * an error. If so, the error is returned and its non-zero. Otherwise a 
- * zero is returned indicating that we don't know of any problems.
- */
-static int check_ack(int fd, int seq)
-{
-	int rc;
-	struct audit_reply rep;
-	struct pollfd pfd[1];
-
-	pfd[0].fd = fd;
-	pfd[0].events = POLLIN;
-	do {
-		rc = poll(pfd, 1, 100); /* .1 second */
-	} while (rc < 0 && errno == EINTR);
-
-	/* We don't look at rc from above as it doesn't matter. We are 
-	 * going to try to read nonblocking just in case packet shows up. */
-	
-	/* NOTE: whatever is returned is treated as the errno */
-	rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, MSG_PEEK);
-	if (rc < 0)
-		return rc;
-	else if (rc == 0)
-		return -EINVAL; /* This can't happen anymore */
-	else if (rc > 0 && rep.type == NLMSG_ERROR) {
-		/* Eat the message */
-		struct audit_reply rep2; /* throw away */
-		(void)audit_get_reply(fd, &rep2, GET_REPLY_NONBLOCKING, 0);
-
-		/* NLMSG_ERROR can indicate success, only report nonzero */ 
-		if (rep.error->error) {
-			errno = -rep.error->error;
-			return rep.error->error;
-		}
-	}
-	return 0;
-}
-
--- a/src/mt/private.h
+++ /dev/null
@@ -1,202 +0,0 @@
-/* private.h -- 
- * Copyright 2005,2006 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- * 
- * Authors:
- *	Steve Grubb <sgrubb@redhat.com>
- */
-#ifndef _PRIVATE_H_
-#define _PRIVATE_H_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#ifdef PIC
-# define hidden __attribute__ ((visibility ("hidden")))
-# define hidden_proto(fct) __hidden_proto (fct, fct##_internal)
-# define __hidden_proto(fct, internal)  \
-     extern __typeof (fct) internal;    \
-     extern __typeof (fct) fct __asm (#internal) hidden;
-# if defined(__alpha__) || defined(__mips__)
-#  define hidden_def(fct) \
-     asm (".globl " #fct "\n" #fct " = " #fct "_internal");
-# else
-#  define hidden_def(fct) \
-     asm (".globl " #fct "\n.set " #fct ", " #fct "_internal");
-#endif
-#else
-# define hidden
-# define hidden_proto(fct)
-# define hidden_def(fct)
-#endif
-
-typedef enum { REAL_ERR, HIDE_IT } hide_t;
-
-/* Internal syslog messaging */
-void audit_msg(int priority, const char *fmt, ...) hidden
-#ifdef __GNUC__
-	__attribute__ ((format (printf, 2, 3)));
-#else
-	;
-#endif
-
-/* This structure is for protocol reference only.  All fields are
-   packed and in network order (LSB first).  */
-struct auditd_remote_message_wrapper {
-	/* The magic number shall never have LF (0x0a) as one of its bytes.  */
-	uint32_t	magic;
-	/* Bumped when the layout of this structure changes.  */
-	uint8_t		header_version;
-	/* The minimum support needed to understand this message type.
-	 * Normally zero.  */
-	uint8_t		message_version;
-	/* Upper 8 bits are generic type, see below.  */
-	uint32_t	type;
-	/* Number of bytes that follow this header  Must be 0..MAX_AUDIT_MESSAGE_LENGTH.  */
-	uint16_t	length;
-	/* Copied from message to its reply. */
-	uint32_t	sequence_id;
-	/* The message follows for LENGTH bytes.  */
-};
-
-#define AUDIT_RMW_HEADER_SIZE		16
-/* The magic number shall never have LF (0x0a) as one of its bytes.  */
-#define AUDIT_RMW_MAGIC			0xff0000feUL
-
-#define AUDIT_RMW_HEADER_VERSION	0
-
-/* If set, this is a reply.  */
-#define AUDIT_RMW_TYPE_REPLYMASK	0x40000000
-/* If set, this reply indicates a fatal error of some sort.  */
-#define AUDIT_RMW_TYPE_FATALMASK	0x20000000
-/* If set, this reply indicates success but with some warnings.  */
-#define AUDIT_RMW_TYPE_WARNMASK		0x10000000
-/* This part of the message type is the details for the above.  */
-#define AUDIT_RMW_TYPE_DETAILMASK	0x0fffffff
-
-/* Version 0 messages.  */
-#define AUDIT_RMW_TYPE_MESSAGE		0x00000000
-#define AUDIT_RMW_TYPE_HEARTBEAT	0x00000001
