Add AUDIT_RESP_ORIGIN_BLOCK & AUDIT_RESP_ORIGIN_BLOCK_TIMED events

Author: RH-steve-grubb

ChangeLog

@@ -5,6 +5,7 @@
 - In auparse python bindings, expose some new types that were missing
 - In normalizer, pickup subject kind for user_login events
 - Fix interpretation of unknown ioctcmds (#1540507)
+- Add AUDIT_RESP_ORIGIN_BLOCK & AUDIT_RESP_ORIGIN_BLOCK_TIMED events
 
 2.8.2
 - Update tables for 4.14 kernel

lib/libaudit.h

@@ -1,5 +1,5 @@
 /* libaudit.h -- 
- * Copyright 2004-2017 Red Hat Inc., Durham, North Carolina.
+ * Copyright 2004-2018 Red Hat Inc., Durham, North Carolina.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -179,6 +179,8 @@ extern "C" {
 #define AUDIT_RESP_EXEC			2210 /* Execute a script */
 #define AUDIT_RESP_SINGLE		2211 /* Go to single user mode */
 #define AUDIT_RESP_HALT			2212 /* take the system down */
+#define AUDIT_RESP_ORIGIN_BLOCK		2213 /* Address blocked by iptables */
+#define AUDIT_RESP_ORIGIN_BLOCK_TIMED	2214 /* Address blocked for time */
 
 #define AUDIT_FIRST_USER_LSPP_MSG	2300
 #define AUDIT_LAST_USER_LSPP_MSG	2399

lib/msg_typetab.h

@@ -1,5 +1,5 @@
 /* msg_typetab.h --
- * Copyright 2005-07,2009-17 Red Hat Inc., Durham, North Carolina.
+ * Copyright 2005-07,2009-18 Red Hat Inc., Durham, North Carolina.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -192,6 +192,8 @@ _S(AUDIT_RESP_SEBOOL,                "RESP_SEBOOL"                   )
 _S(AUDIT_RESP_EXEC,                  "RESP_EXEC"                     )
 _S(AUDIT_RESP_SINGLE,                "RESP_SINGLE"                   )
 _S(AUDIT_RESP_HALT,                  "RESP_HALT"                     )
+_S(AUDIT_RESP_ORIGIN_BLOCK,          "RESP_ORIGIN_BLOCK"             )
+_S(AUDIT_RESP_ORIGIN_BLOCK_TIMED,    "RESP_ORIGIN_BLOCK_TIMED"       )
 _S(AUDIT_USER_ROLE_CHANGE,           "USER_ROLE_CHANGE"              )
 _S(AUDIT_ROLE_ASSIGN,                "ROLE_ASSIGN"                   )
 _S(AUDIT_ROLE_REMOVE,                "ROLE_REMOVE"                   )