diff --git a/_multibuild b/_multibuild new file mode 100644 index 0000000..831aaf6 --- /dev/null +++ b/_multibuild @@ -0,0 +1,4 @@ + + audit-secondary + + diff --git a/audit-3.0.9.tar.gz b/audit-3.0.9.tar.gz deleted file mode 100644 index 3595002..0000000 --- a/audit-3.0.9.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:fd9570444df1573a274ca8ba23590082298a083cfc0618138957f590e845bc78 -size 1210655 diff --git a/audit-3.1.1.tar.gz b/audit-3.1.1.tar.gz new file mode 100644 index 0000000..16cf0d9 --- /dev/null +++ b/audit-3.1.1.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:46e46b37623cce09e6ee134e78d668afc34f4e1c870c853ef12e4193078cfe87 +size 1218111 diff --git a/audit-ausearch-do-not-require-tclass.patch b/audit-ausearch-do-not-require-tclass.patch index 91c8fe7..532a6c2 100644 --- a/audit-ausearch-do-not-require-tclass.patch +++ b/audit-ausearch-do-not-require-tclass.patch @@ -9,11 +9,11 @@ Signed-off-by: Tony Jones src/ausearch-parse.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -Index: audit-3.0.9/src/ausearch-parse.c +Index: audit-3.1.1/src/ausearch-parse.c =================================================================== ---- audit-3.0.9.orig/src/ausearch-parse.c -+++ audit-3.0.9/src/ausearch-parse.c -@@ -2062,17 +2062,15 @@ other_avc: +--- audit-3.1.1.orig/src/ausearch-parse.c ++++ audit-3.1.1/src/ausearch-parse.c +@@ -2075,17 +2075,15 @@ other_avc: // Now get the class...its at the end, so we do things different str = strstr(term, "tclass="); diff --git a/audit-secondary.changes b/audit-secondary.changes index f1c1137..e1fb40f 100644 --- a/audit-secondary.changes +++ b/audit-secondary.changes @@ -1,3 +1,39 @@ +------------------------------------------------------------------- +Mon Aug 5 08:50:50 UTC 2024 - Thorsten Kukuk + +- Remove rcaudit symlink [jsc#PED-266] + +------------------------------------------------------------------- +Mon Jul 3 08:34:22 UTC 2023 - Paolo Stivanin + +- Update to 3.1.1: + * Add user friendly keywords for signals to auditctl + * In ausearch, parse up URINGOP and DM_CTRL records + * Harden auparse to better handle corrupt logs + * Fix a CFLAGS propogation problem in the common directory + * Move the audispd af_unix plugin to a standalone program + +------------------------------------------------------------------- +Thu May 4 12:58:06 UTC 2023 - Frederic Crozat + +- Add _multibuild to define additional spec files as additional + flavors. + Eliminates the need for source package links in OBS. + +------------------------------------------------------------------- +Mon Feb 20 14:13:06 UTC 2023 - Paolo Stivanin + +- Update to 3.1: + * Disable ProtectControlGroups in auditd.service by default + * Fix rule checking for exclude filter + * Make audit_rule_syscallbyname_data work correctly outside of auditctl + * Add new record types + * Add io_uring support + * Add support for new FANOTIFY record fields + * Add keyword, this-hour, to ausearch/report start/end options + * Add Requires.private to audit.pc file + * Try to interpret OPENAT2 fields correctly + ------------------------------------------------------------------- Tue Dec 27 10:21:56 UTC 2022 - Ludwig Nussel diff --git a/audit-secondary.spec b/audit-secondary.spec index 1315a16..6140594 100644 --- a/audit-secondary.spec +++ b/audit-secondary.spec @@ -1,7 +1,7 @@ # # spec file for package audit-secondary # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -22,7 +22,7 @@ # The seperation is required to minimize unnecessary build cycles. %define _name audit Name: audit-secondary -Version: 3.0.9 +Version: 3.1.1 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -206,8 +206,10 @@ for prog in auditctl auditd ausearch autrace aureport augenrules; do done %endif #END-USR-MERGE +%if 0%{?suse_version} < 1550 # rcauditd symlink ln -s service %{buildroot}%{_sbindir}/rcauditd +%endif chmod 0644 %{buildroot}%{_unitdir}/auditd.service chmod 0644 %{buildroot}%{_unitdir}/augenrules.service @@ -258,6 +260,7 @@ fi %attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz %attr(644,root,root) %{_mandir}/man8/auvirt.8.gz %attr(644,root,root) %{_mandir}/man8/augenrules.8.gz +%attr(644,root,root) %{_mandir}/man8/audisp-af_unix.8.gz %if 0%{?suse_version} < 1550 /sbin/auditctl /sbin/auditd @@ -276,6 +279,7 @@ fi %attr(755,root,root) %{_bindir}/aulastlog %attr(755,root,root) %{_bindir}/ausyscall %attr(755,root,root) %{_sbindir}/aureport +%attr(755,root,root) %{_sbindir}/audisp-af_unix %attr(755,root,root) %{_bindir}/auvirt %dir %attr(750,root,root) %{_sysconfdir}/audit %attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d @@ -292,7 +296,9 @@ fi %dir %attr(700,root,root) %{_localstatedir}/spool/audit %{_unitdir}/auditd.service %{_unitdir}/augenrules.service +%if 0%{?suse_version} < 1550 %{_sbindir}/rcauditd +%endif %{_datadir}/audit/ %files -n system-group-audit diff --git a/audit.changes b/audit.changes index 22981df..c05a79e 100644 --- a/audit.changes +++ b/audit.changes @@ -1,3 +1,39 @@ +------------------------------------------------------------------- +Mon Jul 3 08:33:52 UTC 2023 - Paolo Stivanin + +- Update to 3.1.1: + * Add user friendly keywords for signals to auditctl + * In ausearch, parse up URINGOP and DM_CTRL records + * Harden auparse to better handle corrupt logs + * Fix a CFLAGS propogation problem in the common directory + * Move the audispd af_unix plugin to a standalone program + +------------------------------------------------------------------- +Thu May 4 12:58:06 UTC 2023 - Frederic Crozat + +- Add _multibuild to define additional spec files as additional + flavors. + Eliminates the need for source package links in OBS. + +------------------------------------------------------------------- +Mon Mar 20 14:53:26 UTC 2023 - Giuliano Belinassi + +- Enable livepatching on main library on x86_64. + +------------------------------------------------------------------- +Mon Feb 20 14:12:55 UTC 2023 - Paolo Stivanin + +- Update to 3.1: + * Disable ProtectControlGroups in auditd.service by default + * Fix rule checking for exclude filter + * Make audit_rule_syscallbyname_data work correctly outside of auditctl + * Add new record types + * Add io_uring support + * Add support for new FANOTIFY record fields + * Add keyword, this-hour, to ausearch/report start/end options + * Add Requires.private to audit.pc file + * Try to interpret OPENAT2 fields correctly + ------------------------------------------------------------------- Thu Dec 15 19:17:35 UTC 2022 - Enzo Matsumiya diff --git a/audit.spec b/audit.spec index ac8a617..b8069e2 100644 --- a/audit.spec +++ b/audit.spec @@ -1,7 +1,7 @@ # # spec file for package audit # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,8 +16,14 @@ # +%ifarch x86_64 +%bcond_without livepatching +%else +%bcond_with livepatching +%endif + Name: audit -Version: 3.0.9 +Version: 3.1.1 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -79,6 +85,9 @@ libraries. %build autoreconf -fi export CFLAGS="%{optflags} -fno-strict-aliasing" +%if %{with livepatching} +export CFLAGS="$CFLAGS -fpatchable-function-entry=16,14 -fdump-ipa-clones" +%endif export CXXFLAGS="$CFLAGS" export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch @@ -102,6 +111,33 @@ export LDFLAGS="-Wl,-z,relro,-z,now" %make_build -C auparse %make_build -C docs +%if %{with livepatching} +# Workaround bsc#1208721: remove _patchable_function_entry from static libs. +find . -name "*.a" -exec \ + objcopy --remove-section "__patchable_function_entries" {} \; + +%define tar_basename audit-livepatch-%{version}-%{release} +%define tar_package_name %{tar_basename}.