rpm/audit
SHA256
1
0
Fork 0
forked from pool/audit
Code Pull Requests Activity
3099f73ab7
audit/audit.changes

1471 lines
64 KiB
Plaintext
Raw Normal View History

Accepting request 920348 from home:ematsumiya:branches:security - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs OBS-URL: https://build.opensuse.org/request/show/920348 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=129
2021-09-20 18:14:05 +02:00
-------------------------------------------------------------------
Thu Sep 16 03:46:19 UTC 2021 - Enzo Matsumiya <ematsumiya@suse.com>
- Update to version 3.0.5:
* In auditd, flush uid/gid caches when user/group added/deleted/modified
* Fixed various issues when dealing with corrupted logs
* In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
* Apply performance speedups to auparse library
* Optimize rule loading in auditctl
* Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
* Update syscall table to the 5.14 kernel
* Fixed various issues when dealing with corrupted logs
Accepting request 909447 from home:ematsumiya:branches:security - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists OBS-URL: https://build.opensuse.org/request/show/909447 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=124
2021-08-01 16:31:28 +02:00
-------------------------------------------------------------------
Fri Jul 30 18:14:14 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com>
- Update to version 3.0.3:
* Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
* Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
* Change auparse_feed_has_data in auparse to include incomplete events
* Auditd, stop linking against -lrt
* Add ProtectHome and RestrictRealtime to auditd.service
* In auditd, read up to 3 netlink packets in a row
* In auditd, do not validate path to plugin unless active
* In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=125
2021-08-03 17:56:42 +02:00
- use https source urls
Accepting request 909447 from home:ematsumiya:branches:security - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists OBS-URL: https://build.opensuse.org/request/show/909447 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=124
2021-08-01 16:31:28 +02:00
Accepting request 900434 from home:ematsumiya:branches:security - Adjust spec files to support new version - Include one fix for libev - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream old: security/audit new: home:ematsumiya:branches:security/audit rev None Index: audit-no-gss.patch =================================================================== --- audit-no-gss.patch (revision 118) +++ audit-no-gss.patch (revision 17) @@ -11,11 +11,12 @@ --- a/init.d/auditd.conf +++ b/init.d/auditd.conf -@@ -30,7 +30,4 @@ tcp_listen_queue = 5 - tcp_max_per_addr = 1 +@@ -30,8 +30,6 @@ tcp_max_per_addr = 1 ##tcp_client_ports = 1024-65535 tcp_client_max_idle = 0 --enable_krb5 = no + transport = TCP -krb5_principal = auditd -##krb5_key_file = /etc/audit/audit.key distribute_network = no + q_depth = 400 + overflow_action = SYSLOG Index: audit-plugins-path.patch =================================================================== --- audit-plugins-path.patch (revision 118) +++ audit-plugins-path.patch (revision 17) @@ -5,19 +5,8 @@ Adjust location of plugins built by audit-secondary. These should never have been in /sbin plus some (for SUSE) require lib dependancies on /usr/lib ---- audit-1.7.2/audisp/plugins/prelude/au-prelude.conf.orig 2008-04-23 11:56:11.946681000 +0200 -+++ audit-1.7.2/audisp/plugins/prelude/au-prelude.conf 2008-04-23 11:56:22.789827000 +0200 -@@ -5,7 +5,7 @@ - - active = no - direction = out --path = /sbin/audisp-prelude -+path = /usr/sbin/audisp-prelude - type = always - #args = - format = string ---- audit-1.7.2/audisp/plugins/remote/au-remote.conf.orig 2008-04-23 11:56:11.976660000 +0200 -+++ audit-1.7.2/audisp/plugins/remote/au-remote.conf 2008-04-23 11:56:30.958657000 +0200 +--- a/audisp/plugins/remote/au-remote.conf ++++ b/audisp/plugins/remote/au-remote.conf @@ -5,7 +5,7 @@ active = no @@ -27,8 +16,8 @@ type = always #args = format = string ---- audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf.orig 2008-04-23 11:56:11.993637000 +0200 -+++ audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf 2008-04-23 11:56:40.533070000 +0200 +--- a/audisp/plugins/zos-remote/audispd-zos-remote.conf ++++ b/audisp/plugins/zos-remote/audispd-zos-remote.conf @@ -8,7 +8,7 @@ active = no @@ -36,5 +25,5 @@ -path = /sbin/audispd-zos-remote +path = /usr/sbin/audispd-zos-remote type = always - args = /etc/audisp/zos-remote.conf + args = /etc/audit/zos-remote.conf format = string Index: audit-secondary.changes =================================================================== --- audit-secondary.changes (revision 118) +++ audit-secondary.