394 lines
11 KiB
RPMSpec
394 lines
11 KiB
RPMSpec
#
|
|
# spec file for package velociraptor
|
|
#
|
|
# Copyright (c) 2024 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
%define flavor @BUILD_FLAVOR@%{nil}
|
|
|
|
%if "%{flavor}" == "client"
|
|
%define build_client 1
|
|
%define build_server 0
|
|
%define name_suffix -client
|
|
%define make_target linux_bare
|
|
%define config_perms 0600, root, root
|
|
%define state_dir_perms 0700, root, root
|
|
%else
|
|
%define build_server 1
|
|
%define build_client 0
|
|
%define name_suffix %{nil}
|
|
%define make_target linux
|
|
%define config_perms 0640, root, velociraptor
|
|
%define state_dir_perms 0700, velociraptor, velociraptor
|
|
%endif
|
|
|
|
%define projname velociraptor
|
|
%define vmlinux_h_version 5.14.21150400.22-150400-default
|
|
|
|
# SLE 15 SP3 / Leap 15.3 or newer gets eBPF
|
|
# Earlier versions don't have a usable eBPF and the
|
|
# release doesn't easily build llvm13
|
|
%if 0%{?suse_version} > 1500 || 0%{?sle_version} > 150200
|
|
%bcond_without bpf
|
|
%endif
|
|
%if "%{_vendor}" == "debbuild"
|
|
%bcond_without bpf
|
|
%endif
|
|
%if 0%{?rhel}
|
|
# RHEL can do BPF but we need llvm for it
|
|
%bcond_without bpf
|
|
%endif
|
|
|
|
%if "%{_vendor}" == "debbuild"
|
|
%define _unitdir /usr/lib/systemd/system
|
|
%endif
|
|
|
|
# Older SLE releases and debbuild don't support uppercase VERSION macro
|
|
%if "%{_vendor}" == "debbuild" || 0%{?sle_version} < 150000
|
|
%define VERSION %{version}
|
|
%endif
|
|
|
|
#Compat macro for new _fillupdir macro introduced in Nov 2017
|
|
%if ! %{defined _fillupdir}
|
|
%define _fillupdir %{_localstatedir}/adm/fillup-templates
|
|
%endif
|
|
|
|
# SLE12 has _sharedstatedir in an odd place
|
|
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
|
|
%define _sharedstatedir /var/lib
|
|
%endif
|
|
|
|
Name: velociraptor%{name_suffix}
|
|
Version: 0.7.0.4.git74.3426c0a
|
|
Release: 0
|
|
%if %{build_server}
|
|
Summary: Endpoint visibility and collection tool
|
|
%else
|
|
Summary: Endpoint visibility and collection tool (endpoint only)
|
|
%endif
|
|
Group: System/Monitoring
|
|
License: AGPL-3.0-only
|
|
URL: https://github.com/Velocidex/velociraptor
|
|
Source: %{projname}-%{version}.tar.gz
|
|
Source1: velociraptor-go_modules.tar.gz
|
|
Source2: vmlinux.h-%{vmlinux_h_version}.tar.xz
|
|
Source3: velociraptor.service
|
|
Source4: velociraptor-server.config.placeholder
|
|
Source5: velociraptor-client.service
|
|
Source6: velociraptor-client.config.placeholder
|
|
Source7: sysconfig.velociraptor
|
|
Source8: sysconfig.velociraptor-client
|
|
Source9: %{projname}.obsinfo
|
|
Source10: system-user-velociraptor.sysusers
|
|
Source11: velociraptor-nodejs.spec.inc
|
|
|
|
%include %{_sourcedir}/velociraptor-nodejs.spec.inc
|
|
|
|
Patch1: vendor-build-fixes-for-SLE12.patch
|
|
Patch2: sdjournal-build-fix-for-SLE12.patch
|
|
Patch3: velociraptor-reproducible-timestamp.diff
|
|
