import audit-3.0-0.10.20180831git0047a6c.el8
This commit is contained in:
CentOS Sources
commit
bf4d714ac6
1
.audit.metadata
Normal file
1
.audit.metadata
Normal file
@ -0,0 +1 @@
|
|||||||
|
6968c30d9bb05d3f44413d1cd944ca8cbf3cf8c4 SOURCES/audit-3.0-alpha5.tar.gz
|
||||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
SOURCES/audit-3.0-alpha5.tar.gz
|
||||||
244
SOURCES/audit-3.0-af_unix-plugin.patch
Normal file
244
SOURCES/audit-3.0-af_unix-plugin.patch
Normal file
@ -0,0 +1,244 @@
|
|||||||
|
diff -urp audit-3.0.orig/audisp/audispd-builtins.c audit-3.0/audisp/audispd-builtins.c
|
||||||
|
--- audit-3.0.orig/audisp/audispd-builtins.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/audisp/audispd-builtins.c 2018-12-06 20:01:06.922443361 -0500
|
||||||
|
@@ -35,12 +35,17 @@
|
||||||
|
#include <sys/uio.h> // writev
|
||||||
|
#include <fcntl.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
+#include "ev.h"
|
||||||
|
#include "audispd-pconfig.h"
|
||||||
|
#include "audispd-builtins.h"
|
||||||
|
|
||||||
|
+// Global data
|
||||||
|
+extern struct ev_loop *loop;
|
||||||
|
+
|
||||||
|
// Local data
|
||||||
|
static volatile int sock = -1, conn = -1;
|
||||||
|
static char *path = NULL;
|
||||||
|
+static struct ev_io af_unix_watcher;
|
||||||
|
|
||||||
|
// Local prototypes
|
||||||
|
static void init_af_unix(const plugin_conf_t *conf);
|
||||||
|
@@ -63,21 +68,37 @@ void stop_builtin(plugin_conf_t *conf)
|
||||||
|
syslog(LOG_ERR, "Unknown builtin %s", conf->path);
|
||||||
|
}
|
||||||
|
|
||||||
|
-static void af_unix_accept(int fd)
|
||||||
|
+static int watching = 0;
|
||||||
|
+static void stop_watching(void)
|
||||||
|
+{
|
||||||
|
+ if (watching) {
|
||||||
|
+ ev_io_stop(loop, &af_unix_watcher);
|
||||||
|
+ watching = 0;
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void af_unix_accept(struct ev_loop *l, struct ev_io *_io, int revents)
|
||||||
|
{
|
||||||
|
int cmd;
|
||||||
|
|
||||||
|
do {
|
||||||
|
- conn = accept(fd, NULL, NULL);
|
||||||
|
+ conn = accept(_io->fd, NULL, NULL);
|
||||||
|
} while (conn < 0 && errno == EINTR);
|
||||||
|
|
||||||
|
// De-register since this is intended to be one listener
|
||||||
|
if (conn >= 0)
|
||||||
|
- remove_event(fd);
|
||||||
|
+ stop_watching();
|
||||||
|
cmd = fcntl(conn, F_GETFD);
|
||||||
|
fcntl(conn, F_SETFD, cmd|FD_CLOEXEC);
|
||||||
|
}
|
||||||
|
|
||||||
|
+static void start_watching(void)
|
||||||
|
+{
|
||||||
|
+ ev_io_init(&af_unix_watcher, af_unix_accept, sock, EV_READ);
|
||||||
|
+ ev_io_start(loop, &af_unix_watcher);
|
||||||
|
+ watching = 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
static int create_af_unix_socket(const char *path, int mode)
|
||||||
|
{
|
||||||
|
struct sockaddr_un addr;
|
||||||
|
@@ -122,8 +143,8 @@ static int create_af_unix_socket(const c
|
||||||
|
// Make socket listening...won't block
|
||||||
|
(void)listen(sock, 5);
|
||||||
|
|
||||||
|
- // Register socket with poll
|
||||||
|
- add_event(sock, af_unix_accept);
|
||||||
|
+ // Register socket with libev
|
||||||
|
+ start_watching();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -213,7 +234,8 @@ void send_af_unix_string(const char *s,
|
||||||
|
if (rc < 0 && errno == EPIPE) {
|
||||||
|
close(conn);
|
||||||
|
conn = -1;
|
||||||
|
- add_event(sock, af_unix_accept);
|
||||||
|
+ stop_watching();
|
||||||
|
+ start_watching();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -237,7 +259,8 @@ void send_af_unix_binary(event_t *e)
|
||||||
|
if (rc < 0 && errno == EPIPE) {
|
||||||
|
close(conn);
|
||||||
|
conn = -1;
|
||||||
|
- add_event(sock, af_unix_accept);
|
||||||
|
+ stop_watching();
|
||||||
|
+ start_watching();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -250,10 +273,13 @@ void destroy_af_unix(void)
|
||||||
|
conn = -1;
|
||||||
|
did_something = 1;
|
||||||
|
}
|
||||||
|
+ stop_watching();
|
||||||
|
if (sock >= 0) {
|
||||||
|
+
|
||||||
|
close(sock);
|
||||||
|
sock = -1;
|
||||||
|
did_something = 1;
|
||||||
|
+
|
||||||
|
}
|
||||||
|
if (path) {
|
||||||
|
unlink(path);
|
||||||
|
diff -urp audit-3.0.orig/audisp/audispd-builtins.h audit-3.0/audisp/audispd-builtins.h
|
||||||
|
--- audit-3.0.orig/audisp/audispd-builtins.h 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/audisp/audispd-builtins.h 2018-12-06 20:01:06.922443361 -0500
|
||||||
|
@@ -33,10 +33,5 @@ void send_af_unix_string(const char *s,
|
||||||
|
void send_af_unix_binary(event_t *e);
|
||||||
|
void destroy_af_unix(void);
|
||||||
|
|
||||||
|
-typedef void (*poll_callback_ptr)(int fd);
|
||||||
|
-int add_event(int fd, poll_callback_ptr cb);
|
||||||
|
-int remove_event(int fd);
|
||||||
|
-
|
||||||
|
-
|
||||||
|
#endif
|
||||||
|
|
||||||
|
diff -urp audit-3.0.orig/audisp/audispd.c audit-3.0/audisp/audispd.c
|
||||||
|
--- audit-3.0.orig/audisp/audispd.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/audisp/audispd.c 2018-12-06 20:01:06.922443361 -0500
|
||||||
|
@@ -31,7 +31,6 @@
|
||||||
|
#include <pthread.h>
|
||||||
|
#include <dirent.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
-#include <sys/poll.h>
|
||||||
|
#include <netdb.h>
|
||||||
|
#include <arpa/inet.h>
|
||||||
|
#include <limits.h>
|
||||||
|
@@ -578,43 +577,6 @@ static int event_loop(void)
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static struct pollfd pfd[4];
|
||||||
|
-static poll_callback_ptr pfd_cb[4];
|
||||||
|
-static volatile int pfd_cnt=0;
|
||||||
|
-int add_event(int fd, poll_callback_ptr cb)
|
||||||
|
-{
|
||||||
|
- if (pfd_cnt > 3)
|
||||||
|
- return -1;
|
||||||
|
-
|
||||||
|
- pfd[pfd_cnt].fd = fd;
|
||||||
|
- pfd[pfd_cnt].events = POLLIN;
|
||||||
|
- pfd[pfd_cnt].revents = 0;
|
||||||
|
- pfd_cb[pfd_cnt] = cb;
|
||||||
|
- pfd_cnt++;
|
||||||
|
- return 0;
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
-int remove_event(int fd)
|
||||||
|
-{
|
||||||
|
- int start, i;
|
||||||
|
- if (pfd_cnt == 0)
|
||||||
|
- return -1;
|
||||||
|
-
|
||||||
|
- for (start=0; start < pfd_cnt; start++) {
|
||||||
|
- if (pfd[start].fd == fd)
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- for (i=start; i<(pfd_cnt-1); i++) {
|
||||||
|
- pfd[i].events = pfd[i+1].events;
|
||||||
|
- pfd[i].revents = pfd[i+1].revents;
|
||||||
|
- pfd[i].fd = pfd[i+1].fd;
|
||||||
|
- pfd_cb[i] = pfd_cb[i+1];
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- pfd_cnt--;
|
||||||
|
- return 0;
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
/* returns > 0 if plugins and 0 if none */
|
||||||
|
int libdisp_active(void)
|
||||||
|
{
|
||||||
|
diff -urp audit-3.0.orig/audisp/Makefile.am audit-3.0/audisp/Makefile.am
|
||||||
|
--- audit-3.0.orig/audisp/Makefile.am 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/audisp/Makefile.am 2018-12-06 20:01:06.922443361 -0500
|
||||||
|
@@ -22,7 +22,7 @@
|
||||||
|
|
||||||
|
SUBDIRS = plugins
|
||||||
|
CONFIG_CLEAN_FILES = *.rej *.orig
|
||||||
|
-AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src
|
||||||
|
+AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src -I${top_srcdir}/src/libev
|
||||||
|
LIBS = -L${top_builddir}/lib -laudit
|
||||||
|
LDADD = -lpthread
|
||||||
|
|
||||||
|
@@ -30,5 +30,6 @@ noinst_HEADERS = audispd-pconfig.h audis
|
||||||
|
queue.h audispd-builtins.h libdisp.h
|
||||||
|
libdisp_a_SOURCES = audispd.c audispd-pconfig.c queue.c \
|
||||||
|
audispd-llist.c audispd-builtins.c
|
||||||
|
+libdisp_a_CFLAGS = -fno-strict-aliasing
|
||||||
|
noinst_LIBRARIES = libdisp.a
|
||||||
|
|
||||||
|
diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
|
||||||
|
--- audit-3.0.orig/src/auditd.c 2018-12-06 19:41:21.076570614 -0500
|
||||||
|
+++ audit-3.0/src/auditd.c 2018-12-06 20:01:06.923443360 -0500
|
||||||
|
@@ -580,6 +580,7 @@ static void close_pipes(void)
|
||||||
|
close(pipefds[1]);
|
||||||
|
}
|
||||||
|
|
||||||
|
+struct ev_loop *loop;
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
{
|
||||||
|
struct sigaction sa;
|
||||||
|
@@ -597,7 +598,6 @@ int main(int argc, char *argv[])
|
||||||
|
enum startup_state opt_startup = startup_enable;
|
||||||
|
extern char *optarg;
|
||||||
|
extern int optind;
|
||||||
|
- struct ev_loop *loop;
|
||||||
|
struct ev_io netlink_watcher;
|
||||||
|
struct ev_io pipe_watcher;
|
||||||
|
struct ev_signal sigterm_watcher;
|
||||||
|
@@ -748,14 +748,6 @@ int main(int argc, char *argv[])
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (init_dispatcher(&config)) {
|
||||||
|
- if (pidfile)
|
||||||
|
- unlink(pidfile);
|
||||||
|
- tell_parent(FAILURE);
|
||||||
|
- free_config(&config);
|
||||||
|
- return 1;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
/* Get machine name ready for use */
|
||||||
|
if (resolve_node(&config)) {
|
||||||
|
if (pidfile)
|
||||||
|
@@ -891,6 +883,14 @@ int main(int argc, char *argv[])
|
||||||
|
/* Depending on value of opt_startup (-s) set initial audit state */
|
||||||
|
loop = ev_default_loop (EVFLAG_NOENV);
|
||||||
|
|
||||||
|
+ if (init_dispatcher(&config)) {
|
||||||
|
+ if (pidfile)
|
||||||
|
+ unlink(pidfile);
|
||||||
|
+ tell_parent(FAILURE);
|
||||||
|
+ free_config(&config);
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!opt_aggregate_only) {
|
||||||
|
ev_io_init (&netlink_watcher, netlink_handler, fd, EV_READ);
|
||||||
|
ev_io_start (loop, &netlink_watcher);
|
||||||
12
SOURCES/audit-3.0-auditd-stop.patch
Normal file
12
SOURCES/audit-3.0-auditd-stop.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff -ur audit-3.0.orig/init.d/auditd.stop audit-3.0/init.d/auditd.stop
|
||||||
|
--- audit-3.0.orig/init.d/auditd.stop 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/init.d/auditd.stop 2018-12-08 17:15:59.916950477 -0500
|
||||||
|
@@ -10,7 +10,7 @@
|
||||||
|
. /etc/init.d/functions
|
||||||
|
|
||||||
|
printf "Stopping logging: "
|
||||||
|
-killproc $prog -TERM
|
||||||
|
+killproc -d 1 $prog -TERM
|
||||||
|
RETVAL=$?
