2004-11-15 22:58:29 +00:00
|
|
|
Summary: User space tools for 2.6 kernel auditing.
|
2004-09-09 03:16:50 +00:00
|
|
|
Name: audit
|
2005-04-23 21:15:11 +00:00
|
|
|
Version: 0.7
|
2005-04-01 19:10:36 +00:00
|
|
|
Release: 1
|
2004-09-09 03:16:50 +00:00
|
|
|
License: GPL
|
2004-11-15 22:58:29 +00:00
|
|
|
Group: System Environment/Daemons
|
2004-11-19 22:18:07 +00:00
|
|
|
URL: http://people.redhat.com/sgrubb/audit/
|
2004-09-09 03:16:50 +00:00
|
|
|
Source0: %{name}-%{version}.tar.gz
|
2004-11-15 22:58:29 +00:00
|
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-root
|
2005-03-14 21:08:53 +00:00
|
|
|
BuildRequires: libtool
|
2005-03-03 22:48:44 +00:00
|
|
|
BuildRequires: glibc-kernheaders >= 2.4-9.1.90
|
2005-02-11 19:22:21 +00:00
|
|
|
BuildRequires: automake >= 1.9
|
|
|
|
BuildRequires: autoconf >= 2.59
|
2005-01-05 19:13:59 +00:00
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
2004-11-19 22:18:07 +00:00
|
|
|
Requires: chkconfig
|
2004-09-09 03:16:50 +00:00
|
|
|
|
|
|
|
%description
|
|
|
|
The audit package contains the user space utilities for
|
|
|
|
storing and processing the audit records generate by
|
|
|
|
the audit subsystem in the Linux 2.6 kernel.
|
|
|
|
|
2005-01-05 19:13:59 +00:00
|
|
|
%package libs
|
|
|
|
Summary: Dynamic library for libaudit
|
2004-11-19 22:18:07 +00:00
|
|
|
License: LGPL
|
|
|
|
Group: Development/Libraries
|
|
|
|
|
2005-01-05 19:13:59 +00:00
|
|
|
%description libs
|
|
|
|
The audit-libs package contains the dynamic libraries needed for
|
|
|
|
applications to use the audit framework.
|
|
|
|
|
|
|
|
%package libs-devel
|
|
|
|
Summary: Header files and static library for libaudit
|
|
|
|
License: LGPL
|
|
|
|
Group: Development/Libraries
|
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
2005-02-23 13:57:24 +00:00
|
|
|
Requires: glibc-kernheaders >= 2.4-9.1.90
|
2005-01-05 19:13:59 +00:00
|
|
|
|
|
|
|
%description libs-devel
|
|
|
|
The audit-libs-devel package contains the static libraries and header
|
|
|
|
files needed for developing applications that need to use the audit
|
|
|
|
framework libraries.
|
2004-11-19 22:18:07 +00:00
|
|
|
|
2004-09-09 03:16:50 +00:00
|
|
|
%prep
|
|
|
|
%setup -q
|
|
|
|
|
|
|
|
%build
|
2004-11-15 22:58:29 +00:00
|
|
|
autoreconf -fv --install
|
2005-02-20 20:33:50 +00:00
|
|
|
export CFLAGS="$RPM_OPT_FLAGS"
|
2005-03-14 21:08:53 +00:00
|
|
|
./configure --sbindir=/sbin --mandir=%{_mandir} --libdir=/%{_lib}
|
2004-09-09 03:16:50 +00:00
|
|
|
make
|
|
|
|
|
|
|
|
%install
|
|
|
|
rm -rf $RPM_BUILD_ROOT
|
2004-11-15 22:58:29 +00:00
|
|
|
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/{sysconfig,rc.d/init.d}}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_mandir}/man8