-#define AUDIT_RMW_TYPE_ACK		0x40000000
-#define AUDIT_RMW_TYPE_ENDING		0x40000001
-#define AUDIT_RMW_TYPE_DISKLOW		0x50000001
-#define AUDIT_RMW_TYPE_DISKFULL		0x60000001
-#define AUDIT_RMW_TYPE_DISKERROR	0x60000002
-
-/* These next four should not be called directly.  */
-#define _AUDIT_RMW_PUTN32(header,i,v)	\
-	header[i] = v & 0xff;		\
-	header[i+1] = (v>>8) & 0xff;	\
-	header[i+2] = (v>>16) & 0xff;	\
-	header[i+3] = (v>>24) & 0xff;
-#define _AUDIT_RMW_PUTN16(header,i,v)			\
-	header[i] = v & 0xff;		\
-	header[i+1] = (v>>8) & 0xff;
-#define _AUDIT_RMW_GETN32(header,i)			\
-	(((uint32_t)(header[i] & 0xFF)) |               \
-	 (((uint32_t)(header[i+1] & 0xFF))<<8) |        \
-	 (((uint32_t)(header[i+2] & 0xFF ))<<16) |      \
-	 (((uint32_t)(header[i+3] & 0xFF))<<24))
-#define _AUDIT_RMW_GETN16(header,i)			\
-	((uint32_t)(header[i] & 0xFF) | ((uint32_t)(header[i+1] & 0xFF)<<8))
-
-/* For these, HEADER must by of type "unsigned char *" or "unsigned
-   char []" */
-
-#define AUDIT_RMW_PACK_HEADER(header,mver,type,len,seq) \
-	_AUDIT_RMW_PUTN32 (header,0, AUDIT_RMW_MAGIC); \
-	header[4] = AUDIT_RMW_HEADER_VERSION;  \
-	header[5] = mver;  \
-	_AUDIT_RMW_PUTN32 (header,6, type);  \
-	_AUDIT_RMW_PUTN16 (header,10, len); \
-	_AUDIT_RMW_PUTN32 (header,12, seq);
-
-#define AUDIT_RMW_IS_MAGIC(header,length)		\
-	(length >= 4 && _AUDIT_RMW_GETN32 (header,0) == AUDIT_RMW_MAGIC)
-
-#define AUDIT_RMW_UNPACK_HEADER(header,hver,mver,type,len,seq) \
-	hver = header[4]; \
-	mver = header[5]; \
-	type = _AUDIT_RMW_GETN32 (header,6); \
-	len = _AUDIT_RMW_GETN16 (header,10); \
-	seq = _AUDIT_RMW_GETN32 (header,12);
-
-/* General */
-extern int audit_send(int fd, int type, const void *data, unsigned int size)
-	hidden;
-
-// This is the main messaging function used internally
-// Don't hide it, it used to be a part of the public API!
-extern int audit_send_user_message(int fd, int type, hide_t hide_err, 
-	const char *message);
-
-// Newly deprecated
-// Don't hide them, they used to be a part of the public API!
-extern int  audit_request_rules_list(int fd);
-extern int  audit_add_rule(int fd, struct audit_rule *rule,
-				int flags, int action);
-extern int  audit_delete_rule(int fd, struct audit_rule *rule,
-				int flags, int action);
-extern int  audit_rule_syscall(struct audit_rule *rule, int scall);
-extern int  audit_rule_syscallbyname(struct audit_rule *rule,
-				const char *scall);
-extern int  audit_rule_fieldpair(struct audit_rule *rule, const char *pair,
-				int flags);
-extern void audit_rule_free(struct audit_rule *rule);
-
-// libaudit.c
-hidden_proto(audit_send_user_message);
-hidden_proto(audit_request_rules_list);
-hidden_proto(audit_add_rule);
-hidden_proto(audit_delete_rule);
-hidden_proto(audit_rule_syscall);
-hidden_proto(audit_rule_syscallbyname);
-hidden_proto(audit_rule_fieldpair);
-hidden_proto(audit_rule_free);
-hidden_proto(audit_add_watch_dir);
-hidden_proto(audit_detect_machine);
-hidden_proto(audit_request_status);
-hidden_proto(audit_rule_syscall_data);
-hidden_proto(audit_rule_syscallbyname_data);
-
-// lookup_table.c
-hidden_proto(audit_elf_to_machine);
-hidden_proto(audit_machine_to_elf);
-hidden_proto(audit_msg_type_to_name);
-hidden_proto(audit_name_to_errno);
-hidden_proto(audit_name_to_field);
-hidden_proto(audit_name_to_machine);
-hidden_proto(audit_name_to_msg_type);
-hidden_proto(audit_name_to_syscall);
-hidden_proto(audit_operator_to_symbol);
-hidden_proto(audit_name_to_ftype);
-
-// netlink.c
-hidden_proto(audit_get_reply);
-
-// FIXME delete after bumping soname number
-extern int audit_log_avc(int fd, int type, const char *fmt, va_list ap); //dbus,nscd
-hidden_proto(audit_log_avc)
-
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
