pool/velociraptor
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
154074cae5
velociraptor/velociraptor.spec

315 lines
10 KiB
RPMSpec
Raw Normal View History

osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
#
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
# spec file
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
#
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
# Copyright (c) 2023 SUSE LLC
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%define flavor @BUILD_FLAVOR@%{nil}
%if "%{flavor}" == "client"
%define build_client 1
%define build_server 0
%define build_kafka_humio_gateway 0
%define name_suffix -client
%define make_target linux_bare
%define config_perms %attr(0600, root, root)
%define state_dir_perms %attr(0700, root, root)
%else
%define build_kafka_humio_gateway 1
%define build_server 1
%define build_client 0
%define name_suffix %{nil}
%define make_target linux
%define config_perms %attr(0640, root, velociraptor)
%define state_dir_perms %attr(0700, velociraptor, velociraptor)
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%define projname velociraptor
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%define vendor_version 0.6.7.5~git77.997aa73
Accepting request 1035679 from home:jeff_mahoney:security:sensor re-add vmlinux handling OBS-URL: https://build.opensuse.org/request/show/1035679 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=24
2022-11-14 16:01:41 +01:00
%define vmlinux_h_version 5.14.21150400.22-150400-default
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
Accepting request 1060071 from home:jeff_mahoney:branches:security:sensor - Increase required release to enable eBPF to SLE 15 SP2 and openSUSE Leap 15.2. Earlier versions don't have a usable eBPF and can't easily build llvm13. - Increase required release to enable eBPF to SLE 15 SP2 and openSUSE Leap 15.2. Earlier versions don't have a usable eBPF and can't easily build llvm13. OBS-URL: https://build.opensuse.org/request/show/1060071 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=36
2023-01-21 03:50:51 +01:00
# SLE 15 SP2 / Leap 15.2 or newer gets eBPF
# Earlier versions don't have a usable eBPF and the
# release doesn't easily build llvm13
Accepting request 1060079 from home:jeff_mahoney:branches:security:sensor - Fixed release detection to include Tumblweed OBS-URL: https://build.opensuse.org/request/show/1060079 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=39
2023-01-21 05:12:03 +01:00
%if 0%{?suse_version} > 1500 || 0%{?sle_version} >= 150200
Accepting request 1059461 from home:jeff_mahoney:branches:security:sensor - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Added Restart=on-failure to restart the client automatically. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x OBS-URL: https://build.opensuse.org/request/show/1059461 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=30
2023-01-19 02:05:43 +01:00
%bcond_without bpf
%else
%bcond_with bpf
%endif
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
#Compat macro for new _fillupdir macro introduced in Nov 2017
%if ! %{defined _fillupdir}
%define _fillupdir %{_localstatedir}/adm/fillup-templates
%endif
# SLE12 has _sharedstatedir in an odd place
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
%define _sharedstatedir /var/lib
%endif
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Name: velociraptor%{name_suffix}
- Update to version 0.6.7.5~git81.01be570: * libbpfgo: pull fix for double-free * logscale: add documentation for plugin OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=51
2023-05-10 02:51:00 +02:00
Version: 0.6.7.5~git81.01be570
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
Release: 0
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_server}
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Summary: Endpoint visibility and collection tool
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%else
Summary: Endpoint visibility and collection tool (endpoint only)
%endif
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Group: System/Monitoring
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
License: AGPL-3.0-only
URL: https://github.com/Velocidex/velociraptor
Source: %{projname}-%{version}.tar.xz
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Source1: vendor-golang-%{vendor_version}.tar.xz
Source2: vendor-golang-kafka-humio-gateway-%{vendor_version}.tar.xz
Source3: vendor-nodejs-%{vendor_version}.tar.xz
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Source4: vmlinux.h-%{vmlinux_h_version}.tar.xz
Source5: velociraptor.service
Source6: velociraptor-server.config.placeholder
Source7: velociraptor-client.service
Source8: velociraptor-client.config.placeholder
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Source9: update-vendoring.sh
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Source10: sysconfig.velociraptor
Source11: sysconfig.velociraptor-client