# CVE-2024-28849 - bsc#1221456 - follow-redirects: Drop Proxy-Athorization across hosts
|
|
Patch4: CVE-2024-28849-follow-redirects-drop-proxy-authorization.patch
|
|
BuildRequires: fileb0x
|
|
%if 0%{?suse_version}
|
|
BuildRequires: systemd-rpm-macros
|
|
BuildRequires: golang(API) >= 1.19
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
%endif
|
|
%if "%{_vendor}" == "debbuild"
|
|
BuildRequires: golang >= 2:1.19~0
|
|
BuildRequires: libsystemd-dev
|
|
BuildRequires: pkg-config
|
|
%endif
|
|
%if 0%{?rhel}
|
|
BuildRequires: golang >= 1.19
|
|
BuildRequires: python3
|
|
BuildRequires: systemd-devel
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
%endif
|
|
%if %{build_server}
|
|
BuildRequires: local-npm-registry
|
|
BuildRequires: nodejs >= 18
|
|
BuildRequires: npm >= 18
|
|
%endif
|
|
%if %{with bpf}
|
|
%if 0%{?suse_version}
|
|
%if 0%{?suse_version} > 1500 || 0%{?sle_version} >= 150300
|
|
BuildRequires: clang16
|
|
BuildRequires: llvm16
|
|
%if 0%{?sle_version} > 150400
|
|
BuildRequires: llvm16-libclang13
|
|
%endif
|
|
%else
|
|
BuildRequires: clang13
|
|
BuildRequires: llvm13
|
|
%endif
|
|
BuildRequires: libelf-devel
|
|
BuildRequires: libzstd-devel
|
|
BuildRequires: zlib-devel
|
|
%endif
|
|
%if "%{_vendor}" == "debbuild"
|
|
BuildRequires: clang
|
|
BuildRequires: libelf-dev
|
|
BuildRequires: libzstd-dev
|
|
BuildRequires: llvm
|
|
BuildRequires: zlib1g-dev
|
|
%endif
|
|
%if 0%{?rhel}
|
|
BuildRequires: clang >= 13
|
|
BuildRequires: libelf-devel
|
|
BuildRequires: libzstd-devel
|
|
BuildRequires: llvm >= 13
|
|
BuildRequires: zlib-devel
|
|
%endif
|
|
%endif
|
|
%if %{build_server}
|
|
BuildRequires: sysuser-tools
|
|
Requires: group(velociraptor)
|
|
Requires: user(velociraptor)
|
|
Obsoletes: velociraptor-kafka-humio-gateway < %{version}
|
|
%{?sysusers_requires}
|
|
%endif
|
|
|
|
%if 0%{?suse_version}
|
|
# SLE12 doesn't support sysusers
|
|
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
|
|
Requires(pre): pwdutils
|
|
%define pre_create_group 1
|
|
%else
|
|
Requires: group(velociraptor)
|
|
%endif
|
|
%endif
|
|
|
|
%if %{build_server}
|
|
%if 0%{?suse_version} > 1500 || 0%{?sle_version} >= 150400
|
|
ExclusiveArch: x86_64
|
|
%else
|
|
ExclusiveArch: do_not_build
|
|
%endif
|
|
%else
|
|
ExclusiveArch: x86_64 ppc64le aarch64 s390x
|
|
%endif
|
|
|
|
%if 0%{?rhel}
|
|
# RHEL builds aren't working yet
|
|
ExclusiveArch: do_not_build
|
|
%endif
|
|
|
|
# Not *required* but without it, we spam the system log
|
|
Recommends: auditd
|
|
|
|
%if 0%{?_project:1} && (0%{?suse_version} > 1500 || 0%{?sle_version} > 150000)
|
|
Provides: %{name}(project:%_project)
|
|
%endif
|
|
|
|
%if "%{vendor}" == "debbuild"
|
|
%define mtag Packager: https://www.suse.com
|
|
%mtag
|
|
%endif
|
|
|
|
%if %{build_server}
|
|
%description
|
|
Velociraptor is a tool for collecting host based state information
|
|
using The Velociraptor Query Language (VQL) queries.
