Marcus Meissner
b5c3d0c025
- Update to 0.17.3:
* BACKWARDS INCOMPATIBLE CHANGES
- '--verbose' command line option and 'verbose' config option are no
longer supported, use 'log_level' and 'report_level' options instead
- '--report' command line option is no longer supported, use
'report_url' config option instead
- 'ignore_list' config option is no longer supported, use
'report_ignore_changed_attrs' instead
- 'report_attributes' config option is no longer supported, use
'report_force_attrs' instead
- (restricted) regular rules must start with literal '/', i.e. the rule
cannot begin with a macro variable
- config lines must end with new line
- '@' and ' ' in the configuration are now escaped with '\', that means
to match a '\' you have to use four backslashes '\\\\' in your rules
- 'gzip_dbout=false' fails now with config error when no zlib support
is compiled in
- remove '--with-initial-errors' configure option
- remove PostgreSQL database backend support
- remove Sun ACL support
- remove config and database signing support
* Enhancements:
- add new '--log-level' command line option and 'log_level' config option
- introduce named log levels
- add new 'report' log level to help to debug rule matching
- add new 'config' log level to help to debug config and rule parsing
- aad new '--dry-init' command
- add new '--path-check' command
- add directory support for @@include
- add new @@x_include config macro
- add new @@x_include_setenv config macro
- add new default compound group 'H' (all compiled-in hashsums)
- add support for per-report_url options
- add new 'report_level' config option
- add new 'report_append' config option
- add exit code 21 for file lock errors
- add default config values, available hashsums and compound groups
to '--version' output
- add Linux capabilities support
- show changed attributes in 'different attributes' message
- enable 'gost' and 'whirlpool' checksums when using gcrypt
- add 'stribog256' and 'stribog512' gcrypt algorithms
- add config file names to log output
* Miscellaneous behaviour changes:
- 'report_summarize_changes': hashsum changes are now indicated with 'H'
- print '--help' and '--verion' output to stdout
- log messages and errors are always written to stderr
- initialise report URLs after configuration parsing
- allow empty values for macro variables
- SIGUSR1 now toggles debug log level
- fail on errors in regular expressions during config parsing
- fail on invalid URLs during config check
- Fail on double slash in rule path
- cache log lines when 'log_level' is not yet set
* Deprecations:
- 'database' config option is now deprecated, use 'database_in' instead
- 'summarize_changes' config option is now deprecated, use
'report_summarize_changes' instead
- 'grouped' config option is now deprecated, use 'report_grouped'
instead
- non-alphanumeric group names are deprecated
* Notable bug fixes:
- fix line numbers in log messages
- remove warning when input database is '/dev/null'
- correctly handle UTF-8 in path names and rules
- fix compilation with curl and gcrypt
- warn on unsupported hash algorithms
- improve large-file support
* Remove obsolete aide-attributes.sh script
* Remove outdated manual.html
* Update documentation
- Rename and rebase aide-0.17.3-as-needed.patch
- Rebase aide-xattr-in-libc.patch
- Remove aide-define_hash_use_gcrypt.patch (no longer needed)
- Remove aide-dynamic.patch (no longer needed)
OBS-URL: https://build.opensuse.org/request/show/874862
OBS-URL: https://build.opensuse.org/package/show/security/aide?expand=0&rev=38
126 lines
4.1 KiB
RPMSpec
126 lines
4.1 KiB
RPMSpec
#
|
|
# spec file for package aide
|
|
#
|
|
# Copyright (c) 2021 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
Name: aide
|
|
Version: 0.17.3
|
|
Release: 0
|
|
Summary: Advanced Intrusion Detection Environment
|
|
License: GPL-2.0-or-later
|
|
URL: https://aide.github.io/
|
|
Source0: https://github.com/aide/aide/releases/download/v%{version}/aide-%{version}.tar.gz
|
|
Source1: aide.conf
|
|
Source2: aide-cron_daily.sh
|
|
Source3: aide-test.sh
|
|
Source42: https://github.com/aide/aide/releases/download/v%{version}/aide-%{version}.tar.gz.asc
|
|
Source43: aide.keyring
|
|
Patch1: aide-0.17.3-as-needed.patch
|
|
Patch2: aide-xattr-in-libc.patch
|
|
BuildRequires: automake
|
|
BuildRequires: bison
|
|
BuildRequires: curl-devel
|
|
BuildRequires: flex
|
|
BuildRequires: libacl-devel
|
|
BuildRequires: libgcrypt-devel
|
|
BuildRequires: libselinux-devel
|
|
BuildRequires: pkgconfig
|
|
BuildRequires: zlib-devel
|
|
|
|
%description
|
|
AIDE is an intrusion detection system that checks file integrity.