Accepting request 1060929 from home:jeff_mahoney:branches:security:sensor - Use obsinfo mtime to produce stable build timestamp (bsc#1207369). - Update to version 0.6.7.4~git60.8abed37a: * http_comms: create ring buffer temporary file in the same directory * cronsnoop: plumb in real scope logging * cronsnoop: don't treat routine errors as fatal * cronsnoop: fix typo - Use obsinfo mtime to produce stable build timestamp (bsc#1207369). - Update to version 0.6.7.4~git60.8abed37a: * http_comms: create ring buffer temporary file in the same directory * cronsnoop: plumb in real scope logging * cronsnoop: don't treat routine errors as fatal * cronsnoop: fix typo OBS-URL: https://build.opensuse.org/request/show/1060929 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=41
2023-01-25 14:29:03 +01:00
Source12: %{projname}.obsinfo
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
Source13: system-user-velociraptor.sysusers
Source14: velociraptor-kafka.sysusers
Source15: velociraptor-kafka-humio-gateway.service
Source16: sysconfig.velociraptor-kafka-humio-gateway
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Patch1: velociraptor-golang-mage-vendoring.diff
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Patch2: vendor-build-fixes-for-SLE12.patch
Patch3: sdjournal-build-fix-for-SLE12.patch
Patch4: velociraptor-reproducible-timestamp.diff
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
BuildRequires: fileb0x
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
BuildRequires: golang-packaging
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
BuildRequires: mage
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
BuildRequires: systemd-rpm-macros
Accepting request 1059625 from home:jeff_mahoney:branches:security:sensor --------------------------------------------------------------------- - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. ----------------------------------------------------------------- - Added support for setting command line options via sysconfig - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. - Added support for setting command line options via sysconfig OBS-URL: https://build.opensuse.org/request/show/1059625 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=32
2023-01-19 16:27:12 +01:00
BuildRequires: golang(API) >= 1.18
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
BuildRequires: pkgconfig(libsystemd)
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_server}
Accepting request 1085748 from home:darix:apps - bump minimum nodejs to 18: building against 16 causes errors OBS-URL: https://build.opensuse.org/request/show/1085748 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=50
2023-05-10 01:43:33 +02:00
BuildRequires: nodejs >= 18
BuildRequires: npm >= 18
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%endif
Accepting request 1059461 from home:jeff_mahoney:branches:security:sensor - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Added Restart=on-failure to restart the client automatically. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x OBS-URL: https://build.opensuse.org/request/show/1059461 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=30
2023-01-19 02:05:43 +01:00
%if %{with bpf}
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
# clang15 causes libbpfgo to crash immediately
BuildRequires: clang16
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
BuildRequires: libelf-devel
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
BuildRequires: libzstd-devel
BuildRequires: libzstd-devel
BuildRequires: llvm16
BuildRequires: zlib-devel
Accepting request 1059461 from home:jeff_mahoney:branches:security:sensor - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Added Restart=on-failure to restart the client automatically. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x OBS-URL: https://build.opensuse.org/request/show/1059461 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=30
2023-01-19 02:05:43 +01:00
%endif
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Requires: group(velociraptor)
Requires: user(velociraptor)
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
ExclusiveArch: x86_64 ppc64le aarch64 s390x
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%if %{build_server}
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
BuildRequires: sysuser-tools
%{?sysusers_requires}
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_server}
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%description
Velociraptor is a tool for collecting host based state information
using The Velociraptor Query Language (VQL) queries.
To learn more about Velociraptor, read the documentation on:
https://docs.velociraptor.app/
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
This package contains the velociraptor server and full console GUI.
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
For just the endpoint agent, please install the 'velociraptor-client' package.