%{_arch}.tar.xz +%define clones_dest_dir %{tar_basename}/%{_arch} + +# Ipa-clones are files generated by gcc which logs changes made across +# functions, and we need to know such changes to build livepatches +# correctly. These files are intended to be used by the livepatch +# developers and may be retrieved by using `osc getbinaries`. +# +# Create ipa-clones destination folder and move clones there. +mkdir -p ipa-clones/%{clones_dest_dir} +find . -name "*.ipa-clones" ! -empty \ + -exec cp -t ipa-clones/%{clones_dest_dir} --parents {} + + +# Create tarball with ipa-clones. +tar -cJf %{tar_package_name} -C ipa-clones \ + --owner root --group root --sort name %{tar_basename} + +# Copy tarball to the OTHER folder to store it as artifact. +cp %{tar_package_name} %{_topdir}/OTHER +%endif + %install %make_install -C common %make_install -C lib diff --git a/create-augenrules-service.patch b/create-augenrules-service.patch index 72c8745..3064bc1 100644 --- a/create-augenrules-service.patch +++ b/create-augenrules-service.patch @@ -1,7 +1,7 @@ -Index: audit-3.0.9/init.d/augenrules.service +Index: audit-3.1.1/init.d/augenrules.service =================================================================== --- /dev/null -+++ audit-3.0.9/init.d/augenrules.service ++++ audit-3.1.1/init.d/augenrules.service @@ -0,0 +1,29 @@ +[Unit] +Description=auditd rules generation @@ -32,10 +32,10 @@ Index: audit-3.0.9/init.d/augenrules.service +ProtectKernelTunables=true +ProtectKernelLogs=true +ReadWritePaths=/etc/audit -Index: audit-3.0.9/init.d/auditd.service +Index: audit-3.1.1/init.d/auditd.service =================================================================== ---- audit-3.0.9.orig/init.d/auditd.service -+++ audit-3.0.9/init.d/auditd.service +--- audit-3.1.1.orig/init.d/auditd.service ++++ audit-3.1.1/init.d/auditd.service @@ -15,15 +15,16 @@ ConditionKernelCommandLine=!audit=0 ConditionKernelCommandLine=!audit=off @@ -57,7 +57,7 @@ Index: audit-3.0.9/init.d/auditd.service #ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules # By default we clear the rules on exit. To disable this, comment # the next line after copying the file to /etc/systemd/system/auditd.service -@@ -46,7 +47,6 @@ ProtectClock=true +@@ -47,7 +48,6 @@ ProtectClock=true ProtectKernelTunables=true ProtectKernelLogs=true # end of automatic additions @@ -65,10 +65,10 @@ Index: audit-3.0.9/init.d/auditd.service [Install] WantedBy=multi-user.target -Index: audit-3.0.9/init.d/Makefile.am +Index: audit-3.1.1/init.d/Makefile.am =================================================================== ---- audit-3.0.9.orig/init.d/Makefile.am -+++ audit-3.0.9/init.d/Makefile.am +--- audit-3.1.1.orig/init.d/Makefile.am ++++ audit-3.1.1/init.d/Makefile.am @@ -26,7 +26,8 @@ EXTRA_DIST = auditd.init auditd.service auditd.cron libaudit.conf auditd.condrestart \ auditd.reload auditd.restart auditd.resume \ diff --git a/fix-hardened-service.patch b/fix-hardened-service.patch index 0fe1648..c7325be 100644 --- a/fix-hardened-service.patch +++ b/fix-hardened-service.patch @@ -12,11 +12,11 @@ Also remove PrivateDevices=true so /dev/* are exposed to auditd. Signed-off-by: Enzo Matsumiya -Index: audit-3.0.9/init.d/auditd.service +Index: audit-3.1.1/init.d/auditd.service =================================================================== ---- audit-3.0.9.orig/init.d/auditd.service -+++ audit-3.0.9/init.d/auditd.service -@@ -41,12 +41,12 @@ RestrictRealtime=true +--- audit-3.1.1.orig/init.d/auditd.service ++++ audit-3.1.1/init.d/auditd.service +@@ -42,12 +42,12 @@ RestrictRealtime=true # added automatically, for details please see # https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ProtectSystem=full diff --git a/harden_auditd.service.patch b/harden_auditd.service.patch index 3e3ad0f..4eff294 100644 --- a/harden_auditd.service.patch +++ b/harden_auditd.service.patch @@ -1,9 +1,9 @@ -Index: audit-3.0.9/init.d/auditd.service +Index: audit-3.1.1/init.d/auditd.service =================================================================== ---- audit-3.0.9.orig/init.d/auditd.service -+++ audit-3.0.9/init.d/auditd.service -@@ -38,6 +38,15 @@ LockPersonality=true - ProtectControlGroups=true +--- audit-3.1.1.orig/init.d/auditd.service ++++ audit-3.1.1/init.d/auditd.service +@@ -39,6 +39,15 @@ LockPersonality=true + #ProtectControlGroups=true ProtectKernelModules=true RestrictRealtime=true +# added automatically, for details please see