|
||||||
|
echo
|
||||||
|
exit $RETVAL
|
||||||
21
SOURCES/audit-3.0-ausearch-buffer-fix.patch
Normal file
21
SOURCES/audit-3.0-ausearch-buffer-fix.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
diff -urp audit-3.0.orig/src/ausearch-lol.c audit-3.0/src/ausearch-lol.c
|
||||||
|
--- audit-3.0.orig/src/ausearch-lol.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/ausearch-lol.c 2018-12-06 19:38:21.208589916 -0500
|
||||||
|
@@ -277,7 +277,7 @@ int lol_add_record(lol *lo, char *buff)
|
||||||
|
if (n.tlen > MAX_AUDIT_MESSAGE_LENGTH)
|
||||||
|
n.tlen = MAX_AUDIT_MESSAGE_LENGTH;
|
||||||
|
} else
|
||||||
|
- n.tlen = MAX_AUDIT_MESSAGE_LENGTH;
|
||||||
|
+ n.tlen = n.mlen;
|
||||||
|
fmt = LF_ENRICHED;
|
||||||
|
} else {
|
||||||
|
ptr = strrchr(n.message, 0x0a);
|
||||||
|
@@ -287,7 +287,7 @@ int lol_add_record(lol *lo, char *buff)
|
||||||
|
if (n.mlen > MAX_AUDIT_MESSAGE_LENGTH)
|
||||||
|
n.mlen = MAX_AUDIT_MESSAGE_LENGTH;
|
||||||
|
} else
|
||||||
|
- n.mlen = MAX_AUDIT_MESSAGE_LENGTH;
|
||||||
|
+ n.mlen = strlen(n.message);
|
||||||
|
n.interp = NULL;
|
||||||
|
n.tlen = n.mlen;
|
||||||
|
fmt = LF_RAW;
|
||||||
12
SOURCES/audit-3.0-cap_audit_read.patch
Normal file
12
SOURCES/audit-3.0-cap_audit_read.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
|
||||||
|
--- audit-3.0.orig/src/auditd.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/auditd.c 2018-12-06 19:41:21.076570614 -0500
|
||||||
|
@@ -665,7 +665,7 @@ int main(int argc, char *argv[])
|
||||||
|
#ifndef DEBUG
|
||||||
|
/* Make sure we can do our job. Containers may not give you
|
||||||
|
* capabilities, so we revert to a uid check for that case. */
|
||||||
|
- if (!audit_can_control() || !audit_can_read()) {
|
||||||
|
+ if (!audit_can_control()) {
|
||||||
|
if (!config.local_events && geteuid() == 0)
|
||||||
|
;
|
||||||
|
else {
|
||||||
104
SOURCES/audit-3.0-docs.patch
Normal file
104
SOURCES/audit-3.0-docs.patch
Normal file
@ -0,0 +1,104 @@
|
|||||||
|
diff -ur audit-3.0.orig/docs/auparse_normalize.3 audit-3.0/docs/auparse_normalize.3
|
||||||
|
--- audit-3.0.orig/docs/auparse_normalize.3 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/docs/auparse_normalize.3 2018-12-06 19:27:33.636659407 -0500
|
||||||
|
@@ -25,7 +25,8 @@
|
||||||
|
|
||||||
|
.SH "SEE ALSO"
|
||||||
|
|
||||||
|
-.BR
|
||||||
|
+.BR auparse_normalize_subject_primary (3) ,
|
||||||
|
+.BR auparse_normalize_object_primary (3).
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
Steve Grubb
|
||||||
|
diff -ur audit-3.0.orig/rules/30-ospp-v42.rules audit-3.0/rules/30-ospp-v42.rules
|
||||||
|
--- audit-3.0.orig/rules/30-ospp-v42.rules 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/rules/30-ospp-v42.rules 2018-12-06 19:27:33.656659405 -0500
|
||||||
|
@@ -3,20 +3,28 @@
|
||||||
|
## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.
|
||||||
|
|
||||||
|
## Unsuccessful file creation (open with O_CREAT)
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
||||||
|
|
||||||
|
## Unsuccessful file modifications (open for write or truncate)
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
||||||
|
@@ -47,16 +55,30 @@
|
||||||
|
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
|
||||||
|
|
||||||
|
## User add delete modify. This is covered by pam. However, someone could
|
||||||
|
-## open a file and directly create a user, so we'll watch passwd for writes
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+## open a file and directly create or modify a user, so we'll watch passwd and
|
||||||
|
+## shadow for writes
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||||
|
|
||||||
|
## User enable and disable. This is entirely handled by pam.
|
||||||
|
|
||||||
|
## Group add delete modify. This is covered by pam. However, someone could
|
||||||
|
-## open a file and directly create a user, so we'll watch group for writes
|
||||||
|
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+## open a file and directly create or modify a user, so we'll watch group and
|
||||||
|
+## gshadow for writes
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
+-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||||
|
|
||||||
|
## Use of special rights for config changes. This would be use of setuid
|
||||||
|
## programs that relate to user accts. This is not all setuid apps because
|
||||||
|
diff -ur audit-3.0.orig/rules/30-pci-dss-v31.rules audit-3.0/rules/30-pci-dss-v31.rules
|
||||||
|
--- audit-3.0.orig/rules/30-pci-dss-v31.rules 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/rules/30-pci-dss-v31.rules 2018-12-06 19:27:33.656659405 -0500
|
||||||
|
@@ -41,8 +41,8 @@
|
||||||
|
## ausearch --start today -m user_auth,user_chauthtok -i
|
||||||
|
|
||||||
|
## 10.2.5.b All elevation of privileges is logged
|
||||||
|
--a always,exit -F arch=b64 -S setuid -Fa0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
|
||||||
|
--a always,exit -F arch=b32 -S setuid -Fa0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
|
||||||
|
+-a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
|
||||||
|
+-a always,exit -F arch=b32 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session
|
||||||
|
-a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session
|
||||||
|
-a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session
|
||||||
|
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=10.2.5.b-elevated-privs-setuid
|
||||||
12
SOURCES/audit-3.0-libev-remove-cold.patch
Normal file
12
SOURCES/audit-3.0-libev-remove-cold.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff -urp audit-3.0.orig/src/libev/ev.c audit-3.0/src/libev/ev.c
|
||||||
|
--- audit-3.0.orig/src/libev/ev.c 2019-01-03 12:25:16.000000000 -0500
|
||||||
|
+++ audit-3.0/src/libev/ev.c 2019-01-09 10:58:20.437560972 -0500
|
||||||
|
@@ -901,7 +901,7 @@ typedef int ecb_bool;
|
||||||
|
#if ECB_GCC_VERSION(4,3)
|
||||||
|
#define ecb_artificial ecb_attribute ((__artificial__))
|
||||||
|
#define ecb_hot ecb_attribute ((__hot__))
|
||||||
|
- #define ecb_cold ecb_attribute ((__cold__))
|
||||||
|
+ #define ecb_cold
|
||||||
|
#else
|
||||||
|
#define ecb_artificial
|
||||||
|
#define ecb_hot
|
||||||
232
SOURCES/audit-3.0-network-orig-events.patch
Normal file
232
SOURCES/audit-3.0-network-orig-events.patch
Normal file
@ -0,0 +1,232 @@
|
|||||||
|
diff -urp audit-3.0.orig/src/auditd.c audit-3.0/src/auditd.c
|
||||||
|
--- audit-3.0.orig/src/auditd.c 2018-12-06 20:01:06.923443360 -0500
|
||||||
|
+++ audit-3.0/src/auditd.c 2018-12-06 20:17:19.030339043 -0500
|
||||||
|
@@ -214,24 +214,35 @@ static void cont_handler(struct ev_loop
|
||||||
|
|
||||||
|
static int extract_type(const char *str)
|
||||||
|
{
|
||||||
|
- const char *tptr, *ptr2, *ptr = str;
|
||||||
|
+ char tmp, *ptr2, *ptr = str;
|
||||||
|
+ int type;
|
||||||
|
if (*str == 'n') {
|
||||||
|
ptr = strchr(str+1, ' ');
|
||||||
|
if (ptr == NULL)
|
||||||
|
return -1; // Malformed - bomb out
|
||||||
|
ptr++;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
// ptr should be at 't'
|
||||||
|
ptr2 = strchr(ptr, ' ');
|
||||||
|
- // get type=xxx in a buffer
|
||||||
|
- tptr = strndupa(ptr, ptr2 - ptr);
|
||||||
|
+
|
||||||
|
// find =
|
||||||
|
- str = strchr(tptr, '=');
|
||||||
|
- if (str == NULL)
|
||||||
|
+ str = strchr(ptr, '=');
|
||||||
|
+ if (str == NULL || str >= ptr2)
|
||||||
|
return -1; // Malformed - bomb out
|
||||||
|
+
|
||||||
|
// name is 1 past
|
||||||
|
str++;
|
||||||
|
- return audit_name_to_msg_type(str);
|
||||||
|
+
|
||||||
|
+ // Save character & terminate string
|
||||||
|
+ tmp = *ptr2;
|
||||||
|
+ *ptr2 = 0;
|
||||||
|
+
|
||||||
|
+ type = audit_name_to_msg_type(str);
|
||||||
|
+
|
||||||
|
+ *ptr2 = tmp; // Restore character
|
||||||
|
+
|
||||||
|
+ return type;
|
||||||
|
}
|
||||||
|
|
||||||
|
void distribute_event(struct auditd_event *e)
|
||||||
|
@@ -250,18 +261,22 @@ void distribute_event(struct auditd_even
|
||||||
|
route = 0;
|
||||||
|
else { // We only need the original type if its being routed
|
||||||
|
e->reply.type = extract_type(e->reply.message);
|
||||||
|
- char *p = strchr(e->reply.message,
|
||||||
|
- AUDIT_INTERP_SEPARATOR);
|
||||||
|
- if (p)
|
||||||
|
- proto = AUDISP_PROTOCOL_VER2;
|
||||||
|
- else
|
||||||
|
- proto = AUDISP_PROTOCOL_VER;
|
||||||
|
|
||||||
|
+ // Treat everything from the network as VER2
|
||||||
|
+ // because they are already formatted. This is
|
||||||
|
+ // important when it gets to the dispatcher which
|
||||||
|
+ // can strip node= when its VER1.