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%package -n system-user-velociraptor
Summary: System user and group 'velociraptor'
Version: 1.0.0
License: Apache-2.0
Group: System/Monitoring
Provides: group(velociraptor)
Provides: user(velociraptor)
%description -n system-user-velociraptor
This package provides a shared system user for all velociraptor components
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_kafka_humio_gateway}
- Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) - Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=11
2022-03-15 15:14:34 +01:00
%package kafka-humio-gateway
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
Summary: Gateway between Kafka and Humio for Velociraptor Artifacts
- Update to version 0.6.7.5~git81.01be570: * libbpfgo: pull fix for double-free * logscale: add documentation for plugin OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=51
2023-05-10 02:51:00 +02:00
Version: 0.6.7.5~git81.01be570
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
Requires: group(velociraptor-kafka)
Requires: user(velociraptor-kafka)
- Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) - Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=11
2022-03-15 15:14:34 +01:00
%description kafka-humio-gateway
This tool is used to consume events generated by the Kafka Velociraptor plugin
and post them to a Humio cluster.
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%endif
%if %{build_client}
%description
Velociraptor is a tool for collecting host based state information
using The Velociraptor Query Language (VQL) queries.
To learn more about Velociraptor, read the documentation on:
https://docs.velociraptor.app/
This package contains only the endpoint agent. For the full server and GUI
console, please install the 'velociraptor' package.
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%prep
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%setup -q -a 1 -a 2 -a 3 -a 4 -n %{projname}-%{version}
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%autopatch -p1
# Set the version to something more specific than <next-tag>-dev
sed -ie "s/\(VERSION *= \).*/\1 \"%{version}\"/" constants/constants.go
Accepting request 1059461 from home:jeff_mahoney:branches:security:sensor - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Added Restart=on-failure to restart the client automatically. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x OBS-URL: https://build.opensuse.org/request/show/1059461 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=30
2023-01-19 02:05:43 +01:00
%if %{with bpf}
Accepting request 998240 from home:jeff_mahoney:branches:security:sensor - Update to version 0.6.4.2~git59.5ebb49db: * api/authenticators: fix handling of missing oauthstate cookie for OAUTH2 - Update to version 0.6.4.2~git57.fcb11adf: * kafka-humio-gateway: add sample config file - Updated BuildRequires to use go 1.17 after updating vendoring - Add vmlinux.h from 5.18.9-2-default to provide type information (x86_64 only) - Update to version 0.6.4.2~git56.47b4adb4: * Updating the NewFiles and ProcessStatuses Artifacts * cronsnoop: Add plugin which is able to snoop removal/addition of cron… (#37) * third_party/go-libaudit: don't directly use unix.* * Add Linux.Remediation.Quarantine artifact * Extend audit artifacts to use new interface * audit: rearchitect plugin to scale better with multiple invocations * third_party/go-libaudit: move handling of receive buffer to caller * third_party/go-libaudit: move buffer handling from netlink to audit * third_party/go-libaudit: allow audit fd to be pollable * third_party/go-libaudit: Add support for removing individual rules * third_party/go-libaudit: rule.Rule.Build: Don't assume that no syscalls means all syscalls * third_party/go-libaudit: Report missing rules during deletion * import go-libaudit as a third-party module * quarantine: actually call the OS-specific artifact * artifactset: add ability to select named sources * GUI: Artifact selector (#1790) * host-info: make quarantine UI more robust with non-Windows client hosts * shell-viewer: default to Bash on non-Windows clients OBS-URL: https://build.opensuse.org/request/show/998240 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=18
2022-08-19 20:30:12 +02:00
mkdir -p third_party/libbpfgo/output