|
|
|
|
To learn more about Velociraptor, read the documentation on:
|
|
|
|
https://docs.velociraptor.app/
|
|
|
|
This package contains the velociraptor server and full console GUI.
|
|
For just the endpoint agent, please install the 'velociraptor-client' package.
|
|
|
|
%package -n system-user-velociraptor
|
|
Summary: System user and group 'velociraptor'
|
|
Version: 1.0.0
|
|
License: Apache-2.0
|
|
Group: System/Monitoring
|
|
Provides: group(velociraptor)
|
|
Provides: user(velociraptor)
|
|
|
|
%description -n system-user-velociraptor
|
|
This package provides a shared system user for all velociraptor components
|
|
|
|
%endif
|
|
|
|
%if %{build_client}
|
|
%description
|
|
Velociraptor is a tool for collecting host based state information
|
|
using The Velociraptor Query Language (VQL) queries.
|
|
|
|
To learn more about Velociraptor, read the documentation on:
|
|
|
|
https://docs.velociraptor.app/
|
|
|
|
This package contains only the endpoint agent. For the full server and GUI
|
|
console, please install the 'velociraptor' package.
|
|
%endif
|
|
|
|
%prep
|
|
%setup -q -a 1 -a 2 -n %{projname}-%{VERSION}
|
|
%patch -P 1 -p1
|
|
%patch -P 2 -p1
|
|
%patch -P 3 -p1
|
|
|
|
# Set the version to something more specific than <next-tag>-dev
|
|
sed -ie "s/\([[:space:]]VERSION *= \).*/\1 \"%{VERSION}\"/" constants/constants.go
|
|
|
|
%if %{with bpf}
|
|
mkdir -p third_party/libbpfgo/output
|
|
|
|
arch=%{_arch}
|
|
if test "$arch" = "amd64"; then
|
|
arch=x86_64
|
|
fi
|
|
|
|
cp vmlinux.h-%{vmlinux_h_version}/vmlinux-${arch}.h \
|
|
third_party/libbpfgo/output/vmlinux.h
|
|
%endif
|
|
|
|
# These just clutter the GUI and we don't have Windows clients
|
|
# Note: There are dependencies on these that need to be resolved before
|
|
# removing them outright.
|
|
# rm -rf artifacts/definitions/Windows
|
|
|
|
%if %{build_server}
|
|
pushd gui/velociraptor
|
|
rm -f package-lock.json
|
|
local-npm-registry %{_sourcedir} install
|
|
popd
|
|
%patch -P 4 -p1
|
|
%endif
|
|
|
|
%build
|
|
|
|
# Reproducible builds need stable timestamps
|
|
timestamp=$(date -Iseconds --utc --date=@$(grep mtime: %{SOURCE9}|sed -e 's/mtime: //'))
|
|
git_commit=$(grep commit: %{SOURCE9}|sed -e 's/commit: //g')
|
|
|
|
export VELOCIRAPTOR_BUILD_TIME=$timestamp
|
|
export VELOCIRAPTOR_GIT_HEAD=$git_commit
|
|
|
|
%if %{build_server}
|
|
(cd gui/velociraptor ; npm run build)
|
|
%sysusers_generate_pre %{SOURCE10} velociraptor-user
|
|
%endif
|
|
|
|
%if 0%{?suse_version}
|
|
LLVM_STRIP=llvm-strip
|
|
%else
|
|
LLVM_STRIP=llvm-strip
|
|
%endif
|
|
|
|
CLANG=clang
|
|
|
|
PATH=$PATH:/usr/sbin make %{make_target} BUILD_BPF_PLUGINS=%{with bpf} CLANG=$CLANG STRIP=$LLVM_STRIP
|
|
|
|
%install
|
|
install -D -d -m 0750 %buildroot/%{_sysconfdir}/velociraptor
|
|
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/data
|
|
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/logs
|
|