|
||||||
|
+ proto = AUDISP_PROTOCOL_VER2;
|
||||||
|
}
|
||||||
|
- } else if (e->reply.type != AUDIT_DAEMON_RECONFIG)
|
||||||
|
- // All other events need formatting
|
||||||
|
+ } else if (e->reply.type != AUDIT_DAEMON_RECONFIG) {
|
||||||
|
+ // All other local events need formatting
|
||||||
|
format_event(e);
|
||||||
|
- else
|
||||||
|
+
|
||||||
|
+ // If the event has been formatted with node, upgrade
|
||||||
|
+ // to VER2 so that the dispatcher honors the formatting
|
||||||
|
+ if (config.node_name_format != N_NONE)
|
||||||
|
+ proto = AUDISP_PROTOCOL_VER2;
|
||||||
|
+ } else
|
||||||
|
route = 0; // Don't DAEMON_RECONFIG events until after enqueue
|
||||||
|
|
||||||
|
/* End of Event is for realtime interface - skip local logging of it */
|
||||||
|
@@ -748,6 +763,17 @@ int main(int argc, char *argv[])
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* Startup libev and dispatcher */
|
||||||
|
+ loop = ev_default_loop(EVFLAG_NOENV);
|
||||||
|
+ if (init_dispatcher(&config)) {
|
||||||
|
+ if (pidfile)
|
||||||
|
+ unlink(pidfile);
|
||||||
|
+ tell_parent(FAILURE);
|
||||||
|
+ free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* Get machine name ready for use */
|
||||||
|
if (resolve_node(&config)) {
|
||||||
|
if (pidfile)
|
||||||
|
@@ -755,6 +781,7 @@ int main(int argc, char *argv[])
|
||||||
|
shutdown_dispatcher();
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -766,6 +793,7 @@ int main(int argc, char *argv[])
|
||||||
|
shutdown_dispatcher();
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
fcntl(pipefds[0], F_SETFD, FD_CLOEXEC);
|
||||||
|
@@ -785,6 +813,7 @@ int main(int argc, char *argv[])
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
close_pipes();
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
if (getsubj(subj))
|
||||||
|
@@ -811,6 +840,7 @@ int main(int argc, char *argv[])
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
close_pipes();
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -821,6 +851,7 @@ int main(int argc, char *argv[])
|
||||||
|
/* let config manager init */
|
||||||
|
init_config_manager();
|
||||||
|
|
||||||
|
+ /* Depending on value of opt_startup (-s) set initial audit state */
|
||||||
|
if (opt_startup != startup_nochange && !opt_aggregate_only &&
|
||||||
|
(audit_is_enabled(fd) < 2) &&
|
||||||
|
audit_set_enabled(fd, (int)opt_startup) < 0) {
|
||||||
|
@@ -849,6 +880,7 @@ int main(int argc, char *argv[])
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
close_pipes();
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -877,20 +909,11 @@ int main(int argc, char *argv[])
|
||||||
|
tell_parent(FAILURE);
|
||||||
|
close_pipes();
|
||||||
|
free_config(&config);
|
||||||
|
+ ev_default_destroy();
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /* Depending on value of opt_startup (-s) set initial audit state */
|
||||||
|
- loop = ev_default_loop (EVFLAG_NOENV);
|
||||||
|
-
|
||||||
|
- if (init_dispatcher(&config)) {
|
||||||
|
- if (pidfile)
|
||||||
|
- unlink(pidfile);
|
||||||
|
- tell_parent(FAILURE);
|
||||||
|
- free_config(&config);
|
||||||
|
- return 1;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
+ /* Start up all the handlers */
|
||||||
|
if (!opt_aggregate_only) {
|
||||||
|
ev_io_init (&netlink_watcher, netlink_handler, fd, EV_READ);
|
||||||
|
ev_io_start (loop, &netlink_watcher);
|
||||||
|
diff -urp audit-3.0.orig/src/auditd-dispatch.c audit-3.0/src/auditd-dispatch.c
|
||||||
|
--- audit-3.0.orig/src/auditd-dispatch.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/auditd-dispatch.c 2018-12-06 20:17:09.769340037 -0500
|
||||||
|
@@ -70,6 +70,7 @@ int dispatch_event(const struct audit_re
|
||||||
|
if (!libdisp_active())
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
+ // Translate event into dispatcher format
|
||||||
|
e = malloc(sizeof(event_t));
|
||||||
|
if (e == NULL)
|
||||||
|
return -1;
|
||||||
|
@@ -78,6 +79,7 @@ int dispatch_event(const struct audit_re
|
||||||
|
e->hdr.hlen = sizeof(struct audit_dispatcher_header);
|
||||||
|
e->hdr.type = rep->type;
|
||||||
|
|
||||||
|
+ // Network originating events have data at rep->message
|
||||||
|
if (protocol_ver == AUDISP_PROTOCOL_VER) {
|
||||||
|
e->hdr.size = rep->msg.nlh.nlmsg_len;
|
||||||
|
memcpy(e->data, (void*)rep->msg.data, e->hdr.size);
|
||||||
|
diff -urp audit-3.0.orig/src/auditd-event.c audit-3.0/src/auditd-event.c
|
||||||
|
--- audit-3.0.orig/src/auditd-event.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/auditd-event.c 2018-12-06 20:17:09.769340037 -0500
|
||||||
|
@@ -225,8 +225,10 @@ static void replace_event_msg(struct aud
|
||||||
|
e->reply.message = strndup(buf, MAX_AUDIT_MESSAGE_LENGTH-1);
|
||||||
|
len = MAX_AUDIT_MESSAGE_LENGTH;
|
||||||
|
}
|
||||||
|
- e->reply.msg.nlh.nlmsg_len = e->reply.len;
|
||||||
|
- e->reply.len = len;
|
||||||
|
+ // For network originating events, len should be used
|
||||||
|
+ if (!from_network(e)) // V1 protocol msg size
|
||||||
|
+ e->reply.msg.nlh.nlmsg_len = e->reply.len;
|
||||||
|
+ e->reply.len = len; // V2 protocol msg size
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -500,7 +502,7 @@ struct auditd_event *create_event(char *
|
||||||
|
e->sequence_id = sequence_id;
|
||||||
|
|
||||||
|
/* Network originating events need things adjusted to mimic netlink. */
|
||||||
|
- if (e->ack_func)
|
||||||
|
+ if (from_network(e))
|
||||||
|
replace_event_msg(e, msg);
|
||||||
|
|
||||||
|
return e;
|
||||||
|
@@ -570,7 +572,7 @@ void handle_event(struct auditd_event *e
|
||||||
|
static void send_ack(const struct auditd_event *e, int ack_type,
|
||||||
|
const char *msg)
|
||||||
|
{
|
||||||
|
- if (e->ack_func) {
|
||||||
|
+ if (from_network(e)) {
|
||||||
|
unsigned char header[AUDIT_RMW_HEADER_SIZE];
|
||||||
|
|
||||||
|
AUDIT_RMW_PACK_HEADER(header, 0, ack_type, strlen(msg),
|
||||||
|
diff -urp audit-3.0.orig/src/auditd-event.h audit-3.0/src/auditd-event.h
|
||||||
|
--- audit-3.0.orig/src/auditd-event.h 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/auditd-event.h 2018-12-06 20:17:09.769340037 -0500
|
||||||
|
@@ -36,6 +36,9 @@ struct auditd_event {
|
||||||
|
unsigned long sequence_id;
|
||||||
|
};
|
||||||
|
|
||||||
|
+static inline int from_network(const struct auditd_event *e)
|
||||||
|
+{ if (e && e->ack_func) return 1; return 0; };
|
||||||
|
+
|
||||||
|
#include "auditd-config.h"
|
||||||
|
|
||||||
|
int dispatch_network_events(void);
|
||||||
21
SOURCES/audit-3.0-queue-report.patch
Normal file
21
SOURCES/audit-3.0-queue-report.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
diff -urp audit-3.0.orig/audisp/queue.c audit-3.0/audisp/queue.c
|
||||||
|
--- audit-3.0.orig/audisp/queue.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/audisp/queue.c 2018-12-06 20:21:22.184312950 -0500
|
||||||
|
@@ -231,11 +231,12 @@ void increase_queue_depth(unsigned int s
|
||||||
|
|
||||||
|
void write_queue_state(FILE *f)
|
||||||
|
{
|
||||||
|
- fprintf(f, "current queue depth = %u\n", currently_used);
|
||||||
|
- fprintf(f, "max queue depth used = %u\n", max_used);
|
||||||
|
- fprintf(f, "queue size = %u\n", q_depth);
|
||||||
|
- fprintf(f, "queue overflow detected = %s\n",overflowed ? "yes" : "no");
|
||||||
|
- fprintf(f, "queueing suspended = %s\n",
|
||||||
|
+ fprintf(f, "current plugin queue depth = %u\n", currently_used);
|
||||||
|
+ fprintf(f, "max plugin queue depth used = %u\n", max_used);
|
||||||
|
+ fprintf(f, "plugin queue size = %u\n", q_depth);
|
||||||
|
+ fprintf(f, "plugin queue overflow detected = %s\n",
|
||||||
|
+ overflowed ? "yes" : "no");
|
||||||
|
+ fprintf(f, "plugin queueing suspended = %s\n",
|
||||||
|
processing_suspended ? "yes" : "no");
|
||||||
|
}
|
||||||
|
|
||||||
97
SOURCES/audit-3.0-user_avc.patch
Normal file
97
SOURCES/audit-3.0-user_avc.patch
Normal file
@ -0,0 +1,97 @@
|
|||||||
|
diff -ur audit-3.0.orig/src/aureport-options.c audit-3.0/src/aureport-options.c
|
||||||
|
--- audit-3.0.orig/src/aureport-options.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/aureport-options.c 2018-12-06 19:31:26.945634371 -0500
|
||||||
|
@@ -85,7 +85,8 @@
|
||||||
|
R_AVCS, R_SYSCALLS, R_PIDS, R_EVENTS, R_ACCT_MODS,
|
||||||
|
R_INTERPRET, R_HELP, R_ANOMALY, R_RESPONSE, R_SUMMARY_DET, R_CRYPTO,
|
||||||
|
R_MAC, R_FAILED, R_SUCCESS, R_ADD, R_DEL, R_AUTH, R_NODE, R_IN_LOGS,
|
||||||
|
- R_KEYS, R_TTY, R_NO_CONFIG, R_COMM, R_VIRT, R_INTEG, R_ESCAPE };
|
||||||
|
+ R_KEYS, R_TTY, R_NO_CONFIG, R_COMM, R_VIRT, R_INTEG, R_ESCAPE,
|
||||||
|
+ R_DEBUG };
|
||||||
|
|
||||||
|
static struct nv_pair optiontab[] = {
|
||||||
|
{ R_AUTH, "-au" },
|
||||||
|
@@ -98,6 +99,7 @@
|
||||||
|
{ R_CONFIGS, "--config" },
|
||||||
|
{ R_CRYPTO, "-cr" },
|
||||||
|
{ R_CRYPTO, "--crypto" },