Accepting request 1035327 from home:jeff_mahoney:security:sensor - Update to version 0.6.4.2~git86.b5931f7: * cleanup: go mod tidy - Fix vendoring of replaced modules. - Only require libtsan0 on x86_64 - Only attempt to copy vmlinux.h if /sys/kernel/btf/vmlinux doesn't exist - Fix building of libbpfgo on i586 - Update to version 0.6.4.2~git84.1b38fda: * Clean up libbpfgo mess * libbpfgo: use forked repo for fully static builds * libbpfgo: sync to v0.4.4-libbpf-1.0.1 * contrib/kafka-humio-gateway: add new debug option for noisy events * contrib/kafka-humio-gateway: backoff and retry for metadata * vql/server/kafka: connect sarama logging to velociraptor logging * vql/server/kafka: add exponential backoff (limited to 30s) for metadata retries * vql/server/kafka: set appropriate ClientID * libbpfgo: add selftest to build so testcases work * cronsnoop: rework testcases to use t.TempDir * cronsnoop: move external dependencies to end of import list * SSHLogin: require _TRANSPORT != 'kernel' from watch_journal() - Update to version 0.6.4.2~git67.85b608e: * clients/host-info.js: add MAC addresses to client dashboard * linux: Add ability to interrogate system and network configuration * SUSE: Add docker-compose environment * SUSE: add Docker files * Add Linux.Sys.Bash to Server.Monitor.Shell artifact * api/authenticators: fix handling of missing oauthstate cookie for OAUTH2 * kafka-humio-gateway: add sample config file * Updating the NewFiles and ProcessStatuses Artifacts OBS-URL: https://build.opensuse.org/request/show/1035327 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=22
2022-11-12 02:51:37 +01:00
Accepting request 1035679 from home:jeff_mahoney:security:sensor re-add vmlinux handling OBS-URL: https://build.opensuse.org/request/show/1035679 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=24
2022-11-14 16:01:41 +01:00
cp vmlinux.h-%{vmlinux_h_version}/vmlinux-%{_arch}.h \
third_party/libbpfgo/output/vmlinux.h
Accepting request 1059461 from home:jeff_mahoney:branches:security:sensor - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Added Restart=on-failure to restart the client automatically. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x - Clean up for Factory submission: - Make bpf-enabled builds conditional - Removed %defattr and combined service lines. - Change clang and llvm dependencies to use >= 13 - Newer versions of clang hit a DWARF parsing bug in go < 1.19, so increase go version dependecy - Define ExclusiveArch for x86_64, ppc64le, aarch64, and s390x Neither the client or server builds on ix86. - Update to version 0.6.7.4~git51.a588d6e4: * magefile.go: use current architecture for Linux builds * Update libbpfgo submodule to include non-AMD64 build fixes * bpf: bpf expects s390 instead of s390x OBS-URL: https://build.opensuse.org/request/show/1059461 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=30
2023-01-19 02:05:43 +01:00
%endif
Accepting request 998240 from home:jeff_mahoney:branches:security:sensor - Update to version 0.6.4.2~git59.5ebb49db: * api/authenticators: fix handling of missing oauthstate cookie for OAUTH2 - Update to version 0.6.4.2~git57.fcb11adf: * kafka-humio-gateway: add sample config file - Updated BuildRequires to use go 1.17 after updating vendoring - Add vmlinux.h from 5.18.9-2-default to provide type information (x86_64 only) - Update to version 0.6.4.2~git56.47b4adb4: * Updating the NewFiles and ProcessStatuses Artifacts * cronsnoop: Add plugin which is able to snoop removal/addition of cron… (#37) * third_party/go-libaudit: don't directly use unix.* * Add Linux.Remediation.Quarantine artifact * Extend audit artifacts to use new interface * audit: rearchitect plugin to scale better with multiple invocations * third_party/go-libaudit: move handling of receive buffer to caller * third_party/go-libaudit: move buffer handling from netlink to audit * third_party/go-libaudit: allow audit fd to be pollable * third_party/go-libaudit: Add support for removing individual rules * third_party/go-libaudit: rule.Rule.Build: Don't assume that no syscalls means all syscalls * third_party/go-libaudit: Report missing rules during deletion * import go-libaudit as a third-party module * quarantine: actually call the OS-specific artifact * artifactset: add ability to select named sources * GUI: Artifact selector (#1790) * host-info: make quarantine UI more robust with non-Windows client hosts * shell-viewer: default to Bash on non-Windows clients OBS-URL: https://build.opensuse.org/request/show/998240 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=18
2022-08-19 20:30:12 +02:00
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
# These just clutter the GUI and we don't have Windows clients
Accepting request 952144 from home:jeff_mahoney:branches:security:sensor - Temporarily re-enable Windows artifacts. OBS-URL: https://build.opensuse.org/request/show/952144 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=4
