Things that need to be done:
===========================
1.1.3
ausearch make listing message types logical
more audit dispatcher program & plugin framework updates

1.1.4
More audit dispatcher program & plugin framework updates
auditctl label support
Remove deprecated functions
Bump so number
Change auditd to not use daemonize. Do fork and have pipe so child can signal when it is setup. The parent then returns 0 or 1. This prevents a race in initscripts where auditd returns but is not ready to log yet.

1.1.5
More audit dispatcher program & plugin framework updates
Success cb enum w/unset - adjust avc parsing to preserve syscall unless unset
Avc messages should be linked list in ausearch & aureport

1.2
more plugins
make ausearch library for third party parsing API
auditctl session id, pgid
aureport get specific reports working

1.3
Look at supporting binary formats
Remove evil getopt cruft in auditctl
Add counting semaphore to control internal queue depth
auditctl should ignore invalid arches for rules
Look at modifying kernel rule matcher to do: first match & match all 

1.4
look into way of spotting avc denials related to booleans
look at config changed report to see if an action can be added 
Add scheduling options: strict, relaxed, loose (determines user space queueing)
Add exec option to action handlers
Parser should allow more than 1 arg after option - eg EXEC /usr/local/script
Add config option media: syslog, file, socket, dbus
Allow users to specify message types to be kept for logging
Allow users to specify fields to be kept for logging

1.5
Pretty Print ausearch messages
audit explorer gui
create responder to potential security incidents
Under what circumstances do files have relative name in path record - ausearch may have to combine cwd record with path to do file searches

IN THE DISTANT FUTURE:
Allow users to label syscall event rules in auditctl
Consider creating way to interactively delete rules by menu
Create a rule builder GUI