|
||||||
|
+ { R_DEBUG, "--debug" },
|
||||||
|
{ R_DEL, "--delete" },
|
||||||
|
{ R_EVENTS, "-e" },
|
||||||
|
{ R_EVENTS, "--event" },
|
||||||
|
@@ -731,6 +733,9 @@
|
||||||
|
case R_DEL:
|
||||||
|
event_conf_act = C_DEL;
|
||||||
|
break;
|
||||||
|
+ case R_DEBUG:
|
||||||
|
+ event_debug = 1;
|
||||||
|
+ break;
|
||||||
|
case R_IN_LOGS:
|
||||||
|
force_logs = 1;
|
||||||
|
break;
|
||||||
|
diff -ur audit-3.0.orig/src/ausearch-parse.c audit-3.0/src/ausearch-parse.c
|
||||||
|
--- audit-3.0.orig/src/ausearch-parse.c 2018-08-31 17:05:48.000000000 -0400
|
||||||
|
+++ audit-3.0/src/ausearch-parse.c 2018-12-06 19:31:26.945634371 -0500
|
||||||
|
@@ -102,7 +102,8 @@
|
||||||
|
ret = parse_path(n, s);
|
||||||
|
break;
|
||||||
|
case AUDIT_USER:
|
||||||
|
- case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
|
||||||
|
+ case AUDIT_FIRST_USER_MSG...AUDIT_USER_END:
|
||||||
|
+ case AUDIT_USER_CHAUTHTOK...AUDIT_LAST_USER_MSG:
|
||||||
|
case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
|
||||||
|
ret = parse_user(n, s);
|
||||||
|
break;
|
||||||
|
@@ -136,6 +137,7 @@
|
||||||
|
avc_parse_path(n, s);
|
||||||
|
break;
|
||||||
|
case AUDIT_AVC:
|
||||||
|
+ case AUDIT_USER_AVC:
|
||||||
|
ret = parse_avc(n, s);
|
||||||
|
break;
|
||||||
|
case AUDIT_NETFILTER_PKT:
|
||||||
|
@@ -1867,6 +1869,20 @@
|
||||||
|
*term = ' ';
|
||||||
|
}
|
||||||
|
|
||||||
|
+ // User AVC's are not formatted like a kernel AVC
|
||||||
|
+ if (n->type == AUDIT_USER_AVC) {
|
||||||
|
+ rc = parse_user(n, s);
|
||||||
|
+ if (rc > 20)
|
||||||
|
+ rc = 0;
|
||||||
|
+ if (audit_avc_init(s) == 0) {
|
||||||
|
+ alist_append(s->avc, &an);
|
||||||
|
+ } else {
|
||||||
|
+ rc = 10;
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ return rc;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
// get pid
|
||||||
|
if (event_pid != -1) {
|
||||||
|
str = strstr(term, "pid=");
|
||||||
|
diff -urp audit-3.0.orig/src/ausearch-parse.c audit-3.0/src/ausearch-parse.c
|
||||||
|
--- audit-3.0.orig/src/ausearch-parse.c 2018-10-03 19:46:52.000000000 -0400
|
||||||
|
+++ audit-3.0/src/ausearch-parse.c 2018-12-08 15:48:54.350009208 -0500
|
||||||
|
@@ -1839,8 +1839,10 @@ static int parse_avc(const lnode *n, sea
|
||||||
|
if (str) {
|
||||||
|
str += 5;
|
||||||
|
term = strchr(str, '{');
|
||||||
|
- if (term == NULL)
|
||||||
|
- return 1;
|
||||||
|
+ if (term == NULL) {
|
||||||
|
+ term = n->message;
|
||||||
|
+ goto other_avc;
|
||||||
|
+ }
|
||||||
|
if (event_success != S_UNSET) {
|
||||||
|
*term = 0;
|
||||||
|
// FIXME. Do not override syscall success if already
|
||||||
|
@@ -1869,6 +1871,7 @@ static int parse_avc(const lnode *n, sea
|
||||||
|
*term = ' ';
|
||||||
|
}
|
||||||
|
|
||||||
|
+other_avc:
|
||||||
|
// User AVC's are not formatted like a kernel AVC
|
||||||
|
if (n->type == AUDIT_USER_AVC) {
|
||||||
|
rc = parse_user(n, s);
|
||||||
502
SOURCES/lgpl-2.1.txt
Normal file
502
SOURCES/lgpl-2.1.txt
Normal file
@ -0,0 +1,502 @@
|
|||||||
|
GNU LESSER GENERAL PUBLIC LICENSE
|
||||||
|
Version 2.1, February 1999
|
||||||
|
|
||||||
|
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||||
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
[This is the first released version of the Lesser GPL. It also counts
|
||||||
|
as the successor of the GNU Library Public License, version 2, hence
|
||||||
|
the version number 2.1.]
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The licenses for most software are designed to take away your
|
||||||
|
freedom to share and change it. By contrast, the GNU General Public
|
||||||
|
Licenses are intended to guarantee your freedom to share and change
|
||||||
|
free software--to make sure the software is free for all its users.
|
||||||
|
|
||||||
|
This license, the Lesser General Public License, applies to some
|
||||||
|
specially designated software packages--typically libraries--of the
|
||||||
|
Free Software Foundation and other authors who decide to use it. You
|
||||||
|
can use it too, but we suggest you first think carefully about whether
|
||||||
|
this license or the ordinary General Public License is the better
|
||||||
|
strategy to use in any particular case, based on the explanations below.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom of use,
|
||||||
|
not price. Our General Public Licenses are designed to make sure that
|
||||||
|
you have the freedom to distribute copies of free software (and charge
|
||||||
|
for this service if you wish); that you receive source code or can get
|
||||||
|
it if you want it; that you can change the software and use pieces of
|
||||||
|
it in new free programs; and that you are informed that you can do
|
||||||
|
these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to make restrictions that forbid
|
||||||
|
distributors to deny you these rights or to ask you to surrender these
|
||||||
|
rights. These restrictions translate to certain responsibilities for
|
||||||
|
you if you distribute copies of the library or if you modify it.
|
||||||
|
|
||||||
|
For example, if you distribute copies of the library, whether gratis
|
||||||
|
or for a fee, you must give the recipients all the rights that we gave
|
||||||
|
you. You must make sure that they, too, receive or can get the source
|
||||||
|
code. If you link other code with the library, you must provide
|
||||||
|
complete object files to the recipients, so that they can relink them
|
||||||
|
with the library after making changes to the library and recompiling
|
||||||
|
it. And you must show them these terms so they know their rights.
|
||||||
|
|
||||||
|
We protect your rights with a two-step method: (1) we copyright the
|
||||||
|
library, and (2) we offer you this license, which gives you legal
|
||||||
|
permission to copy, distribute and/or modify the library.
|
||||||
|
|
||||||
|
To protect each distributor, we want to make it very clear that
|
||||||
|
there is no warranty for the free library. Also, if the library is
|
||||||
|
modified by someone else and passed on, the recipients should know
|
||||||
|
that what they have is not the original version, so that the original
|
||||||
|
author's reputation will not be affected by problems that might be
|
||||||
|
introduced by others.
|
||||||
|
|
||||||
|
Finally, software patents pose a constant threat to the existence of
|
||||||
|
any free program. We wish to make sure that a company cannot
|
||||||
|
effectively restrict the users of a free program by obtaining a
|
||||||
|
restrictive license from a patent holder. Therefore, we insist that
|
||||||
|
any patent license obtained for a version of the library must be
|
||||||
|
consistent with the full freedom of use specified in this license.
|
||||||
|
|
||||||
|
Most GNU software, including some libraries, is covered by the
|
||||||
|
ordinary GNU General Public License. This license, the GNU Lesser
|
||||||
|
General Public License, applies to certain designated libraries, and
|
||||||
|
is quite different from the ordinary General Public License. We use
|
||||||
|
this license for certain libraries in order to permit linking those
|
||||||
|
libraries into non-free programs.
|
||||||
|
|
||||||
|
When a program is linked with a library, whether statically or using
|
||||||
|
a shared library, the combination of the two is legally speaking a
|
||||||
|
combined work, a derivative of the original library. The ordinary
|
||||||
|
General Public License therefore permits such linking only if the
|
||||||
|
entire combination fits its criteria of freedom. The Lesser General
|
||||||
|
Public License permits more lax criteria for linking other code with
|
||||||
|
the library.
|
||||||
|
|
||||||
|
We call this license the "Lesser" General Public License because it
|
||||||
|
does Less to protect the user's freedom than the ordinary General
|
||||||
|
Public License. It also provides other free software developers Less
|
||||||
|
of an advantage over competing non-free programs. These disadvantages
|
||||||
|
are the reason we use the ordinary General Public License for many
|
||||||
|
libraries. However, the Lesser license provides advantages in certain
|
||||||
|
special circumstances.
|
||||||
|
|
||||||
|
For example, on rare occasions, there may be a special need to
|
||||||
|
encourage the widest possible use of a certain library, so that it becomes
|
||||||
|
a de-facto standard. To achieve this, non-free programs must be
|
||||||
|
allowed to use the library. A more frequent case is that a free
|
||||||
|
library does the same job as widely used non-free libraries. In this
|
||||||
|
case, there is little to gain by limiting the free library to free
|
||||||
|
software only, so we use the Lesser General Public License.