2022-02-07 19:30:48 +01:00
# Note: There are dependencies on these that need to be resolved before
# removing them outright.
Accepting request 975255 from home:jeff_mahoney:security:sensor:devel - Fix error handling in tcpsnoop and dnssnoop. * If BTF information is unavailable, there is no indication that the query has failed. - Rebase on 0.6.4: * Updated dependencies * Bugfix: startup bugs (#1680) * bugfix: Server event notebook not correctly created (#1737) * Bugfix: Start a dummy indexing service (#1736) * Add bugfix which would return no rows if the user removed whitelist (#1735) * Fixed bug in read_reg_key (#1734) * BUGFIX: Do not include config flag when darwin installer is repacked (#1733) * Refactored index into its own service. (#1730) * Bugfix: Write one index item per JSONL record. (#1727) * Bugfix: Estimating client impact should consider last active status (#1726) * Add complete ntfs metadata option to MFT output (#1725) * Various bugfixes. (#1724) * Update Usn.yaml (#1723) * Fixed a bug in hunt download preparation. (#1722) * Add Windows.Forensics.Usn filter and presentation updates (#1720) * Optimize writing event monitoring records (#1721) * Add Generic.Detection.Yara.Zip (#1718) * Fixed crash on master-pong response. (#1719) * Remove _type option from elastic. (#1715) * Opportunistically update directly connected client's ping times (#1713) * Fixed a bug in hunt download preparation. (#1722) * Add Windows.Forensics.Usn filter and presentation updates (#1720) * Optimize writing event monitoring records (#1721) * Add Generic.Detection.Yara.Zip (#1718) * Fixed crash on master-pong response. (#1719) OBS-URL: https://build.opensuse.org/request/show/975255 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=14
2022-05-05 20:38:36 +02:00
# rm -rf artifacts/definitions/Windows
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%build
Accepting request 1060929 from home:jeff_mahoney:branches:security:sensor - Use obsinfo mtime to produce stable build timestamp (bsc#1207369). - Update to version 0.6.7.4~git60.8abed37a: * http_comms: create ring buffer temporary file in the same directory * cronsnoop: plumb in real scope logging * cronsnoop: don't treat routine errors as fatal * cronsnoop: fix typo - Use obsinfo mtime to produce stable build timestamp (bsc#1207369). - Update to version 0.6.7.4~git60.8abed37a: * http_comms: create ring buffer temporary file in the same directory * cronsnoop: plumb in real scope logging * cronsnoop: don't treat routine errors as fatal * cronsnoop: fix typo OBS-URL: https://build.opensuse.org/request/show/1060929 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=41
2023-01-25 14:29:03 +01:00
# Reproductible builds need stable timestamps
timestamp=$(date -Iseconds --utc --date=@$(grep mtime: %{SOURCE12}|sed -e 's/mtime: //'))
git_commit=$(grep commit: %{SOURCE12}|sed -e 's/commit: //g')
export VELOCIRAPTOR_BUILD_TIME=$timestamp
export VELOCIRAPTOR_GIT_HEAD=$git_commit
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_server}
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
(cd gui/velociraptor ; npm run build)
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%sysusers_generate_pre %{SOURCE13} velociraptor-user
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%endif
make %{make_target} BUILD_LIBBPFGO=%{with bpf} GIT=echo
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_kafka_humio_gateway}
Accepting request 998240 from home:jeff_mahoney:branches:security:sensor - Update to version 0.6.4.2~git59.5ebb49db: * api/authenticators: fix handling of missing oauthstate cookie for OAUTH2 - Update to version 0.6.4.2~git57.fcb11adf: * kafka-humio-gateway: add sample config file - Updated BuildRequires to use go 1.17 after updating vendoring - Add vmlinux.h from 5.18.9-2-default to provide type information (x86_64 only) - Update to version 0.6.4.2~git56.47b4adb4: * Updating the NewFiles and ProcessStatuses Artifacts * cronsnoop: Add plugin which is able to snoop removal/addition of cron… (#37) * third_party/go-libaudit: don't directly use unix.