aide/aide-0.13.1-prelink2.patch

diff -up aide-0.13.1/configure.in.prelink aide-0.13.1/configure.in
--- aide-0.13.1/configure.in.prelink	2006-12-08 22:49:21.000000000 +0100
+++ aide-0.13.1/configure.in	2009-05-13 16:14:49.000000000 +0200
@@ -405,6 +405,30 @@ AS_IF([test "x$with_selinux_support" != 
 
 AC_SUBST(SELINUXLIB)
 
+
+AC_MSG_CHECKING(for prelink-support)
+AC_ARG_WITH([prelink], 
+            [AC_HELP_STRING([--with-prelink],[use prelink (no checking)])],
+            [case $with_prelink in 
+		yes) AC_DEFINE_UNQUOTED(PRELINK_PATH, "/usr/sbin/prelink", [path to prelink])
+		     AC_DEFINE(WITH_PRELINK,1,[use prelink])
+		     ELFLIB="-lelf"
+		     compoptionstring="${compoptionstring}WITH_PRELINK\\n"
+		     AC_MSG_RESULT([/usr/sbin/prelink])
+		     ;;
+		no)  AC_MSG_RESULT(no)
+		     ;;
+		*)   AC_DEFINE_UNQUOTED(PRELINK_PATH, "$with_prelink", [path to prelink])
+		     AC_DEFINE(WITH_PRELINK,1,[use prelink])
+		     ELFLIB="-lelf"
+		     compoptionstring="${compoptionstring}WITH_PRELINK\\n"
+		     AC_MSG_RESULT([$with_prelink])
+		     ;;
+	     esac],
+	    [with_prelink=no]
+)
+AC_SUBST(ELFLIB)
+
 AC_MSG_CHECKING(for xattr-support)
 AC_ARG_WITH([xattr],
 	[AC_HELP_STRING([--with-xattr],
diff -up aide-0.13.1/src/do_md.c.prelink aide-0.13.1/src/do_md.c
--- aide-0.13.1/src/do_md.c.prelink	2006-10-27 22:47:20.000000000 +0200
+++ aide-0.13.1/src/do_md.c	2009-05-13 17:37:51.000000000 +0200
@@ -65,6 +65,86 @@
 /*
 #include <gcrypt.h>
 */
+
+#ifdef WITH_PRELINK
+#include <sys/wait.h>
+#include <gelf.h>
+
+/*
+ *  Is file descriptor prelinked binary/library?
+ *  Return: 1(yes) / 0(no)
+ *  
+ */
+int is_prelinked(int fd) {
+        Elf *elf = NULL;
+        Elf_Scn *scn = NULL;
+        Elf_Data *data = NULL;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
+        GElf_Dyn dyn;
+        int bingo;
+
+        (void) elf_version(EV_CURRENT);
+
+        if ((elf = elf_begin (fd, ELF_C_READ, NULL)) == NULL
+            || elf_kind(elf) != ELF_K_ELF
+            || gelf_getehdr(elf, &ehdr) == NULL
+            || !(ehdr.e_type == ET_DYN || ehdr.e_type == ET_EXEC))
+                return 0;
+
+        bingo = 0;
+        while (!bingo && (scn = elf_nextscn(elf, scn)) != NULL) {
+                (void) gelf_getshdr(scn, &shdr);
+
+                if (shdr.sh_type != SHT_DYNAMIC)
+                        continue;
+
+                while (!bingo && (data = elf_getdata (scn, data)) != NULL) {
+                        int maxndx = data->d_size / shdr.sh_entsize;
+                        int ndx;
+
+                        for (ndx = 0; ndx < maxndx; ++ndx) {
+                                (void) gelf_getdyn (data, ndx, &dyn);
+                                if (!(dyn.d_tag == DT_GNU_PRELINKED || dyn.d_tag == DT_GNU_LIBLIST))
+                                        continue;
+                                bingo = 1;
+                                break;
+                        }
+                }
+        }
+
+        return bingo;
+}
+
+/*
+ * Open path via prelink -y, set fd
+ * Return: 0(not success) / !0(prelink child process)
+ *
+ */
+pid_t open_prelinked(const char * path, int * fd) {
+        const char *cmd = PRELINK_PATH;
+        pid_t pid = 0;
+        int pipes[2];
+
+        pipes[0] = pipes[1] = -1;
+        pipe(pipes);
+        if (!(pid = fork())) {
+                /* child */
+                close(pipes[0]);
+                dup2(pipes[1], STDOUT_FILENO);
+                close(pipes[1]);
+                unsetenv("MALLOC_CHECK_");
+                execl(cmd, cmd, "--verify", path, (char *) NULL);
+        }
+        /* parent */
+        close(pipes[1]);
+        *fd = pipes[0];
+        return pid;
+
+}
+
+#endif
+
 void md_init_fail(const char* s,db_line* db,byte** hash,DB_ATTR_TYPE i) {
   error(0,"Message digest %s initialise failed\nDisabling %s for file %s\n",s,s,db->filename);
   db->attr=db->attr&(~i);
@@ -121,6 +201,9 @@ void calc_md(struct AIDE_STAT_TYPE* old_
   struct AIDE_STAT_TYPE fs;
   int sres=0;
   int stat_diff,filedes;
+#ifdef WITH_PRELINK
+  pid_t pid;
+#endif
 
   error(255,"calc_md called\n");
 #ifdef _PARAMETER_CHECK_
@@ -166,6 +249,22 @@ void calc_md(struct AIDE_STAT_TYPE* old_
     /*
       Now we have a 'valid' filehandle to read from a file.
      */
+
+#ifdef WITH_PRELINK
+    /*
+     * Let's take care of prelinked libraries/binaries 	
+     */
+    pid=0;
+    if ( is_prelinked(filedes) ) {
+      close(filedes);
+      pid = open_prelinked(line->filename, &filedes);
+      if (pid == 0) {
+        error(0, "Error on starting prelink undo\n");
+	return;
+      }
+    }
+#endif
+
     off_t r_size=0;
     off_t size=0;
     char* buf;
@@ -176,47 +275,58 @@ void calc_md(struct AIDE_STAT_TYPE* old_
     
     if (init_md(&mdc)==RETOK) {
 #ifdef HAVE_MMAP
-      off_t curpos=0;
+#ifdef WITH_PRELINK
+      if (pid == 0) {
+#endif
+        off_t curpos=0;
 