|
||||||
|
|
||||||
|
In other cases, permission to use a particular library in non-free
|
||||||
|
programs enables a greater number of people to use a large body of
|
||||||
|
free software. For example, permission to use the GNU C Library in
|
||||||
|
non-free programs enables many more people to use the whole GNU
|
||||||
|
operating system, as well as its variant, the GNU/Linux operating
|
||||||
|
system.
|
||||||
|
|
||||||
|
Although the Lesser General Public License is Less protective of the
|
||||||
|
users' freedom, it does ensure that the user of a program that is
|
||||||
|
linked with the Library has the freedom and the wherewithal to run
|
||||||
|
that program using a modified version of the Library.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow. Pay close attention to the difference between a
|
||||||
|
"work based on the library" and a "work that uses the library". The
|
||||||
|
former contains code derived from the library, whereas the latter must
|
||||||
|
be combined with the library in order to run.
|
||||||
|
|
||||||
|
GNU LESSER GENERAL PUBLIC LICENSE
|
||||||
|
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||||
|
|
||||||
|
0. This License Agreement applies to any software library or other
|
||||||
|
program which contains a notice placed by the copyright holder or
|
||||||
|
other authorized party saying it may be distributed under the terms of
|
||||||
|
this Lesser General Public License (also called "this License").
|
||||||
|
Each licensee is addressed as "you".
|
||||||
|
|
||||||
|
A "library" means a collection of software functions and/or data
|
||||||
|
prepared so as to be conveniently linked with application programs
|
||||||
|
(which use some of those functions and data) to form executables.
|
||||||
|
|
||||||
|
The "Library", below, refers to any such software library or work
|
||||||
|
which has been distributed under these terms. A "work based on the
|
||||||
|
Library" means either the Library or any derivative work under
|
||||||
|
copyright law: that is to say, a work containing the Library or a
|
||||||
|
portion of it, either verbatim or with modifications and/or translated
|
||||||
|
straightforwardly into another language. (Hereinafter, translation is
|
||||||
|
included without limitation in the term "modification".)
|
||||||
|
|
||||||
|
"Source code" for a work means the preferred form of the work for
|
||||||
|
making modifications to it. For a library, complete source code means
|
||||||
|
all the source code for all modules it contains, plus any associated
|
||||||
|
interface definition files, plus the scripts used to control compilation
|
||||||
|
and installation of the library.
|
||||||
|
|
||||||
|
Activities other than copying, distribution and modification are not
|
||||||
|
covered by this License; they are outside its scope. The act of
|
||||||
|
running a program using the Library is not restricted, and output from
|
||||||
|
such a program is covered only if its contents constitute a work based
|
||||||
|
on the Library (independent of the use of the Library in a tool for
|
||||||
|
writing it). Whether that is true depends on what the Library does
|
||||||
|
and what the program that uses the Library does.
|
||||||
|
|
||||||
|
1. You may copy and distribute verbatim copies of the Library's
|
||||||
|
complete source code as you receive it, in any medium, provided that
|
||||||
|
you conspicuously and appropriately publish on each copy an
|
||||||
|
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||||
|
all the notices that refer to this License and to the absence of any
|
||||||
|
warranty; and distribute a copy of this License along with the
|
||||||
|
Library.
|
||||||
|
|
||||||
|
You may charge a fee for the physical act of transferring a copy,
|
||||||
|
and you may at your option offer warranty protection in exchange for a
|
||||||
|
fee.
|
||||||
|
|
||||||
|
2. You may modify your copy or copies of the Library or any portion
|
||||||
|
of it, thus forming a work based on the Library, and copy and
|
||||||
|
distribute such modifications or work under the terms of Section 1
|
||||||
|
above, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) The modified work must itself be a software library.
|
||||||
|
|
||||||
|
b) You must cause the files modified to carry prominent notices
|
||||||
|
stating that you changed the files and the date of any change.
|
||||||
|
|
||||||
|
c) You must cause the whole of the work to be licensed at no
|
||||||
|
charge to all third parties under the terms of this License.
|
||||||
|
|
||||||
|
d) If a facility in the modified Library refers to a function or a
|
||||||
|
table of data to be supplied by an application program that uses
|
||||||
|
the facility, other than as an argument passed when the facility
|
||||||
|
is invoked, then you must make a good faith effort to ensure that,
|
||||||
|
in the event an application does not supply such function or
|
||||||
|
table, the facility still operates, and performs whatever part of
|
||||||
|
its purpose remains meaningful.
|
||||||
|
|
||||||
|
(For example, a function in a library to compute square roots has
|
||||||
|
a purpose that is entirely well-defined independent of the
|
||||||
|
application. Therefore, Subsection 2d requires that any
|
||||||
|
application-supplied function or table used by this function must
|
||||||
|
be optional: if the application does not supply it, the square
|
||||||
|
root function must still compute square roots.)
|
||||||
|
|
||||||
|
These requirements apply to the modified work as a whole. If
|
||||||
|
identifiable sections of that work are not derived from the Library,
|
||||||
|
and can be reasonably considered independent and separate works in
|
||||||
|
themselves, then this License, and its terms, do not apply to those
|
||||||
|
sections when you distribute them as separate works. But when you
|
||||||
|
distribute the same sections as part of a whole which is a work based
|
||||||
|
on the Library, the distribution of the whole must be on the terms of
|
||||||
|
this License, whose permissions for other licensees extend to the
|
||||||
|
entire whole, and thus to each and every part regardless of who wrote
|
||||||
|
it.
|
||||||
|
|
||||||
|
Thus, it is not the intent of this section to claim rights or contest
|
||||||
|
your rights to work written entirely by you; rather, the intent is to
|
||||||
|
exercise the right to control the distribution of derivative or
|
||||||
|
collective works based on the Library.
|
||||||
|
|
||||||
|
In addition, mere aggregation of another work not based on the Library
|
||||||
|
with the Library (or with a work based on the Library) on a volume of
|
||||||
|
a storage or distribution medium does not bring the other work under
|
||||||
|
the scope of this License.
|
||||||
|
|
||||||
|
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||||
|
License instead of this License to a given copy of the Library. To do
|
||||||
|
this, you must alter all the notices that refer to this License, so
|
||||||
|
that they refer to the ordinary GNU General Public License, version 2,
|
||||||
|
instead of to this License. (If a newer version than version 2 of the
|
||||||
|
ordinary GNU General Public License has appeared, then you can specify
|
||||||
|
that version instead if you wish.) Do not make any other change in
|
||||||
|
these notices.
|
||||||
|
|
||||||
|
Once this change is made in a given copy, it is irreversible for
|
||||||
|
that copy, so the ordinary GNU General Public License applies to all
|
||||||
|
subsequent copies and derivative works made from that copy.
|
||||||
|
|
||||||
|
This option is useful when you wish to copy part of the code of
|
||||||
|
the Library into a program that is not a library.
|
||||||
|
|
||||||
|
4. You may copy and distribute the Library (or a portion or
|
||||||
|
derivative of it, under Section 2) in object code or executable form
|
||||||
|
under the terms of Sections 1 and 2 above provided that you accompany
|
||||||
|
it with the complete corresponding machine-readable source code, which
|
||||||
|
must be distributed under the terms of Sections 1 and 2 above on a
|
||||||
|
medium customarily used for software interchange.
|
||||||
|
|
||||||
|
If distribution of object code is made by offering access to copy
|
||||||
|
from a designated place, then offering equivalent access to copy the
|
||||||
|
source code from the same place satisfies the requirement to
|
||||||
|
distribute the source code, even though third parties are not
|
||||||
|
compelled to copy the source along with the object code.
|
||||||
|
|
||||||
|
5. A program that contains no derivative of any portion of the
|
||||||
|
Library, but is designed to work with the Library by being compiled or
|
||||||
|
linked with it, is called a "work that uses the Library". Such a
|
||||||
|
work, in isolation, is not a derivative work of the Library, and
|
||||||
|
therefore falls outside the scope of this License.
|
||||||
|
|
||||||
|
However, linking a "work that uses the Library" with the Library
|
||||||
|
creates an executable that is a derivative of the Library (because it
|
||||||
|
contains portions of the Library), rather than a "work that uses the
|
||||||
|
library". The executable is therefore covered by this License.
|
||||||
|
Section 6 states terms for distribution of such executables.
|
||||||
|
|
||||||
|
When a "work that uses the Library" uses material from a header file
|
||||||
|
that is part of the Library, the object code for the work may be a
|
||||||
|
derivative work of the Library even though the source code is not.
|
||||||
|
Whether this is true is especially significant if the work can be
|
||||||
|
linked without the Library, or if the work is itself a library. The
|
||||||
|
threshold for this to be true is not precisely defined by law.
|
||||||
|
|
||||||
|
If such an object file uses only numerical parameters, data
|
||||||
|
structure layouts and accessors, and small macros and small inline
|
||||||
|
functions (ten lines or less in length), then the use of the object
|
||||||
|
file is unrestricted, regardless of whether it is legally a derivative
|
||||||
|
work. (Executables containing this object code plus portions of the
|
||||||
|
Library will still fall under Section 6.)
|
||||||
|
|
||||||
|
Otherwise, if the work is a derivative of the Library, you may
|
||||||
|
distribute the object code for the work under the terms of Section 6.
|
||||||
|
Any executables containing that work also fall under Section 6,
|
||||||
|
whether or not they are linked directly with the Library itself.
|
||||||
|
|
||||||
|
6. As an exception to the Sections above, you may also combine or
|
||||||
|
link a "work that uses the Library" with the Library to produce a
|
||||||
|
work containing portions of the Library, and distribute that work
|
||||||
|
under terms of your choice, provided that the terms permit
|
||||||
|
modification of the work for the customer's own use and reverse
|
||||||
|
engineering for debugging such modifications.
|
||||||
|
|
||||||
|
You must give prominent notice with each copy of the work that the
|
||||||
|
Library is used in it and that the Library and its use are covered by
|
||||||
|
this License. You must supply a copy of this License. If the work
|
||||||
|
during execution displays copyright notices, you must include the
|
||||||
|
copyright notice for the Library among them, as well as a reference
|
||||||
|
directing the user to the copy of this License. Also, you must do one
|
||||||
|
of these things:
|
||||||
|
|
||||||
|
a) Accompany the work with the complete corresponding
|
||||||
|
machine-readable source code for the Library including whatever
|
||||||
|
changes were used in the work (which must be distributed under
|
||||||
|
Sections 1 and 2 above); and, if the work is an executable linked
|
||||||
|
with the Library, with the complete machine-readable "work that
|
||||||
|
uses the Library", as object code and/or source code, so that the
|
||||||
|
user can modify the Library and then relink to produce a modified
|
||||||
|
executable containing the modified Library. (It is understood
|
||||||
|
that the user who changes the contents of definitions files in the
|
||||||
|
Library will not necessarily be able to recompile the application
|
||||||
|
to use the modified definitions.)