* * Add Linux.Remediation.Quarantine artifact * Extend audit artifacts to use new interface * audit: rearchitect plugin to scale better with multiple invocations * third_party/go-libaudit: move handling of receive buffer to caller * third_party/go-libaudit: move buffer handling from netlink to audit * third_party/go-libaudit: allow audit fd to be pollable * third_party/go-libaudit: Add support for removing individual rules * third_party/go-libaudit: rule.Rule.Build: Don't assume that no syscalls means all syscalls * third_party/go-libaudit: Report missing rules during deletion * import go-libaudit as a third-party module * quarantine: actually call the OS-specific artifact * artifactset: add ability to select named sources * GUI: Artifact selector (#1790) * host-info: make quarantine UI more robust with non-Windows client hosts * shell-viewer: default to Bash on non-Windows clients OBS-URL: https://build.opensuse.org/request/show/998240 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=18
2022-08-19 20:30:12 +02:00
(cd contrib/kafka-humio-gateway; go build -o %{name}-kafka-humio-gateway)
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%sysusers_generate_pre %{SOURCE16} kafka-user
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%endif
- Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) - Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=11
2022-03-15 15:14:34 +01:00
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%install
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
install -D -d -m 0750 %buildroot/%{_sysconfdir}/velociraptor
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/data
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/logs
install -D -d -m 0700 %buildroot/%{_sharedstatedir}/%{name}/tmp
%if %{build_server}
service_file_source=%{SOURCE5}
config_file_source=%{SOURCE6}
sysconfig_file_source=%{SOURCE10}
config_file=server.config
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
install -D -m 0644 %{SOURCE13} %{buildroot}%{_sysusersdir}/system-user-velociraptor.conf
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%else
service_file_source=%{SOURCE7}
config_file_source=%{SOURCE8}
sysconfig_file_source=%{SOURCE11}
config_file=client.config
%endif
install -D -m 0644 "$service_file_source" %{buildroot}%{_unitdir}/%{name}.service
install -D -m 0644 "$sysconfig_file_source" %{buildroot}%{_fillupdir}/sysconfig.%{name}
install -D -m 0640 "$config_file_source" "%{buildroot}%{_sysconfdir}/velociraptor/$config_file"
install -D -m 0755 output/velociraptor-v%{version}-linux-* %buildroot/%{_bindir}/%{name}
%if %{build_kafka_humio_gateway}
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
install -D -m 0644 %{SOURCE15} %{buildroot}%{_unitdir}/
install -D -m 0644 %{SOURCE16} %{buildroot}%{_fillupdir}/
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
install -D -m 0755 contrib/kafka-humio-gateway/velociraptor-kafka-humio-gateway %buildroot/%{_bindir}
install -D -m 0644 contrib/kafka-humio-gateway/sample-config.yml \
%buildroot/%{_datadir}/velociraptor-kafka-humio-gateway/sample-config.yml
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
install -D -m 0644 %{SOURCE14} %{buildroot}%{_sysusersdir}/velociraptor-kafka.conf
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
install -D -d -m 0750 %{buildroot}%{_sysconfdir}/velociraptor-kafka-humio-gateway
install -D -m 0640 contrib/kafka-humio-gateway/sample-config.yml \
%buildroot/%{_sysconfdir}/velociraptor-kafka-humio-gateway/transport.yml
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%files
Accepting request 1060070 from home:jeff_mahoney:branches:security:sensor - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch - Remove dependency on bpftool. We use the vmlinux.h archive to provide vmlinux.h. - Restored %defattr due to SLE12 using rpm-4.11. - Fix builds in vendor code on SLE12 - Fix build in third_party/sdjournal due to older systemd on SLE12 - Added patches: - vendor-go-magic-build-fix-for-SLE12.patch - sdjournal-build-fix-for-SLE12.patch OBS-URL: https://build.opensuse.org/request/show/1060070 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=35
