audit: renumber AUDIT_FEATURE_CHANGE into the 1300 range

1000-1099 is for configuring things.  So auditd ignored such messages.
This is about actually logging what was configured.  Move it into the
range for such types of messages.

Reported-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 4315ee99b967..11917f747cb4 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -70,7 +70,6 @@
 #define AUDIT_TTY_SET           1017    /* Set TTY auditing status */
 #define AUDIT_SET_FEATURE       1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE       1019    /* Get which features are enabled */
-#define AUDIT_FEATURE_CHANGE    1020    /* audit log listing feature changes */
 
 #define AUDIT_FIRST_USER_MSG    1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC          1107    /* We filter this differently */
@@ -110,6 +109,7 @@
 #define AUDIT_NETFILTER_CFG     1325    /* Netfilter chain modifications */
 #define AUDIT_SECCOMP           1326    /* Secure Computing event */
 #define AUDIT_PROCTITLE         1327    /* Proctitle emit event */
+#define AUDIT_FEATURE_CHANGE    1328    /* audit log listing feature changes */
 
 #define AUDIT_AVC               1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR       1401    /* Internal SE Linux Errors */