|
||||||
|
|
||||||
|
b) Use a suitable shared library mechanism for linking with the
|
||||||
|
Library. A suitable mechanism is one that (1) uses at run time a
|
||||||
|
copy of the library already present on the user's computer system,
|
||||||
|
rather than copying library functions into the executable, and (2)
|
||||||
|
will operate properly with a modified version of the library, if
|
||||||
|
the user installs one, as long as the modified version is
|
||||||
|
interface-compatible with the version that the work was made with.
|
||||||
|
|
||||||
|
c) Accompany the work with a written offer, valid for at
|
||||||
|
least three years, to give the same user the materials
|
||||||
|
specified in Subsection 6a, above, for a charge no more
|
||||||
|
than the cost of performing this distribution.
|
||||||
|
|
||||||
|
d) If distribution of the work is made by offering access to copy
|
||||||
|
from a designated place, offer equivalent access to copy the above
|
||||||
|
specified materials from the same place.
|
||||||
|
|
||||||
|
e) Verify that the user has already received a copy of these
|
||||||
|
materials or that you have already sent this user a copy.
|
||||||
|
|
||||||
|
For an executable, the required form of the "work that uses the
|
||||||
|
Library" must include any data and utility programs needed for
|
||||||
|
reproducing the executable from it. However, as a special exception,
|
||||||
|
the materials to be distributed need not include anything that is
|
||||||
|
normally distributed (in either source or binary form) with the major
|
||||||
|
components (compiler, kernel, and so on) of the operating system on
|
||||||
|
which the executable runs, unless that component itself accompanies
|
||||||
|
the executable.
|
||||||
|
|
||||||
|
It may happen that this requirement contradicts the license
|
||||||
|
restrictions of other proprietary libraries that do not normally
|
||||||
|
accompany the operating system. Such a contradiction means you cannot
|
||||||
|
use both them and the Library together in an executable that you
|
||||||
|
distribute.
|
||||||
|
|
||||||
|
7. You may place library facilities that are a work based on the
|
||||||
|
Library side-by-side in a single library together with other library
|
||||||
|
facilities not covered by this License, and distribute such a combined
|
||||||
|
library, provided that the separate distribution of the work based on
|
||||||
|
the Library and of the other library facilities is otherwise
|
||||||
|
permitted, and provided that you do these two things:
|
||||||
|
|
||||||
|
a) Accompany the combined library with a copy of the same work
|
||||||
|
based on the Library, uncombined with any other library
|
||||||
|
facilities. This must be distributed under the terms of the
|
||||||
|
Sections above.
|
||||||
|
|
||||||
|
b) Give prominent notice with the combined library of the fact
|
||||||
|
that part of it is a work based on the Library, and explaining
|
||||||
|
where to find the accompanying uncombined form of the same work.
|
||||||
|
|
||||||
|
8. You may not copy, modify, sublicense, link with, or distribute
|
||||||
|
the Library except as expressly provided under this License. Any
|
||||||
|
attempt otherwise to copy, modify, sublicense, link with, or
|
||||||
|
distribute the Library is void, and will automatically terminate your
|
||||||
|
rights under this License. However, parties who have received copies,
|
||||||
|
or rights, from you under this License will not have their licenses
|
||||||
|
terminated so long as such parties remain in full compliance.
|
||||||
|
|
||||||
|
9. You are not required to accept this License, since you have not
|
||||||
|
signed it. However, nothing else grants you permission to modify or
|
||||||
|
distribute the Library or its derivative works. These actions are
|
||||||
|
prohibited by law if you do not accept this License. Therefore, by
|
||||||
|
modifying or distributing the Library (or any work based on the
|
||||||
|
Library), you indicate your acceptance of this License to do so, and
|
||||||
|
all its terms and conditions for copying, distributing or modifying
|
||||||
|
the Library or works based on it.
|
||||||
|
|
||||||
|
10. Each time you redistribute the Library (or any work based on the
|
||||||
|
Library), the recipient automatically receives a license from the
|
||||||
|
original licensor to copy, distribute, link with or modify the Library
|
||||||
|
subject to these terms and conditions. You may not impose any further
|
||||||
|
restrictions on the recipients' exercise of the rights granted herein.
|
||||||
|
You are not responsible for enforcing compliance by third parties with
|
||||||
|
this License.
|
||||||
|
|
||||||
|
11. If, as a consequence of a court judgment or allegation of patent
|
||||||
|
infringement or for any other reason (not limited to patent issues),
|
||||||
|
conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot
|
||||||
|
distribute so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you
|
||||||
|
may not distribute the Library at all. For example, if a patent
|
||||||
|
license would not permit royalty-free redistribution of the Library by
|
||||||
|
all those who receive copies directly or indirectly through you, then
|
||||||
|
the only way you could satisfy both it and this License would be to
|
||||||
|
refrain entirely from distribution of the Library.
|
||||||
|
|
||||||
|
If any portion of this section is held invalid or unenforceable under any
|
||||||
|
particular circumstance, the balance of the section is intended to apply,
|
||||||
|
and the section as a whole is intended to apply in other circumstances.
|
||||||
|
|
||||||
|
It is not the purpose of this section to induce you to infringe any
|
||||||
|
patents or other property right claims or to contest validity of any
|
||||||
|
such claims; this section has the sole purpose of protecting the
|
||||||
|
integrity of the free software distribution system which is
|
||||||
|
implemented by public license practices. Many people have made
|
||||||
|
generous contributions to the wide range of software distributed
|
||||||
|
through that system in reliance on consistent application of that
|
||||||
|
system; it is up to the author/donor to decide if he or she is willing
|
||||||
|
to distribute software through any other system and a licensee cannot
|
||||||
|
impose that choice.
|
||||||
|
|
||||||
|
This section is intended to make thoroughly clear what is believed to
|
||||||
|
be a consequence of the rest of this License.
|
||||||
|
|
||||||
|
12. If the distribution and/or use of the Library is restricted in
|
||||||
|
certain countries either by patents or by copyrighted interfaces, the
|
||||||
|
original copyright holder who places the Library under this License may add
|
||||||
|
an explicit geographical distribution limitation excluding those countries,
|
||||||
|
so that distribution is permitted only in or among countries not thus
|
||||||
|
excluded. In such case, this License incorporates the limitation as if
|
||||||
|
written in the body of this License.
|
||||||
|
|
||||||
|
13. The Free Software Foundation may publish revised and/or new
|
||||||
|
versions of the Lesser General Public License from time to time.
|
||||||
|
Such new versions will be similar in spirit to the present version,
|
||||||
|
but may differ in detail to address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the Library
|
||||||
|
specifies a version number of this License which applies to it and
|
||||||
|
"any later version", you have the option of following the terms and
|
||||||
|
conditions either of that version or of any later version published by
|
||||||
|
the Free Software Foundation. If the Library does not specify a
|
||||||
|
license version number, you may choose any version ever published by
|
||||||
|
the Free Software Foundation.
|
||||||
|
|
||||||
|
14. If you wish to incorporate parts of the Library into other free
|
||||||
|
programs whose distribution conditions are incompatible with these,
|
||||||
|
write to the author to ask for permission. For software which is
|
||||||
|
copyrighted by the Free Software Foundation, write to the Free
|
||||||
|
Software Foundation; we sometimes make exceptions for this. Our
|
||||||
|
decision will be guided by the two goals of preserving the free status
|
||||||
|
of all derivatives of our free software and of promoting the sharing
|
||||||
|
and reuse of software generally.
|
||||||
|
|
||||||
|
NO WARRANTY
|
||||||
|
|
||||||
|
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||||
|
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||||
|
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||||
|
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||||
|
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||||
|
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||||
|
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||||
|
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||||
|
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||||
|
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||||
|
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||||
|
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||||
|
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||||
|
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||||
|
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||||
|
DAMAGES.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Libraries
|
||||||
|
|
||||||
|
If you develop a new library, and you want it to be of the greatest
|
||||||
|
possible use to the public, we recommend making it free software that
|
||||||
|
everyone can redistribute and change. You can do so by permitting
|
||||||
|
redistribution under these terms (or, alternatively, under the terms of the
|
||||||
|
ordinary General Public License).
|
||||||
|
|
||||||
|
To apply these terms, attach the following notices to the library. It is
|
||||||
|
safest to attach them to the start of each source file to most effectively
|
||||||
|
convey the exclusion of warranty; and each file should have at least the
|
||||||
|
"copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
<one line to give the library's name and a brief idea of what it does.>
|
||||||
|
Copyright (C) <year> <name of author>
|
||||||
|
|
||||||
|
This library is free software; you can redistribute it and/or
|
||||||
|
modify it under the terms of the GNU Lesser General Public
|
||||||
|
License as published by the Free Software Foundation; either
|
||||||
|
version 2.1 of the License, or (at your option) any later version.
|
||||||
|
|
||||||
|
This library is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
Lesser General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU Lesser General Public
|
||||||
|
License along with this library; if not, write to the Free Software
|
||||||
|
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or your
|
||||||
|
school, if any, to sign a "copyright disclaimer" for the library, if
|
||||||
|
necessary. Here is a sample; alter the names:
|
||||||
|
|
||||||
|
Yoyodyne, Inc., hereby disclaims all copyright interest in the
|
||||||
|
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
|
||||||
|
|
||||||
|
<signature of Ty Coon>, 1 April 1990
|
||||||
|
Ty Coon, President of Vice
|
||||||
|
|
||||||
|
That's all there is to it!