2023-01-21 03:03:49 +01:00
%defattr(-, root, root)
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%license LICENSE
%doc README.md
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%{_bindir}/%{name}
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
%{_unitdir}/%{name}.service
Accepting request 1059625 from home:jeff_mahoney:branches:security:sensor --------------------------------------------------------------------- - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. ----------------------------------------------------------------- - Added support for setting command line options via sysconfig - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. - Added support for setting command line options via sysconfig OBS-URL: https://build.opensuse.org/request/show/1059625 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=32
2023-01-19 16:27:12 +01:00
%{_fillupdir}/sysconfig.%{name}
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%dir %attr(-, root, velociraptor) %{_sysconfdir}/velociraptor
%config(noreplace) %{config_perms} %{_sysconfdir}/velociraptor/*.config
%dir %{state_dir_perms} %{_sharedstatedir}/%{name}
%dir %{state_dir_perms} %{_sharedstatedir}/%{name}/data
%dir %{state_dir_perms} %{_sharedstatedir}/%{name}/logs
%dir %{state_dir_perms} %{_sharedstatedir}/%{name}/tmp
- Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) - Update to version 0.6.3~git17.741ebb59: * kafka-humio-gateway: update README.md * kafka-humio-gateway: Fix missing variable rename * Add Kafka-Humio Gateway [Depends on PR#10] (#8) OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=11
2022-03-15 15:14:34 +01:00
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
%pre
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%service_add_pre %{name}.service
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
%post
Accepting request 1059625 from home:jeff_mahoney:branches:security:sensor --------------------------------------------------------------------- - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. ----------------------------------------------------------------- - Added support for setting command line options via sysconfig - Restore requirement to build with clang13. Newer versions cause libbpfgo to crash immediately. - Added support for setting command line options via sysconfig OBS-URL: https://build.opensuse.org/request/show/1059625 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=32
2023-01-19 16:27:12 +01:00
%{fillup_only}
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%service_add_post %{name}.service
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
%preun
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%service_del_preun %{name}.service
Accepting request 950798 from home:jeff_mahoney:branches:security:sensor - Resolved some rpmlint warnings and added client config placeholder. - Update to version 0.6.3~git0.69e0fffa: * Prepare for 0.6.3 release (#1515) * add limitations to description and key path to query (#1514) * Retry remote datastore connections (#1513) * Write minion log files and autocert in its own dir. (#1512) * Synced KapeFiles artifacts (#1511) * Added data retention server artifacts (#1510) * Set an upper limit for ttl in memcache (#1508) * Add updates to Windows.System.Services (#15) (#1509) * Ensure collector container is properly closed when interrupted. (#1507) * Continually rebuild the index at runtime. (#1506) * Harder vacuum - directly move client task directories to the attic. (#1505) * add limitation disclaimer (#1504) * Reduce critial section to avoid deadlock in repository manager (#1503) * Implemented a vacuum command to remove old tasks from client queues. (#1501) * Better format profile metrics output. (#1495) * Cap size of directories and report large directories. (#1493) * Set ACE completers per editor to avoid global state. (#1492) * Add HttpOnly flag to all cookies. (#1491) * Refactor completion routine calls (#1490) * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486) * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485) * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487) * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488) * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489) * Limit size of cached directories. (#1483) * Add more instrumentation to memory caches. (#1482) * Fixed chart resizing bug (#1481) OBS-URL: https://build.opensuse.org/request/show/950798 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=3