|
2005-03-14 21:08:53 +00:00
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_lib}
|
2005-04-01 19:10:36 +00:00
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_var}/log/audit
|
2004-11-15 22:58:29 +00:00
|
|
|
make DESTDIR=$RPM_BUILD_ROOT install
|
2004-09-09 03:16:50 +00:00
|
|
|
|
2004-11-19 22:18:07 +00:00
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_includedir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_libdir}
|
2004-12-13 19:27:06 +00:00
|
|
|
# We manually install this since Makefile doesn't
|
2004-11-19 22:18:07 +00:00
|
|
|
install -m 0644 lib/libaudit.h $RPM_BUILD_ROOT/%{_includedir}
|
2004-12-13 19:27:06 +00:00
|
|
|
# This winds up in the wrong place when libtool is involved
|
2005-02-20 20:43:49 +00:00
|
|
|
mv $RPM_BUILD_ROOT/%{_lib}/libaudit.a $RPM_BUILD_ROOT%{_libdir}
|
2005-03-03 22:48:44 +00:00
|
|
|
curdir=`pwd`
|
|
|
|
cd $RPM_BUILD_ROOT/%{_libdir}
|
|
|
|
ln -s ../../%{_lib}/libaudit.so libaudit.so
|
|
|
|
cd $curdir
|
|
|
|
|
2004-09-09 03:16:50 +00:00
|
|
|
%clean
|
|
|
|
rm -rf $RPM_BUILD_ROOT
|
|
|
|
|
2005-04-20 21:33:07 +00:00
|
|
|
%post libs -p /sbin/ldconfig
|
2005-01-05 19:13:59 +00:00
|
|
|
|
2004-11-19 22:18:07 +00:00
|
|
|
%post
|
|
|
|
if [ $1 = 1 ]; then
|
|
|
|
/sbin/chkconfig --add auditd
|
|
|
|
fi
|
|
|
|
|
|
|
|
%preun
|
|
|
|
if [ $1 = 0 ]; then
|
|
|
|
/sbin/service auditd stop > /dev/null 2>&1
|
|
|
|
/sbin/chkconfig --del auditd
|
|
|
|
fi
|
|
|
|
|
2005-01-05 19:13:59 +00:00
|
|
|
%postun libs
|
|
|
|
/sbin/ldconfig 2>/dev/null
|
|
|
|
|
2004-11-19 22:18:07 +00:00
|
|
|
%postun
|
|
|
|
if [ $1 -ge 1 ]; then
|
|
|
|
/sbin/service auditd condrestart > /dev/null 2>&1
|
|
|
|
fi
|
|
|
|
|
2005-01-05 19:13:59 +00:00
|
|
|
%files libs
|
|
|
|
%defattr(-,root,root)
|
2005-02-20 20:43:49 +00:00
|
|
|
%attr(755,root,root) /%{_lib}/libaudit.*
|
2005-01-05 19:13:59 +00:00
|
|
|
|
|
|
|
%files libs-devel
|
2004-11-19 22:18:07 +00:00
|
|
|
%defattr(-,root,root)
|
2005-03-03 22:48:44 +00:00
|
|
|
%{_libdir}/libaudit.a
|
|
|
|
%{_libdir}/libaudit.so
|
2004-11-19 22:18:07 +00:00
|
|
|
%{_includedir}/libaudit.h
|
2004-12-03 20:58:39 +00:00
|
|
|
%{_mandir}/man3/*
|
2004-11-19 22:18:07 +00:00
|
|
|
|
2004-09-09 03:16:50 +00:00
|
|
|
%files
|
|
|
|
%defattr(-,root,root,-)
|
2005-02-23 23:24:19 +00:00
|
|
|
%doc README COPYING ChangeLog sample.rules
|
2004-11-15 22:58:29 +00:00
|
|
|
%attr(0644,root,root) %{_mandir}/man8/*
|
2005-04-01 19:10:36 +00:00
|
|
|
%attr(750,root,root) /sbin/auditctl
|
|
|
|
%attr(750,root,root) /sbin/auditd
|
2005-04-23 21:15:11 +00:00
|
|
|
%attr(750,root,root) /sbin/ausearch
|
2005-04-20 21:33:07 +00:00