-      r_size=fs.st_size;
-      /* in mmap branch r_size is used as size remaining */
-      while(r_size>0){
-	if(r_size<MMAP_BLOCK_SIZE){
+        r_size=fs.st_size;
+        /* in mmap branch r_size is used as size remaining */
+        while(r_size>0){
+         if(r_size<MMAP_BLOCK_SIZE){
 #ifdef __hpux
-	  buf = mmap(0,r_size,PROT_READ,MAP_PRIVATE,filedes,curpos);
+           buf = mmap(0,r_size,PROT_READ,MAP_PRIVATE,filedes,curpos);
 #else
-	  buf = mmap(0,r_size,PROT_READ,MAP_SHARED,filedes,curpos);
+           buf = mmap(0,r_size,PROT_READ,MAP_SHARED,filedes,curpos);
 #endif
-	  curpos+=r_size;
-	  size=r_size;
-	  r_size=0;
-	}else {
+           curpos+=r_size;
+           size=r_size;
+           r_size=0;
+         }else {
 #ifdef __hpux
-	  buf = mmap(0,MMAP_BLOCK_SIZE,PROT_READ,MAP_PRIVATE,filedes,curpos);
+	   buf = mmap(0,MMAP_BLOCK_SIZE,PROT_READ,MAP_PRIVATE,filedes,curpos);
 #else
-	  buf = mmap(0,MMAP_BLOCK_SIZE,PROT_READ,MAP_SHARED,filedes,curpos);
+	   buf = mmap(0,MMAP_BLOCK_SIZE,PROT_READ,MAP_SHARED,filedes,curpos);
 #endif
-	  curpos+=MMAP_BLOCK_SIZE;
-	  size=MMAP_BLOCK_SIZE;
-	  r_size-=MMAP_BLOCK_SIZE;
-	}
-	if ( buf == MAP_FAILED ) {
-	  error(0,"error mmap'ing %s: %s\n", line->filename,strerror(errno));
-	  close(filedes);
-	  close_md(&mdc);
-	  return;
-	}
-	conf->catch_mmap=1;
-	if (update_md(&mdc,buf,size)!=RETOK) {
-	  error(0,"Message digest failed during update\n");
-	  close_md(&mdc);
-	  munmap(buf,size);
-	  return;
-	}
-	munmap(buf,size);
-	conf->catch_mmap=0;
+	   curpos+=MMAP_BLOCK_SIZE;
+	   size=MMAP_BLOCK_SIZE;
+	   r_size-=MMAP_BLOCK_SIZE;
+	 }
+	 if ( buf == MAP_FAILED ) {
+	   error(0,"error mmap'ing %s: %s\n", line->filename,strerror(errno));
+	   close(filedes);
+	   close_md(&mdc);
+	   return;
+	 }
+	 conf->catch_mmap=1;
+	 if (update_md(&mdc,buf,size)!=RETOK) {
+	   error(0,"Message digest failed during update\n");
+	   close_md(&mdc);
+	   munmap(buf,size);
+	   return;
+	 }
+	 munmap(buf,size);
+	 conf->catch_mmap=0;
+        }
+	/* we have used MMAP, let's return */
+        close_md(&mdc);
+        md2line(&mdc,line);
+        close(filedes);
+        return;
+#ifdef WITH_PRELINK
       }
-#else /* not HAVE_MMAP */
+#endif
+#endif /* not HAVE_MMAP */
       buf=malloc(READ_BLOCK_SIZE);
 #if READ_BLOCK_SIZE>SSIZE_MAX
 #error "READ_BLOCK_SIZE" is too large. Max value is SSIZE_MAX, and current is READ_BLOCK_SIZE
@@ -229,11 +339,22 @@ void calc_md(struct AIDE_STAT_TYPE* old_
 	}
 	r_size+=size;
       }
+
+#ifdef WITH_PRELINK
+      if (pid) {
+        int status;
+        (void) waitpid(pid, &status, 0);
+        if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+          error(0, "Error on exit of prelink child process\n");
+	  close_md(&mdc);
+          return;
+        }
+      }
+#endif
       free(buf);
-#endif /* HAVE_MMAP else branch */    
       close_md(&mdc);
       md2line(&mdc,line);
-      
+
     } else {
       error(3,"Message digest initialization failed.\n");
       no_hash(line);
diff -up aide-0.13.1/src/Makefile.am.prelink aide-0.13.1/src/Makefile.am
--- aide-0.13.1/src/Makefile.am.prelink	2006-10-27 23:10:38.000000000 +0200
+++ aide-0.13.1/src/Makefile.am	2009-05-13 16:14:49.000000000 +0200
@@ -50,7 +50,7 @@ aide_SOURCES =	\
 
 INCLUDES = -I$(top_srcdir)/include
 
-LDADD = -lm @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@
+LDADD = -lm @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@ @ELFLIB@
 
 AM_LDFLAGS = @LDFLAGS@ @LD_STATIC_FLAG@