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/tmp
|
|
|
|
%if %{build_server}
|
|
service_file_source=%{SOURCE3}
|
|
config_file_source=%{SOURCE4}
|
|
sysconfig_file_source=%{SOURCE7}
|
|
config_file=server.config
|
|
|
|
install -D -m 0644 %{SOURCE10} %{buildroot}%{_sysusersdir}/system-user-velociraptor.conf
|
|
%else
|
|
service_file_source=%{SOURCE5}
|
|
config_file_source=%{SOURCE6}
|
|
sysconfig_file_source=%{SOURCE8}
|
|
config_file=client.config
|
|
%endif
|
|
|
|
%if 0%{?suse_version}
|
|
install -D -m 0644 "$sysconfig_file_source" %{buildroot}%{_fillupdir}/sysconfig.%{name}
|
|
%endif
|
|
%if "%{vendor}" == "debbuild"
|
|
install -D -m 0644 "$sysconfig_file_source" %{buildroot}/%{_sysconfdir}/default/%{name}
|
|
%endif
|
|
|
|
install -D -m 0644 "$service_file_source" %{buildroot}%{_unitdir}/%{name}.service
|
|
install -D -m 0640 "$config_file_source" "%{buildroot}%{_sysconfdir}/velociraptor/$config_file"
|
|
install -D -m 0755 output/velociraptor-v%{VERSION}-linux-* %buildroot/%{_bindir}/%{name}
|
|
|
|
%files
|
|
%defattr(-, root, root)
|
|
%license LICENSE
|
|
%doc README.md
|
|
%{_bindir}/%{name}
|
|
%{_unitdir}/%{name}.service
|
|
%if 0%{?suse_version}
|
|
%{_fillupdir}/sysconfig.%{name}
|
|
%endif
|
|
%if "%{vendor}" == "debbuild"
|
|
%{_sysconfdir}/default/%{name}
|
|
%endif
|
|
|
|
%dir %attr(-, root, velociraptor) %{_sysconfdir}/velociraptor
|
|
|
|
%config(noreplace) %attr(%{config_perms}) %{_sysconfdir}/velociraptor/*.config
|
|
%dir %attr(%{state_dir_perms}) %{_sharedstatedir}/%{name}
|
|
%dir %attr(%{state_dir_perms}) %{_sharedstatedir}/%{name}/data
|
|
%dir %attr(%{state_dir_perms}) %{_sharedstatedir}/%{name}/logs
|
|
%dir %attr(%{state_dir_perms}) %{_sharedstatedir}/%{name}/tmp
|
|
|
|
%if %{build_server}
|
|
%files -n system-user-velociraptor
|
|
%defattr(-, root, root)
|
|
%{_sysusersdir}/system-user-velociraptor.conf
|
|
|
|
%pre -n system-user-velociraptor -f velociraptor-user.pre
|
|
%endif
|
|
|
|
%if 0%{?suse_version}
|
|
%pre
|
|
%if 0%{?pre_create_group}
|
|
# create velociraptor group if it doesn't exist
|
|
groupadd -f -r velociraptor 2>/dev/null || :
|
|
%endif
|
|
%service_add_pre %{name}.service
|
|
|
|
%post
|
|
%{fillup_only}
|
|
%service_add_post %{name}.service
|
|
|
|
%preun
|
|
%service_del_preun %{name}.service
|
|
|
|
%postun
|
|
%service_del_postun %{name}.service
|
|
%endif
|
|
|
|
%if "%{_vendor}" == "debbuild"
|
|
%postun
|
|
# Automatically added by dh_installsystemd/13.11.4
|
|
if [ "$1" = remove ] && [ -d /run/systemd/system ] ; then
|
|
systemctl --system daemon-reload >/dev/null || true
|
|
fi
|
|
# End automatically added section
|
|
# Automatically added by dh_installsystemd/13.11.4
|
|
if [ "$1" = "purge" ]; then
|
|
if [ -x "/usr/bin/deb-systemd-helper" ]; then
|
|
deb-systemd-helper purge 'velociraptor-client.service' >/dev/null || true
|
|
fi
|
|
fi
|
|
# End automatically added section
|
|
%endif
|
|
|
|
%changelog
|