|
|
|
%attr(750,root,root) /sbin/autrace
|
2004-11-15 22:58:29 +00:00
|
|
|
%attr(755,root,root) /etc/rc.d/init.d/auditd
|
2005-04-01 19:10:36 +00:00
|
|
|
%attr(750,root,root) %{_var}/log/audit
|
2004-12-10 22:13:10 +00:00
|
|
|
%config(noreplace) %attr(640,root,root) /etc/auditd.conf
|
2005-02-11 19:22:21 +00:00
|
|
|
%config(noreplace) %attr(640,root,root) /etc/audit.rules
|
2004-11-15 22:58:29 +00:00
|
|
|
%config(noreplace) %attr(640,root,root) /etc/sysconfig/auditd
|
|
|
|
|
2004-09-09 03:16:50 +00:00
|
|
|
|
|
|
|
%changelog
|
2005-04-23 21:15:11 +00:00
|
|
|
* Sat Apr 23 2005 Steve Grubb <sgrubb@redhat.com> 0.7-1
|
|
|
|
- In auditctl -l, loop until all rules are printed
|
|
|
|
- Update autrace not to run if rules are currently loaded
|
|
|
|
- Added code to switch to single user mode when disk is full
|
|
|
|
- Added the ausearch program
|
|
|
|
|
2005-04-20 21:33:07 +00:00
|
|
|
* Wed Apr 20 2005 Steve Grubb <sgrubb@redhat.com> 0.6.12-1
|
|
|
|
- Fixed bug where elf type wasn't being set when given numerically
|
|
|
|
- Added autrace program (similar to strace)
|
|
|
|
- Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted
|
|
|
|
|
2005-04-18 20:25:36 +00:00
|
|
|
* Mon Apr 18 2005 Steve Grubb <sgrubb@redhat.com> 0.6.11-1
|
|
|
|
- Check log file size on start up
|
|
|
|
- Added priority_boost config item
|
|
|
|
- Reworked arch support
|
|
|
|
- Reworked how run level is changed
|
|
|
|
- Make allowances for ECONNREFUSED
|
|
|
|
|
2005-04-01 19:10:36 +00:00
|
|
|
* Fri Apr 1 2005 Steve Grubb <sgrubb@redhat.com> 0.6.10-1
|
|
|
|
- Code cleanups
|
|
|
|
- Support the arch field for auditctl
|
|
|
|
- Add version to auditctl
|
|
|
|
- Documentation updates
|
|
|
|
- Moved default location of the audit log to /var/log/audit
|
2005-03-24 20:31:24 +00:00
|
|
|
|
2005-03-17 22:58:02 +00:00
|
|
|
* Thu Mar 17 2005 Steve Grubb <sgrubb@redhat.com> 0.6.9-1
|
|
|
|
- Added patch for filesystem watch
|
|
|
|
- Added version information to audit start message
|
|
|
|
- Change netlink code to use ack in order to get error notification
|
|
|
|
|
2005-03-14 21:08:53 +00:00
|
|
|
* Wed Mar 10 2005 Steve Grubb <sgrubb@redhat.com> 0.6.8-1
|
|
|
|
- removed the pam_loginuid library - its going to pam
|
|
|
|
|
2005-03-09 23:50:13 +00:00
|
|
|
* Wed Mar 9 2005 Steve Grubb <sgrubb@redhat.com> 0.6.7-1
|
|
|
|
- Fixed bug setting loginuid
|
|
|
|
- Added num_logs to configure number of logs when rotating
|
|
|
|
- Added code for rotating logs
|
|
|
|
|
2005-03-08 20:46:48 +00:00
|
|
|
* Tue Mar 8 2005 Steve Grubb <sgrubb@redhat.com> 0.6.6-1
|
|
|
|
- Fix audit_set_pid to try to read a reply, but its non-fatal if no reply.
