239d018a6e- Update audit.spec (bsc#1231236): * add requirement for 'awk' package * move some %post logic from audit to audit-rules
devel
Enzo Matsumiya2024-10-11 13:04:43 +00:00
757054e43fAccepting request 1205295 from security
Ana Guerrero
2024-10-03 15:59:59 +00:00
1878dbbb84- Readd audit-allow-manual-stop.patch (removed by mistake) - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patchEnzo Matsumiya2024-10-02 17:07:53 +00:00
66d350687bAccepting request 1204507 from security
Ana Guerrero
2024-09-30 13:34:55 +00:00
90ef868a13- Update audit-secondary.spec: * Add "Requires: audit-rules" for audit package * Remove preun/postun handling of audit-rules.service - Update to 4.0 - Drop python2 support - Drop auvirt and autrace programs - Drop SysVinit support - Require the use of the 5.0 or later kernel headers - New README.md file - Rewrite legacy service functions in terms of systemctl - Consolidate and update end of event detection to a common function - Split off rule loading from auditd.service into audit-rules.service - Refactor libaudit.h to split out logging functions and record numbers - Speed up aureport --summary reports - Limit libaudit python bindings to logging functions - Add a metrics function for auparse - Change auditctl to use pidfd_send_signal for signaling auditd - Adjust watches to optimize syscalls hooked when watch file access - Drop nispom rules - Add intepretations for fsconfig, fsopen, fsmount, & move_mount - Many code fixups (cgzones) - Update syscall and interpretation tables to the 6.8 kernel (from v3.1.2) - When processing a run level change, make auditd exit - In auditd, fix return code when rules added in immutable mode - In auparse, when files are given, also consider EUID for access - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya) - Disable Python bindings from setting rules due to swig bug (S. Trofimovich) - Update all lookup tables for the 6.5 kernel - Don't be as paranoid about auditctl -R file permissions - In ausearch, correct subject/object search to be an and if both are given - Adjust formats for 64 bit time_t - Fix segfault in python bindings around the feed API - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings - Update spec: * Move rules-related files into new subpackage audit-rules': * Files moved: - /sbin/auditctl, /sbin/augenrules, /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules} - manpages for auditctl, augenrules, and audit.rules - /etc/audit is now owned by audit-rules' as well * Add new file /usr/lib/systemd/system/audit-rules.service * Remove in-house create-augenrules-service.patch that generated augenrules.service systemd unit service * Remove ownership of /usr/share/audit * Create /usr/share/audit-rules directory on %install * Remove audit-userspace-517-compat.patch (fixed upstream) * Remove libev-werror.patch (fixed upstream) * Remove audit-allow-manual-stop.patch (fixed upstream) * Add fix-auparse-test.patch (downstream): Upstream tests uses a static value (42) for 'gdm' uid/gid (based on Fedora values, apparently). Replace these occurrences with 'unknown(123456)' * Replace '--with-python' with '--with-python3' on %configure * Remove autrace and auvirt references (upstream) * Replace README with README.md - Drop `--enable-systemd' from %configure as SysV-style scripts aren't supported in upstream since 113ae191758c ("Drop support for SysVinit")Marcus Meissner2024-09-29 09:40:50 +00:00
3f0a4c9486reinstate %dir /etc/audit in the audit package
Wolfgang Frisch
2024-09-17 14:40:04 +00:00
42402f11b7- Update to 4.0 * Includes fixes since v3.1.1 * Enhance support for newer (5.0+) kernels - Update spec: * Move rules-related files into new subpackage audit-rules': * Files moved: - /sbin/auditctl, /sbin/augenrules, /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules} - manpages for auditctl, augenrules, and audit.rules - /etc/audit is now owned by audit-rules' as well * Add new file /usr/lib/systemd/system/audit-rules.service * Remove in-house create-augenrules-service.patch that generated augenrules.service systemd unit service * Remove ownership of /usr/share/audit * Create /usr/share/audit-rules directory on %install * Remove audit-userspace-517-compat.patch (fixed upstream) * Remove libev-werror.patch (fixed upstream) * Remove audit-allow-manual-stop.patch (fixed upstream) * Add fix-auparse-test.patch (downstream): Upstream tests uses a static value (42) for 'gdm' uid/gid (based on Fedora values, apparently). Replace these occurrences with 'unknown(123456)' * Replace '--with-python' with '--with-python3' on %configure * Remove autrace and auvirt references (upstream) * Replace README with README.md - Drop `--enable-systemd' from %configure as SysV-style scripts aren't supported in upstream since 113ae191758c ("Drop support for SysVinit") - Update to 4.0 * Includes fixes since v3.1.1 * Enhance support for newer (5.0+) kernels - Update spec: * Add fix-auparse-test.patch (downstream): Upstream tests uses a static value (42) for 'gdm' uid/gid (based on Fedora values, apparently). Replace these occurrences with 'unknown(123456)' * Replace '--with-python' with '--with-python3' on %configure * Add new headers 'audit_logging.h' and 'audit-records.h' for audit-devel