|
||||||
500
SPECS/audit.spec
Normal file
500
SPECS/audit.spec
Normal file
@ -0,0 +1,500 @@
|
|||||||
|
%{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
|
||||||
|
|
||||||
|
Summary: User space tools for 2.6 kernel auditing
|
||||||
|
Name: audit
|
||||||
|
Version: 3.0
|
||||||
|
Release: 0.10.20180831git0047a6c%{?dist}
|
||||||
|
License: GPLv2+
|
||||||
|
URL: http://people.redhat.com/sgrubb/audit/
|
||||||
|
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}-alpha5.tar.gz
|
||||||
|
Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
|
||||||
|
# Update documentation and rules
|
||||||
|
Patch1: audit-3.0-docs.patch
|
||||||
|
# 1628626 - lightly parse USER_AVC events
|
||||||
|
Patch2: audit-3.0-user_avc.patch
|
||||||
|
# Fix a buffer length calculation in ausearch
|
||||||
|
Patch3: audit-3.0-ausearch-buffer-fix.patch
|
||||||
|
# Remove CAP_AUDIT_READ from daemon permission checks
|
||||||
|
Patch4: audit-3.0-cap_audit_read.patch
|
||||||
|
# Port af_unix plugin to libev
|
||||||
|
Patch5: audit-3.0-af_unix-plugin.patch
|
||||||
|
# Make all network originating events VER2 dispatcher protocol
|
||||||
|
Patch6: audit-3.0-network-orig-events.patch
|
||||||
|
# Adjust state report for plugin queue
|
||||||
|
Patch7: audit-3.0-queue-report.patch
|
||||||
|
# 1643567 - auditd wasn't quite stopped when it was supposed to be
|
||||||
|
Patch8: audit-3.0-auditd-stop.patch
|
||||||
|
# In libev, cold functions cause annocheck failures. Remove them.
|
||||||
|
Patch9: audit-3.0-libev-remove-cold.patch
|
||||||
|
# Next BuildRequires is only needed for the patching - remove in the future
|
||||||
|
BuildRequires: autoconf automake
|
||||||
|
|
||||||
|
BuildRequires: gcc swig
|
||||||
|
BuildRequires: openldap-devel
|
||||||
|
BuildRequires: krb5-devel libcap-ng-devel
|
||||||
|
BuildRequires: kernel-headers >= 2.6.29
|
||||||
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
BuildRequires: systemd
|
||||||
|
Requires(post): systemd coreutils
|
||||||
|
Requires(preun): systemd
|
||||||
|
Requires(postun): systemd coreutils
|
||||||
|
|
||||||
|
%description
|
||||||
|
The audit package contains the user space utilities for
|
||||||
|
storing and searching the audit records generated by
|
||||||
|
the audit subsystem in the Linux 2.6 and later kernels.
|
||||||
|
|
||||||
|
%package libs
|
||||||
|
Summary: Dynamic library for libaudit
|
||||||
|
License: LGPLv2+
|
||||||
|
|
||||||
|
%description libs
|
||||||
|
The audit-libs package contains the dynamic libraries needed for
|
||||||
|
applications to use the audit framework.
|
||||||
|
|
||||||
|
%package libs-devel
|
||||||
|
Summary: Header files for libaudit
|
||||||
|
License: LGPLv2+
|
||||||
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
Requires: kernel-headers >= 2.6.29
|
||||||
|
|
||||||
|
%description libs-devel
|
||||||
|
The audit-libs-devel package contains the header files needed for
|
||||||
|
developing applications that need to use the audit framework libraries.
|
||||||
|
|
||||||
|
%package -n python3-audit
|
||||||
|
Summary: Python3 bindings for libaudit
|
||||||
|
License: LGPLv2+
|
||||||
|
BuildRequires: python3-devel
|
||||||
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
Provides: audit-libs-python3 = %{version}-%{release}
|
||||||
|
Provides: audit-libs-python3%{?_isa} = %{version}-%{release}
|
||||||
|
Obsoletes: audit-libs-python3 < %{version}-%{release}
|
||||||
|
|
||||||
|
%description -n python3-audit
|
||||||
|
The python3-audit package contains the bindings so that libaudit
|
||||||
|
and libauparse can be used by python3.
|
||||||
|
|
||||||
|
%package -n audispd-plugins
|
||||||
|
Summary: Plugins for the audit event dispatcher
|
||||||
|
License: GPLv2+
|
||||||
|
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||||
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
|
||||||
|
%description -n audispd-plugins
|
||||||
|
The audispd-plugins package provides plugins for the real-time
|
||||||
|
interface to the audit system, audispd. These plugins can do things
|
||||||
|
like relay events to remote machines.
|
||||||
|
|
||||||
|
%package -n audispd-plugins-zos
|
||||||
|
Summary: z/OS plugin for the audit event dispatcher
|
||||||
|
License: GPLv2+
|
||||||
|
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||||
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
Requires: openldap
|
||||||
|
|
||||||
|
%description -n audispd-plugins-zos
|
||||||
|
The audispd-plugins-zos package provides a plugin that will forward all
|
||||||
|
incoming audit events, as they happen, to a configured z/OS SMF (Service
|
||||||
|
Management Facility) database, through an IBM Tivoli Directory Server
|
||||||
|
(ITDS) set for Remote Audit service.
|
||||||
|
|
||||||
|
%enable_gotoolset7
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -q
|
||||||
|
%patch1 -p1
|
||||||
|
%patch2 -p1
|
||||||
|
%patch3 -p1
|
||||||
|
%patch4 -p1
|
||||||
|
%patch5 -p1
|
||||||
|
%patch6 -p1
|
||||||
|
%patch7 -p1
|
||||||
|
%patch8 -p1
|
||||||
|
%patch9 -p1
|
||||||
|
cp %{SOURCE1} .
|
||||||
|
autoreconf
|
||||||
|
|
||||||
|
%build
|
||||||
|
%configure --sbindir=/sbin --libdir=/%{_lib} --with-python=no \
|
||||||
|
--with-python3=yes \
|
||||||
|
--enable-gssapi-krb5=yes --with-arm --with-aarch64 \
|
||||||
|
--with-libcap-ng=yes --enable-zos-remote \
|
||||||
|
--enable-systemd
|
||||||
|
|
||||||
|
make CFLAGS="%{optflags}" %{?_smp_mflags}
|
||||||
|
|
||||||
|
%install
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audit/plugins.d,etc/audit/rules.d}
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/%{_lib}
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
|
||||||
|
mkdir -p --mode=0700 $RPM_BUILD_ROOT/%{_var}/log/audit
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit
|
||||||
|
make DESTDIR=$RPM_BUILD_ROOT install
|
||||||
|
|
||||||
|
mkdir -p $RPM_BUILD_ROOT/%{_libdir}
|
||||||
|
curdir=`pwd`
|
||||||
|
cd $RPM_BUILD_ROOT/%{_libdir}
|
||||||
|
LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.1.*.*\``
|
||||||
|
ln -s ../../%{_lib}/$LIBNAME libaudit.so
|
||||||
|
LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.0.*.*\``
|
||||||
|
ln -s ../../%{_lib}/$LIBNAME libauparse.so
|
||||||
|
cd $curdir
|
||||||
|
# Remove these items so they don't get picked up.
|
||||||
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
|
||||||
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
|
||||||
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.a
|
||||||
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.a
|
||||||
|
|
||||||
|
find $RPM_BUILD_ROOT -name '*.la' -delete
|
||||||
|
find $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages -name '*.a' -delete
|
||||||
|
|
||||||
|
# Move the pkgconfig file
|
||||||
|
mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
|
||||||
|
|
||||||
|
# On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
|
||||||
|
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
||||||
|
touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
|
||||||
|
|
||||||
|
%check
|
||||||
|
make check
|
||||||
|
# Get rid of make files so that they don't get packaged.
|
||||||
|
rm -f rules/Makefile*
|
||||||
|
|
||||||
|
%post
|
||||||
|
# Copy default rules into place on new installation
|
||||||
|
files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
|
||||||
|
if [ "$files" -eq 0 ] ; then
|
||||||
|
if [ -e /usr/share/doc/audit/rules/10-base-config.rules ] ; then
|
||||||
|
cp /usr/share/doc/audit/rules/10-base-config.rules /etc/audit/rules.d/audit.rules
|
||||||
|
else
|
||||||
|
touch /etc/audit/rules.d/audit.rules
|
||||||
|
fi
|
||||||
|
chmod 0600 /etc/audit/rules.d/audit.rules
|
||||||
|
fi
|
||||||
|
%systemd_post auditd.service
|
||||||
|
|
||||||
|
%preun
|
||||||
|
%systemd_preun auditd.service
|
||||||
|
|
||||||
|
%postun
|
||||||
|
if [ $1 -ge 1 ]; then
|
||||||
|
/sbin/service auditd condrestart > /dev/null 2>&1 || :
|
||||||
|
fi
|
||||||
|
|
||||||
|
%files libs
|
||||||
|
%{!?_licensedir:%global license %%doc}
|
||||||
|
%license lgpl-2.1.txt
|
||||||
|
/%{_lib}/libaudit.so.1*
|
||||||
|
/%{_lib}/libauparse.*
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
|
||||||
|
%{_mandir}/man5/libaudit.conf.5.gz
|
||||||
|
|
||||||
|
%files libs-devel
|
||||||
|
%doc contrib/plugin
|
||||||
|
%{_libdir}/libaudit.so
|
||||||
|
%{_libdir}/libauparse.so
|
||||||
|
%{_includedir}/libaudit.h
|
||||||
|
%{_includedir}/auparse.h
|
||||||
|
%{_includedir}/auparse-defs.h
|
||||||
|
%{_datadir}/aclocal/audit.m4
|
||||||
|
%{_libdir}/pkgconfig/audit.pc
|
||||||
|
%{_libdir}/pkgconfig/auparse.pc
|
||||||
|
%{_mandir}/man3/*
|
||||||
|
|
||||||
|
%files -n python3-audit
|
||||||
|
%attr(755,root,root) %{python3_sitearch}/*
|
||||||
|
|
||||||
|
%files
|
||||||
|
%doc README ChangeLog rules init.d/auditd.cron
|
||||||
|
%{!?_licensedir:%global license %%doc}
|
||||||
|
%license COPYING
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/autrace.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
|
||||||
|
%attr(755,root,root) /sbin/auditctl
|
||||||
|
%attr(755,root,root) /sbin/auditd
|
||||||
|
%attr(755,root,root) /sbin/ausearch
|
||||||
|
%attr(755,root,root) /sbin/aureport
|
||||||
|
%attr(750,root,root) /sbin/autrace
|
||||||
|
%attr(750,root,root) /sbin/augenrules
|
||||||
|
%attr(755,root,root) %{_bindir}/aulast
|
||||||
|
%attr(755,root,root) %{_bindir}/aulastlog
|
||||||
|
%attr(755,root,root) %{_bindir}/ausyscall
|
||||||
|
%attr(755,root,root) %{_bindir}/auvirt
|
||||||
|
%attr(644,root,root) %{_unitdir}/auditd.service
|
||||||
|
%attr(750,root,root) %dir %{_libexecdir}/initscripts/legacy-actions/auditd
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/condrestart
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/reload
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/restart
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/resume
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/rotate
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/state
|
||||||
|
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/stop
|
||||||
|
%ghost %{_localstatedir}/run/auditd.state
|
||||||
|
%attr(750,root,root) %dir %{_var}/log/audit
|
||||||
|
%attr(750,root,root) %dir /etc/audit
|
||||||
|
%attr(750,root,root) %dir /etc/audit/rules.d
|
||||||
|
%attr(750,root,root) %dir /etc/audit/plugins.d
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
|
||||||
|
%ghost %config(noreplace) %attr(600,root,root) /etc/audit/rules.d/audit.rules