2022-02-02 19:59:59 +01:00
%postun
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%service_del_postun %{name}.service
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%if %{build_server}
%pre -n system-user-velociraptor -f velociraptor-user.pre
%files -n system-user-velociraptor
%defattr(-, root, root)
%{_sysusersdir}/system-user-velociraptor.conf
%endif
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%if %{build_kafka_humio_gateway}
%files kafka-humio-gateway
%defattr(-, root, root)
%license LICENSE
%doc contrib/kafka-humio-gateway/README.md
%{_bindir}/velociraptor-kafka-humio-gateway
%dir %{_datadir}/velociraptor-kafka-humio-gateway
%{_datadir}/velociraptor-kafka-humio-gateway/sample-config.yml
%{_sysusersdir}/velociraptor-kafka.conf
%{_unitdir}/velociraptor-kafka-humio-gateway.service
%{_fillupdir}/sysconfig.velociraptor-kafka-humio-gateway
%dir %attr(750, root, velociraptor-kafka) %{_sysconfdir}/velociraptor-kafka-humio-gateway
%config(noreplace) %attr(0640, root, velociraptor-kafka) %{_sysconfdir}/velociraptor-kafka-humio-gateway/transport.yml
Accepting request 1085596 from home:jeff_mahoney:branches:security:sensor:updates - Provide sysuser template for velociraptor user and group. OBS-URL: https://build.opensuse.org/request/show/1085596 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=48
2023-05-09 04:00:49 +02:00
%pre kafka-humio-gateway -f kafka-user.pre
Accepting request 1085591 from home:jeff_mahoney:branches:security:sensor:updates - Update to version 0.6.7.5~git78.2bef6fc: * bpf: fix path to vmlinux.h - Update to version 0.6.7.5~git77.997aa73: * file_store/test_utils/server_config.go: update test certificate * Update bluemonday dependency. * vql/functions/hash: cache results on Linux * libbpfgo: update to velociraptor-branch-v0.4.8-libbpf-1.2.0 * logscale/backport: don't use networking.GetHttpTransport * vql/tools/logscale: add plugin to post events to LogScale ingestion endpoint * file_store/directory: add ability to report pending size - Change clang dependency to clang16 - Fix velociraptor-golang-mage-vendoring.diff to account for newer 'go mod vendor' honoring build flags. - Fix update-vendoring.sh script to actually run the %setup part of the spec. - Merge client package into server spec and use _multibuild to create client package from same spec file. - Adjust changelog to retain changes for client package. - Fix building in static mode on earlier releases. - Added patch: velociraptor-libbpfgo-only-build-libbpf.patch - Tightening the security of the services a bit: - tmp files are now moved to /var/lib/velociraptor{,-client}/tmp from /tmp - run velociraptor server as user velociraptor instead of root we do not really need root permissions here - introduce /var/lib/velociraptor/filestore to make it easier to split out large file upload - change permissions for the data directory and subdirectories to OBS-URL: https://build.opensuse.org/request/show/1085591 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=46
2023-05-09 02:49:51 +02:00
%service_add_pre velociraptor-kafka-humio-gateway.service
%post kafka-humio-gateway
%{fillup_only -s kafka-humio-gateway}
%service_add_post velociraptor-kafka-humio-gateway.service
%preun kafka-humio-gateway
%service_del_preun velociraptor-kafka-humio-gateway.service
%postun kafka-humio-gateway
%service_del_postun velociraptor-kafka-humio-gateway.service
%endif
osc copypac from project:home:jeff_mahoney:security:sensor package:velociraptor revision:2 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=1
2022-01-21 18:45:44 +01:00
%changelog
Reference in New Issue Copy Permalink