Wolfgang Frisch
2024-09-17 08:11:59 +00:00
ac660bee23Accepting request 1195098 from security
Ana Guerrero
2024-08-22 16:10:26 +00:00
0efabbed8dAccepting request 851328 from security
Dominique Leuenberger
2020-12-03 17:38:06 +00:00
07903acdf1Accepting request 849560 from home:lnussel:usrmoveEnzo Matsumiya2020-11-27 13:40:00 +00:00
f0e0e85897Accepting request 810662 from security
Dominique Leuenberger
2020-06-11 12:38:39 +00:00
005741884e- Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295)Enzo Matsumiya2020-06-01 17:13:53 +00:00
9f1fdb1bedAccepting request 765091 from security
Dominique Leuenberger
2020-01-23 15:07:45 +00:00
74524fcb73- Update to version 2.6.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support
Tony Jones
2020-01-16 20:02:22 +00:00
4971d594a2osc copypac from project:security package:audit revision:105
Tony Jones
2019-10-18 17:26:13 +00:00
a026abd994Accepting request 739736 from home:RBrownSUSE:branches:security
Tony Jones
2019-10-17 14:14:02 +00:00
ea50e39101Accepting request 708766 from security
Dominique Leuenberger
2019-06-26 13:59:07 +00:00
c90af7d388Accepting request 687275 from home:jengelh:sct
Lars Vogdt
2019-06-08 16:58:52 +00:00
59a15871f8Accepting request 619464 from security
Dominique Leuenberger
2018-07-07 19:51:47 +00:00
f7b3eda238Accepting request 618655 from home:1Antoine1:branches:security
Tony Jones
2018-06-28 01:17:18 +00:00
6975dcd5ffAccepting request 593188 from home:kukuk:branches:securityMarcus Rueckert2018-04-11 13:58:54 +00:00
e5a6970bfdAccepting request 588035 from security
Dominique Leuenberger
2018-03-26 09:51:53 +00:00
e57cf5edebAccepting request 588034 from home:jones_tony:branches:security
Tony Jones
2018-03-16 23:10:56 +00:00
7176e3c394Accepting request 580988 from openSUSE:Factory:Staging:O
Tony Jones
2018-03-01 21:24:42 +00:00
7a17f4104fAccepting request 329223 from home:jones_tony:branches:security
Tony Jones
2015-09-04 22:09:27 +00:00
35ac1a5f73Accepting request 283377 from security
Tony Jones
2015-01-29 20:31:09 +00:00
42d7928102Accepting request 283367 from home:fdmanana:branches:security
Tony Jones
2015-01-29 19:21:15 +00:00
3fa133e1f9Accepting request 263884 from security
Dominique Leuenberger
2014-12-03 21:47:20 +00:00
74ea258675- Update to version 2.4.1 Changelog 2.4.1 - Make python3 support easier - Add support for ppc64le (Tony Jones) - Add some translations for a1 of ioctl system calls - Add command & virtualization reports to aureport - Update aureport config report for new events - Add account modification summary report to aureport - Add GRP_MGMT and GRP_CHAUTHTOK event types - Correct aureport account change reports - Add integrity event report to aureport - Add config change summary report to aureport - Adjust some syslogging level settings in audispd - Improve parsing performance in everything - When ausearch outputs a line, use the previously parsed values (Burn Alting) - Improve searching and interpreting groups in events - Fully interpret the proctitle field in auparse - Correct libaudit and auditctl support for kernel features - Add support for backlog_time_wait setting via auditctl - Update syscall tables for the 3.18 kernel - Ignore DNS failure for email validation in auditd (#1138674) - Allow rotate as action for space_left and disk_full in auditd.conf - Correct login summary report of aureport - Auditctl syscalls can be comma separated list now - Update rules for new subsystems and capabilities - Drop patch audit-add-ppc64le-mach-support.patch (already upstream)
Jan Matejka
2014-11-26 16:13:05 +00:00
f51020c36eAccepting request 247316 from security
Stephan Kulow
2014-09-07 09:11:37 +00:00
a550638087Accepting request 247315 from home:jones_tony:branches:security
Tony Jones
2014-09-02 23:07:21 +00:00
3f8c9faf02Accepting request 245613 from security
Stephan Kulow
2014-08-25 10:59:44 +00:00
42c1e24684Accepting request 244848 from home:elvigia:branches:securityMarcus Meissner2014-08-21 13:31:20 +00:00
30cb942b15Accepting request 240712 from security
Stephan Kulow
2014-07-22 04:57:45 +00:00
0251e93f2bAccepting request 240711 from home:jones_tony:branches:security
Tony Jones
2014-07-11 21:01:21 +00:00
Dominique Leuenberger
Enzo Matsumiya
Ana Guerrero
Marcus Meissner
Wolfgang Frisch
Robert Frohl
Tony Jones
Lars Vogdt
Marcus Rueckert
Yuchen Lin
Stephan Kulow
Jan Matejka