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Removes audit-fno-common.patch: fixed in upstream +- Removes audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Mon Feb 1 18:13:18 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org> - Do not explicitly provide group(audit) in system-users-audit: @@ -24,7 +149,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit-secondary.spec =================================================================== --- audit-secondary.spec (revision 118) +++ audit-secondary.spec (revision 17) @@ -22,7 +22,7 @@ # The seperation is required to minimize unnecessary build cycles. %define _name audit Name: audit-secondary -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -34,9 +34,8 @@ Patch2: audit-no-gss.patch Patch3: audit-allow-manual-stop.patch Patch4: audit-ausearch-do-not-require-tclass.patch -Patch5: audit-python3.patch -Patch6: audit-fno-common.patch -Patch7: change-default-log_group.patch +Patch5: change-default-log_group.patch +Patch6: libev-werror.patch BuildRequires: audit-devel = %{version} BuildRequires: autoconf >= 2.12 BuildRequires: gcc-c++ @@ -55,6 +54,7 @@ BuildRequires: sysuser-tools BuildRequires: tcpd-devel BuildRequires: pkgconfig(libcap-ng) +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -127,14 +127,13 @@ %patch4 -p1 %patch5 -p1 %patch6 -p1 -%patch7 -p1 %if %{without python2} && %{with python3} # Fix python env call in tests if we only have Python3. # If both versions are present, python2 bindings are preferred by the tests and # unconditionally using /usr/bin/python3 breaks the tests # Probably the correct solution is to run the tests twice if both are present. -sed -i -e 's:#!/usr/bin/env python:#!/usr/bin/python3:g' auparse/test/auparse_test.py +perl -i -lpe 's{#!/usr/bin/env python\S+}{#!/usr/bin/python3}' auparse/test/auparse_test.py %endif %build @@ -144,15 +143,18 @@ export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{_name} \ --with-apparmor \ --with-libwrap \ --with-libcap-ng=yes \ -%ifarch aarch64 - --with-aarch64 \ -%endif - --disable-static + --disable-static \ + %{?_with_python3} \ + %{?_without_python} + make %{?_smp_mflags} %sysusers_generate_pre %{SOURCE1} audit @@ -197,7 +199,7 @@ #USR-MERGE %if !0%{?usrmerged} mkdir %{buildroot}/sbin/ -for prog in auditctl auditd ausearch autrace audispd aureport augenrules; do +for prog in auditctl auditd ausearch autrace aureport augenrules; do ln -s %{_sbindir}/$prog %{buildroot}/sbin/$prog done %endif @@ -235,8 +237,7 @@ %files -n audit %license COPYING -%doc README ChangeLog rules/[0-9]* rules/README-rules init.d/auditd.cron -%attr(644,root,root) %{_mandir}/man8/audispd.8.gz +%doc README ChangeLog rules init.d/auditd.cron %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz %attr(644,root,root) %{_mandir}/man8/auditd.8.gz %attr(644,root,root) %{_mandir}/man8/aureport.8.gz @@ -247,7 +248,6 @@ %attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz %attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz -%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz %attr(644,root,root) %{_mandir}/man8/auvirt.8.gz %attr(644,root,root) %{_mandir}/man8/augenrules.8.gz @@ -256,7 +256,6 @@ /sbin/auditd /sbin/ausearch /sbin/autrace -/sbin/audispd /sbin/augenrules /sbin/aureport %endif @@ -265,29 +264,28 @@ %attr(755,root,root) %{_sbindir}/ausearch %attr(750,root,root) %{_sbindir}/autrace %attr(750,root,root) %{_sbindir}/augenrules -%attr(750,root,root) %{_sbindir}/audispd +%attr(750,root,root) %{_sbindir}/audisp-syslog %attr(755,root,root) %{_bindir}/aulast %attr(755,root,root) %{_bindir}/aulastlog %attr(755,root,root) %{_bindir}/ausyscall %attr(755,root,root) %{_sbindir}/aureport %attr(755,root,root) %{_bindir}/auvirt %dir %attr(750,root,root) %{_sysconfdir}/audit -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/af_unix.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/syslog.conf +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/af_unix.