|
||||||
|
%ghost %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/audit-stop.rules
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/af_unix.conf
|
||||||
|
|
||||||
|
%files -n audispd-plugins
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-remote.conf
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
|
||||||
|
%attr(750,root,root) /sbin/audisp-remote
|
||||||
|
%attr(750,root,root) /sbin/audisp-syslog
|
||||||
|
%attr(700,root,root) %dir %{_var}/spool/audit
|
||||||
|
%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz
|
||||||
|
|
||||||
|
%files -n audispd-plugins-zos
|
||||||
|
%attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
|
||||||
|
%attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/audispd-zos-remote.conf
|
||||||
|
%config(noreplace) %attr(640,root,root) /etc/audit/zos-remote.conf
|
||||||
|
%attr(750,root,root) /sbin/audispd-zos-remote
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Wed Jan 09 2019 Steve Grubb <sgrubb@redhat.com> 3.0-0.10.20180831git0047a6c
|
||||||
|
resolves: rhbz#1655270] Message "audit: backlog limit exceeded" reported
|
||||||
|
- Fix annobin failure
|
||||||
|
|
||||||
|
* Fri Dec 07 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.8.20180831git0047a6c
|
||||||
|
resolves: rhbz#1639745 - build requires go-toolset-7 which is not available
|
||||||
|
resolves: rhbz#1643567 - service auditd stop exits prematurely
|
||||||
|
resolves: rhbz#1616428 - Update git snapshot of audit package
|
||||||
|
- Remove static libs subpackage
|
||||||
|
|
||||||
|
* Fri Aug 31 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.5.20180831git0047a6c
|
||||||
|
resolves: rhbz#1616428 - Update git snapshot of audit package
|
||||||
|
|
||||||
|
* Wed Aug 08 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.2.20180808git77fbcf3
|
||||||
|
resolves: rhbz#1567357 New upstream feature prerelease
|
||||||
|
|
||||||
|
* Tue Jul 17 2018 Steve Grubb <sgrubb@redhat.com> 3.0-0.1.20180717gitacd53d1
|
||||||
|
- New upstream feature prerelease
|
||||||
|
|
||||||
|
* Tue Jun 26 2018 Steve Grubb <sgrubb@redhat.com> 2.8.4-2
|
||||||
|
- Fix segfault on shutdown
|
||||||
|
|
||||||
|
* Tue Jun 19 2018 Steve Grubb <sgrubb@redhat.com> 2.8.4-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Wed May 30 2018 Steve Grubb <sgrubb@redhat.com> 2.8.3-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
- Remove Python2 support
|
||||||
|
|
||||||
|
* Fri Apr 13 2018 Tom Stellard <tstellar@redhat.com> - 2.7.8-2
|
||||||
|
- Use go-toolset-7 instead of golang
|
||||||
|
- Package now must be built with: rhpkg --release rhel-8.0-go-toolset
|
||||||
|
|
||||||
|
* Mon Sep 18 2017 Steve Grubb <sgrubb@redhat.com> 2.7.8-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.7-5
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
||||||
|
|
||||||
|
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.7-4
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||||
|
|
||||||
|
* Fri Jul 14 2017 Steve Grubb <sgrubb@redhat.com> 2.7.7-3
|
||||||
|
- undo scratch build
|
||||||
|
|
||||||
|
* Fri Jun 16 2017 Steve Grubb <sgrubb@redhat.com> 2.7.7-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Wed Apr 19 2017 Steve Grubb <sgrubb@redhat.com> 2.7.6-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Mon Apr 10 2017 Steve Grubb <sgrubb@redhat.com> 2.7.5-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Tue Mar 28 2017 Steve Grubb <sgrubb@redhat.com> 2.7.4-1
|
||||||
|
- New upstream feature and bugfix release
|
||||||
|
|
||||||
|
* Fri Feb 24 2017 Steve Grubb <sgrubb@redhat.com> 2.7.3-1
|
||||||
|
- New upstream feature and bugfix release
|
||||||
|
|
||||||
|
* Mon Feb 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.2-2
|
||||||
|
- Fix ausearch csv output
|
||||||
|
|
||||||
|
* Mon Feb 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.2-1
|
||||||
|
- New upstream feature and bugfix release
|
||||||
|
|
||||||
|
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
||||||
|
|
||||||
|
* Fri Jan 13 2017 Steve Grubb <sgrubb@redhat.com> 2.7.1-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 2.7-2
|
||||||
|
- Rebuild for Python 3.6
|
||||||
|
|
||||||
|
* Thu Dec 15 2016 Steve Grubb <sgrubb@redhat.com> 2.7-1
|
||||||
|
- New upstream feature release
|
||||||
|
|
||||||
|
* Sun Sep 11 2016 Steve Grubb <sgrubb@redhat.com> 2.6.7-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Mon Aug 01 2016 Steve Grubb <sgrubb@redhat.com> 2.6.6-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Thu Jul 21 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6.5-3
|
||||||
|
- https://fedoraproject.org/wiki/Changes/golang1.7
|
||||||
|
|
||||||
|
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6.5-2
|
||||||
|
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
|
||||||
|
|
||||||
|
* Thu Jul 14 2016 Steve Grubb <sgrubb@redhat.com> 2.6.5-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Fri Jul 08 2016 Steve Grubb <sgrubb@redhat.com> 2.6.4-2
|
||||||
|
- Correct size information of dispatched event
|
||||||
|
|
||||||
|
* Fri Jul 08 2016 Steve Grubb <sgrubb@redhat.com> 2.6.4-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Tue Jul 05 2016 Steve Grubb <sgrubb@redhat.com> 2.6.3-2
|
||||||
|
- Fix sockaddr event interpretation
|
||||||
|
|
||||||
|
* Tue Jul 05 2016 Steve Grubb <sgrubb@redhat.com> 2.6.3-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Fri Jul 01 2016 Steve Grubb <sgrubb@redhat.com> 2.6.2-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
- Fixes 1351954 - prevents virtual machine from starting up in GNOME Boxes
|
||||||
|
|
||||||
|
* Tue Jun 28 2016 Steve Grubb <sgrubb@redhat.com> 2.6.1-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Wed Jun 22 2016 Steve Grubb <sgrubb@redhat.com> 2.6-3
|
||||||
|
- New upstream release
|
||||||
|
|
||||||
|
* Fri Apr 29 2016 Steve Grubb <sgrubb@redhat.com> 2.5.2-1
|
||||||
|
- New upstream release
|
||||||
|
|
||||||
|
* Thu Apr 28 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-2
|
||||||
|
- Refactor plugins to split out zos-remote to lower dependencies
|
||||||
|
|
||||||
|
* Wed Apr 13 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-1
|
||||||
|
- New upstream release
|
||||||
|
|
||||||
|
* Fri Mar 18 2016 Steve Grubb <sgrubb@redhat.com> 2.5-4
|
||||||
|
- Fixes #1313152 - post script fails on dnf --setopt=tsflags=nodocs install
|
||||||
|
|
||||||
|
* Mon Feb 22 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.5-3
|
||||||
|
- https://fedoraproject.org/wiki/Changes/golang1.6
|
||||||
|
|
||||||
|
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Jan 11 2016 Steve Grubb <sgrubb@redhat.com> 2.5-1
|
||||||
|
- New upstream release
|
||||||
|
- Fixes #1241565 - still logs way too much
|
||||||
|
- Fixes #1238051 - audit.rules should be generated from by augenrules
|
||||||
|
|
||||||
|
* Fri Dec 18 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Wed Nov 04 2015 Robert Kuska <rkuska@redhat.com> - 2.4.4-3
|
||||||
|
- Rebuilt for Python3.5 rebuild
|
||||||
|
|
||||||
|
* Wed Sep 16 2015 Peter Robinson <pbrobinson@fedoraproject.org> 2.4.4-2
|
||||||
|
- Fix FTBFS with hardened flags by using the distro CFLAGS
|
||||||
|
- Tighten deps with the _isa macro
|
||||||
|
- Use goarches macro to define supported GO architectures
|
||||||
|
- Minor cleanups
|
||||||
|
|
||||||
|
* Thu Aug 13 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
- Fixes CVE-2015-5186 Audit: log terminal emulator escape sequences handling
|
||||||
|
|
||||||
|
* Thu Jul 16 2015 Steve Grubb <sgrubb@redhat.com> 2.4.3-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
- Adds python3 support
|
||||||
|
|
||||||
|
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.2-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Apr 28 2015 Steve Grubb <sgrubb@redhat.com> 2.4.2-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.4.1-2
|
||||||
|
- Rebuilt for Fedora 23 Change
|
||||||
|
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
|
||||||
|
|
||||||
|
* Tue Oct 28 2014 Steve Grubb <sgrubb@redhat.com> 2.4.1-1
|
||||||
|
- New upstream feature and bugfix release
|
||||||
|
|
||||||
|
* Mon Oct 06 2014 Karsten Hopp <karsten@redhat.com> 2.4-2
|
||||||
|
- bump release and rebuild for upgradepath
|
||||||
|
|
||||||
|
* Sun Aug 24 2014 Steve Grubb <sgrubb@redhat.com> 2.4-1
|
||||||
|
- New upstream feature and bugfix release
|
||||||
|
|
||||||
|
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.8-0.3.svn20140803
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Aug 4 2014 Peter Robinson <pbrobinson@fedoraproject.org> 2.3.8-0.2.svn20140803
|
||||||
|
- aarch64/PPC/s390 don't have golang
|
||||||
|
|
||||||
|
* Sat Aug 02 2014 Steve Grubb <sgrubb@redhat.com> 2.3.8-0.1.svn20140803
|
||||||
|
- New upstream svn snapshot
|
||||||
|
|
||||||
|
* Tue Jul 22 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-4
|
||||||
|
- Bug 1117953 - Per fesco#1311, please disable syscall auditing by default
|
||||||
|
|
||||||
|
* Fri Jul 11 2014 Tom Callaway <spot@fedoraproject.org> - 2.3.7-3
|
||||||
|
- mark license files properly
|
||||||
|
|
||||||
|
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.7-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Jun 03 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-1
|
||||||
|
- New upstream bugfix release
|
||||||
|
|
||||||
|
* Fri Apr 11 2014 Steve Grubb <sgrubb@redhat.com> 2.3.6-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Mon Mar 17 2014 Steve Grubb <sgrubb@redhat.com> 2.3.5-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Thu Feb 27 2014 Steve Grubb <sgrubb@redhat.com> 2.3.4-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Thu Jan 16 2014 Steve Grubb <sgrubb@redhat.com> 2.3.3-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Mon Jul 29 2013 Steve Grubb <sgrubb@redhat.com> 2.3.2-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Fri Jun 21 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-3
|
||||||
|
- Drop prelude support
|
||||||
|
|
||||||
|
* Fri May 31 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-2
|
||||||
|
- Fix unknown lvalue in auditd.service (#969345)
|
||||||
|
|
||||||
|
* Thu May 30 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-1
|
||||||
|
- New upstream bugfix/enhancement release
|
||||||
|
|
||||||
|
* Fri May 03 2013 Steve Grubb <sgrubb@redhat.com> 2.3-2
|
||||||
|
- If no rules exist, copy shipped rules into place
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user