|
|
|
|
- Remove the read status during init
|
|
|
|
- Change to using pthreads sync mechanism for stopping system
|
|
|
|
- Worker thread should ignore all signals
|
|
|
|
- Change main loop to use select for inbound event handling
|
|
|
|
- Gave pam_loginuid a "failok" option for testing
|
|
|
|
|
2005-03-03 22:48:44 +00:00
|
|
|
* Thu Mar 3 2005 Steve Grubb <sgrubb@redhat.com> 0.6.5-1
|
|
|
|
- Lots of code cleanups
|
|
|
|
- Added write_pid function to auditd
|
|
|
|
- Added audit_log to libaudit
|
|
|
|
- Don't check file length in foreground mode of auditd
|
|
|
|
- Added *if_enabled functions to send messages only if audit system is enabled
|
|
|
|
- If syscall name is unknown when printing rules, use the syscall number
|
|
|
|
- Rework the build system to produce singly threaded public libraries
|
|
|
|
- Create a multithreaded version of libaudit for the audit daemon's use
|
|
|
|
|
2005-02-23 23:24:19 +00:00
|
|
|
* Wed Feb 23 2005 Steve Grubb <sgrubb@redhat.com> 0.6.4-1
|
|
|
|
- Rename pam_audit to pam_loginuid to reflect what it does
|
|
|
|
- Fix bug in detecting space left on partition
|
|
|
|
- Fix bug in handling of suspended logging
|
|
|
|
|
2005-02-23 13:57:24 +00:00
|
|
|
* Wed Feb 23 2005 David Woodhouse <dwmw2@redhat.com> 0.6.3-3
|
|
|
|
- Include stdint.h in libaudit.h and require new glibc-kernheaders
|
|
|
|
|
2005-02-20 20:43:49 +00:00
|
|
|
* Sun Feb 20 2005 Steve Grubb <sgrubb@redhat.com> 0.6.3-2
|
|
|
|
- Another lib64 correction
|
|
|
|
|
2005-02-20 20:33:50 +00:00
|
|
|
* Sun Feb 20 2005 Steve Grubb <sgrubb@redhat.com> 0.6.3-1
|
|
|
|
- Change pam install from /lib/security to /%{_lib}/security
|
|
|
|
- Change pam_audit to write loginuid to /proc/pid/loginuid
|
|
|
|
- Add pam_session_close handle
|
|
|
|
- Update to newest kernel headers
|
|
|
|
|
2005-02-11 19:22:21 +00:00
|
|
|
* Fri Feb 11 2005 Steve Grubb <sgrubb@redhat.com> 0.6.2-1
|
|
|
|
- New version
|
|
|
|
- Add R option to auditctl to allow reading rules from file.
|
|
|
|
- Do not allow task creation list to have syscall auditing
|
|
|
|
- Add D option to allow deleting all rules with 1 command
|
|
|
|
- Added pam_audit man page & sample.rules
|
|
|
|
- Mod initscript to call auditctl to load rules at start-up
|
|
|
|
- Write message to log file for daemon start up
|
|
|
|
- Write message that daemon is shutting down
|
|
|
|
- Modify auditd shutdown to wait until logger thread is finished
|
|
|
|
- Add sample rule file to docs
|
|
|
|
|
2005-01-08 23:20:29 +00:00
|
|
|
* Sat Jan 08 2005 Steve Grubb <sgrubb@redhat.com> 0.6.1-1
|
|
|
|
- New version: rework auditctl and its man pages.
|
|
|
|
- Added admin_space_left config option as last chance before
|
|
|
|
running out of disk space.
|
|
|
|
|
2005-01-05 19:13:59 +00:00
|
|
|
* Wed Jan 05 2005 Steve Grubb <sgrubb@redhat.com> 0.6-1
|
|
|
|
- New version
|
|
|
|
- Split package up to libs, libs-devel, and audit.
|
|
|
|
|
|
|
|
* Mon Dec 13 2004 Steve Grubb <sgrubb@redhat.com> 0.5.6-1
|
2004-12-13 19:27:06 +00:00
|
|
|
- New version
|
|
|
|
|
2004-12-10 22:13:10 +00:00
|
|
|
* Fri Dec 10 2004 Steve Grubb <sgrubb@redhat.com> 0.5.5-1
|
|
|
|
- New version
|
|
|
|
|
2004-12-03 20:58:39 +00:00
|
|
|
* Fri Dec 03 2004 Steve Grubb <sgrubb@redhat.com> 0.5.4-1
|
|
|
|
- New version
|
|
|
|
|
2004-11-19 22:18:07 +00:00
|
|
|
* Mon Nov 22 2004 Steve Grubb <sgrubb@redhat.com> 0.5.3-1
|
|
|
|
- New version
|
|
|
|
|
2004-11-15 23:03:35 +00:00
|
|
|
* Mon Nov 15 2004 Steve Grubb <sgrubb@redhat.com> 0.5.2-1
|
|
|
|
- New version
|
|
|
|
|
2004-11-15 22:58:29 +00:00
|
|
|
* Wed Nov 10 2004 Steve Grubb <sgrubb@redhat.com> 0.5.1-1
|
|
|
|
- Added initscript pieces
|
|
|
|
- New version
|
|
|
|
|
|
|
|
* Wed Sep 1 2004 Charlie Bennett (ccb@redhat.com) 0.5-1
|
2004-09-09 03:16:50 +00:00
|
|
|
- Initial build.
|
|
|
|
|