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/syslog.conf %ghost %{_sysconfdir}/auditd.conf %ghost %{_sysconfdir}/audit.rules %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/auditd.conf %dir %attr(750,root,root) %{_sysconfdir}/audit/rules.d %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/rules.d/audit.rules -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audispd.conf %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audit-stop.rules %dir %attr(750,root,audit) %{_localstatedir}/log/audit %ghost %config(noreplace) %attr(640,root,audit) %{_localstatedir}/log/audit/audit.log %dir %attr(700,root,root) %{_localstatedir}/spool/audit %{_unitdir}/auditd.service %{_sbindir}/rcauditd +%{_datadir}/audit/ %files -n system-group-audit %{_sysusersdir}/system-group-audit.conf @@ -301,23 +299,24 @@ %if %{with python3} %files -n python3-audit -%attr(755,root,root) %{python3_sitearch}/_audit.so -%attr(755,root,root) %{python3_sitearch}/auparse.so -%{python3_sitearch}/audit.py* +%defattr(-,root,root,-) +%attr(755,root,root) %{python3_sitearch}/* %endif %files -n audit-audispd-plugins %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz +%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/audispd-zos-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/zos-remote.conf +%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz +%attr(750,root,root) %dir %{_sysconfdir}/audit +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/audispd-zos-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/zos-remote.conf %attr(750,root,root) %{_sbindir}/audisp-remote %attr(750,root,root) %{_sbindir}/audispd-zos-remote -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audisp-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/au-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audisp-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/au-remote.conf %changelog Index: audit.changes =================================================================== --- audit.changes (revision 118) +++ audit.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Remove audit-fno-common.patch: fixed in upstream +- Remove audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Wed Dec 2 11:49:28 UTC 2020 - Alexander Bergmann <abergmann@suse.com> - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) @@ -12,7 +137,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit.spec =================================================================== --- audit.spec (revision 118) +++ audit.spec (revision 17) @@ -17,7 +17,7 @@ Name: audit -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -35,6 +35,7 @@ BuildRequires: tcpd-devel Requires: libaudit1 = %{version} Requires: libauparse0 = %{version} +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -79,27 +80,30 @@ %build autoreconf -fi +cp INSTALL.tmp INSTALl export CFLAGS="%{optflags} -fno-strict-aliasing" export CXXFLAGS="$CFLAGS" export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{name} \ --with-apparmor \ - --with-libwrap \ - --without-libcap-ng \ + --with-libcap-ng=no \ --disable-static \ - --without-python \ -%ifarch aarch64 - --with-aarch64 \ -%endif + --with-python=no \ --disable-zos-remote + +make %{?_smp_mflags} -C common make %{?_smp_mflags} -C lib make %{?_smp_mflags} -C auparse make %{?_smp_mflags} -C docs %install +%make_install -C common %make_install -C lib %make_install -C auparse %make_install -C docs @@ -134,7 +138,7 @@ %{_libdir}/libauparse.so.* %files -n audit-devel -%doc contrib/skeleton.c contrib/plugin +%doc contrib/plugin %{_libdir}/libaudit.so %{_libdir}/libauparse.so %{_includedir}/libaudit.h Index: change-default-log_group.patch =================================================================== --- change-default-log_group.patch (revision 118) +++ change-default-log_group.patch (revision 17) @@ -16,6 +16,6 @@ log_file = /var/log/audit/audit.log -log_group = root +log_group = audit - log_format = RAW + log_format = ENRICHED flush = INCREMENTAL_ASYNC freq = 50 Index: audit-3.0.2.tar.gz =================================================================== Binary file audit-3.0.2.tar.gz (revision 17) added Index: libev-werror.patch =================================================================== --- libev-werror.patch (added) +++ libev-werror.patch (revision 17) @@ -0,0 +1,26 @@ +From: Jan Engelhardt <jengelh@inai.de> +Date: 2021-06-02 16:18:03.256597842 +0200 + +Cherry-pick http://cvs.schmorp.de/libev/ev_iouring.c?view=log&r1=1.25 +to fix some terrible code. + +[ 50s] ev_iouring.c: In function 'iouring_sqe_submit': +[ 50s] ev_iouring.c:300:1: error: no return statement in function returning non-void [-Werror=return-type] + +--- + src/libev/ev_iouring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: audit-3.0.1/src/libev/ev_iouring.c +=================================================================== +--- audit-3.0.1.orig/src/libev/ev_iouring.c ++++ audit-3.0.1/src/libev/ev_iouring.c +@@ -287,7 +287,7 @@ iouring_sqe_get (EV_P) + } + + inline_size +-struct io_uring_sqe * ++void + iouring_sqe_submit (EV_P_ struct io_uring_sqe *sqe) + { + unsigned idx = sqe - EV_SQES; Index: audit-2.8.5.tar.gz =================================================================== Binary file audit-2.8.5.tar.gz (revision 118) deleted Index: audit-fno-common.patch =================================================================== --- audit-fno-common.patch (revision 118) +++ audit-fno-common.patch (deleted) @@ -1,24 +0,0 @@ -From: Tony Jones <tonyj@suse.de> -Subject: Resolve errors when compiling with -fno-common -Git-commmit: 017e6c6ab95df55f34e339d2139def83e5dada1f -References: bsc#1160384 -Upsteam: pending - -Header definitios need to be external when building with -fno-common (which -is default in GCC 10). - -Fixes: ff25054df7ed -Signed-off-by: Tony Jones <tonyj@suse.de> - ---- a/src/ausearch-common.h -+++ b/src/ausearch-common.h -@@ -50,7 +50,7 @@ extern pid_t event_pid; - extern int event_exact_match; - extern uid_t event_uid, event_euid, event_loginuid; - extern const char *event_tuid, *event_teuid, *event_tauid; --slist *event_node_list; -+extern slist *event_node_list; - extern const char *event_comm; - extern const char *event_filename; - extern const char *event_hostname; - Index: audit-python3.patch =================================================================== --- audit-python3.patch (revision 118) +++ audit-python3.patch (deleted) @@ -1,292 +0,0 @@ -From: Tomas Chvatal <tchvatal@suse.com> -Date: Wed Feb 7 09:26:35 UTC 2018 -Subject: Convert tests to run under python3 -References: https://github.com/linux-audit/audit-userspace/pull/39 -Patch-mainline: no; pending with maintainer - -Adjust auparse_test to run with python3 and python2 - -Index: audit-2.8.1/auparse/test/auparse_test.py -=================================================================== ---- audit-2.8.1.orig/auparse/test/auparse_test.py -+++ audit-2.8.1/auparse/test/auparse_test.py -@@ -1,5 +1,7 @@ - #!/usr/bin/env python - -+from __future__ import print_function -+ - import os - srcdir = os.getenv('srcdir') - -@@ -30,29 +32,29 @@ def walk_test(au): - au.reset() - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt, au.get_num_records()) -+ print("event %d has %d records" % (event_cnt, au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt += 1 -@@ -62,25 +64,25 @@ def walk_test(au): - def light_test(au): - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event has %d records" % (au.get_num_records()) -+ print("event has %d records" % (au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -- print -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) -+ print("") - record_cnt += 1 - if not au.next_record(): break - if not au.parse_next_event(): break -@@ -97,9 +99,9 @@ def simple_search(au, source, where): - au.search_add_item("auid", "=", val, auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(where) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def compound_search(au, how): - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); -@@ -115,119 +117,119 @@ def compound_search(au, how): - - au.search_set_stop(auparse.AUSEARCH_STOP_FIELD) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def feed_callback(au, cb_event_type, event_cnt): - if cb_event_type == auparse.AUPARSE_CB_EVENT_READY: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt[0], au.get_num_records()) -+ print("event %d has %d records" % (event_cnt[0], au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt[0] += 1 - - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - --print "Starting Test 1, iterate..." -+print("Starting Test 1, iterate...") - while au.parse_next_event(): - if au.find_field("auid"): -- print "%s=%s" % (au.get_field_name(), au.get_field_str()) -- print "interp auid=%s" % (au.interpret_field()) -+ print("%s=%s" % (au.get_field_name(), au.get_field_str())) -+ print("interp auid=%s" % (au.interpret_field())) - else: -- print "Error iterating to auid" --print "Test 1 Done\n" -+ print("Error iterating to auid") -+print("Test 1 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 2, walk events, records, and fields..." -+print("Starting Test 2, walk events, records, and fields...") - au.reset() - walk_test(au) --print "Test 2 Done\n" -+print("Test 2 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 3, walk events, records of 1 buffer..." -+print("Starting Test 3, walk events, records of 1 buffer...