|
|
|
|
%package test
|
|
Summary: Simple AIDE testing
|
|
|
|
%description test
|
|
Simple AIDE test script for externalized testing.
|
|
|
|
%prep
|
|
%setup -q
|
|
%patch1 -p1
|
|
%patch2 -p1
|
|
|
|
%build
|
|
autoreconf -fiv
|
|
%configure \
|
|
--with-config_file=%{_sysconfdir}/aide.conf \
|
|
--with-dbhmactype=md5 \
|
|
--disable-static \
|
|
--enable-lfs \
|
|
--with-posix-acl \
|
|
--with-xattr \
|
|
--with-selinux \
|
|
--with-curl \
|
|
--with-zlib \
|
|
--with-gcrypt \
|
|
--without-mhash
|
|
# --enable-forced_configmd
|
|
%make_build
|
|
|
|
%install
|
|
%make_install
|
|
install -m 700 -d %{buildroot}%{_localstatedir}/lib/aide
|
|
install -m 700 -d %{buildroot}%{_sysconfdir}
|
|
install -m 600 %{SOURCE1} %{buildroot}%{_sysconfdir}/aide.conf
|
|
install -m 700 %{SOURCE3} %{buildroot}%{_bindir}/
|
|
mkdir -p doc/examples%{_sysconfdir}/cron.daily/
|
|
cp -a %{SOURCE2} doc/examples%{_sysconfdir}/cron.daily/aide.sh
|
|
|
|
%post
|
|
# with the 0.17 update some backward incompatible changes were made to the config file. Therefore, we have to adapt those parameters, otherwise the program will fail
|
|
sed -i 's/database=/database_in=/' %{_sysconfdir}/aide.conf
|
|
sed -i '/verbose=/d' %{_sysconfdir}/aide.conf
|
|
sed -i 's/\t/ /g' %{_sysconfdir}/aide.conf
|
|
|
|
%check
|
|
rm -rf %{_localstatedir}/tmp/aide-test
|
|
mkdir %{_localstatedir}/tmp/aide-test
|
|
export TESTDIR=%{_localstatedir}/tmp/aide-test
|
|
%make_build DESTDIR=$TESTDIR install
|
|
install -m 700 -d $TESTDIR%{_localstatedir}/lib/aide
|
|
install -m 700 -d $TESTDIR%{_sysconfdir}
|
|
install -m 600 %{SOURCE1} $TESTDIR%{_sysconfdir}/aide.conf.new
|
|
sed -e "s#%{_localstatedir}/lib/aide#$TESTDIR%{_localstatedir}/lib/aide#g" <$TESTDIR%{_sysconfdir}/aide.conf.new >$TESTDIR%{_sysconfdir}/aide.conf
|
|
# with the 0.17 update, the config file changed a bit. Wwe have to adapt those parameters, otherwise the program will fail
|
|
sed -i 's/database=/database_in=/' $TESTDIR%{_sysconfdir}/aide.conf
|
|
sed -i '/verbose=/d' $TESTDIR%{_sysconfdir}/aide.conf
|
|
sed -i 's/\t/ /g' $TESTDIR%{_sysconfdir}/aide.conf
|
|
$TESTDIR/usr/bin/aide -D -c $TESTDIR%{_sysconfdir}/aide.conf
|
|
sleep 2
|
|
sync
|
|
sleep 2
|
|
|
|
$TESTDIR/usr/bin/aide -c $TESTDIR%{_sysconfdir}/aide.conf --init
|
|
mv $TESTDIR%{_localstatedir}/lib/aide/aide.db.new $TESTDIR%{_localstatedir}/lib/aide/aide.db
|
|
$TESTDIR/usr/bin/aide -c $TESTDIR%{_sysconfdir}/aide.conf --check --log-level=info
|
|
|
|
rm -rf $TESTDIR
|
|
|
|
%files
|
|
%license COPYING
|
|
%doc AUTHORS ChangeLog NEWS README doc/examples
|
|
%{_bindir}/aide
|
|
/%{_mandir}/man1/aide.1.gz
|
|
/%{_mandir}/man5/aide.conf.5.gz
|
|
%{_localstatedir}/lib/aide
|
|
%config(noreplace) %{_sysconfdir}/aide.conf
|
|
|
|
%files test
|
|
%{_bindir}/aide-test.sh
|
|
|
|
%changelog
|