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER, buf[1]) - au.reset() - light_test(au); --print "Test 3 Done\n" -+print("Test 3 Done\n") - --print "Starting Test 4, walk events, records of 1 file..." -+print("Starting Test 4, walk events, records of 1 file...") - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); - walk_test(au); --print "Test 4 Done\n" -+print("Test 4 Done\n") - --print "Starting Test 5, walk events, records of 2 files..." -+print("Starting Test 5, walk events, records of 2 files...") - au = auparse.AuParser(auparse.AUSOURCE_FILE_ARRAY, files); - walk_test(au); --print "Test 5 Done\n" -+print("Test 5 Done\n") - --print "Starting Test 6, search..." -+print("Starting Test 6, search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - au.search_add_item("auid", "=", "500", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if au.search_next_event(): -- print "Error search found something it shouldn't have" -+ print("Error search found something it shouldn't have") - else: -- print "auid = 500 not found...which is correct" -+ print("auid = 500 not found...which is correct") - au.search_clear() - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - #au.search_add_item("auid", "exists", None, auparse.AUSEARCH_RULE_CLEAR) - au.search_add_item("auid", "exists", "", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if not au.search_next_event(): -- print "Error searching for existence of auid" --print "auid exists...which is correct" --print "Testing BUFFER_ARRAY, stop on field" -+ print("Error searching for existence of auid") -+print("auid exists...which is correct") -+print("Testing BUFFER_ARRAY, stop on field") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_FIELD) --print "Testing BUFFER_ARRAY, stop on record" -+print("Testing BUFFER_ARRAY, stop on record") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_RECORD) --print "Testing BUFFER_ARRAY, stop on event" -+print("Testing BUFFER_ARRAY, stop on event") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_EVENT) --print "Testing test.log, stop on field" -+print("Testing test.log, stop on field") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_FIELD) --print "Testing test.log, stop on record" -+print("Testing test.log, stop on record") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_RECORD) --print "Testing test.log, stop on event" -+print("Testing test.log, stop on event") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_EVENT) --print "Test 6 Done\n" -+print("Test 6 Done\n") - --print "Starting Test 7, compound search..." -+print("Starting Test 7, compound search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - compound_search(au, auparse.AUSEARCH_RULE_AND) - compound_search(au, auparse.AUSEARCH_RULE_OR) --print "Test 7 Done\n" -+print("Test 7 Done\n") - --print "Starting Test 8, regex search..." -+print("Starting Test 8, regex search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Doing regex match...\n" -+print("Doing regex match...\n") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Test 8 Done\n" -+print("Test 8 Done\n") - - # Note: this should match Test 2 exactly - # Note: this should match Test 2 exactly --print "Starting Test 9, buffer feed..." -+print("Starting Test 9, buffer feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -241,10 +243,10 @@ for s in buf: - beg += chunk_len - au.feed(data) - au.flush_feed() --print "Test 9 Done\n" -+print("Test 9 Done\n") - - # Note: this should match Test 4 exactly --print "Starting Test 10, file feed..." -+print("Starting Test 10, file feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -254,9 +256,9 @@ while True: - if not data: break - au.feed(data) - au.flush_feed() --print "Test 10 Done\n" -+print("Test 10 Done\n") - --print "Finished non-admin tests\n" -+print("Finished non-admin tests\n") - - au = None - sys.exit(0) OBS-URL: https://build.opensuse.org/request/show/900434 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=119
2021-06-16 19:16:06 +02:00
-------------------------------------------------------------------
Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com>
Accepting request 900437 from home:ematsumiya:branches:security Mention libev patch in changelogs OBS-URL: https://build.opensuse.org/request/show/900437 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=120
2021-06-16 19:29:54 +02:00
- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
* add libev-werror.patch
Accepting request 900434 from home:ematsumiya:branches:security - Adjust spec files to support new version - Include one fix for libev - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream old: security/audit new: home:ematsumiya:branches:security/audit rev None Index: audit-no-gss.patch =================================================================== --- audit-no-gss.patch (revision 118) +++ audit-no-gss.patch (revision 17) @@ -11,11 +11,12 @@ --- a/init.d/auditd.conf +++ b/init.d/auditd.conf -@@ -30,7 +30,4 @@ tcp_listen_queue = 5 - tcp_max_per_addr = 1 +@@ -30,8 +30,6 @@ tcp_max_per_addr = 1 ##tcp_client_ports = 1024-65535 tcp_client_max_idle = 0 --enable_krb5 = no + transport = TCP -krb5_principal = auditd -##krb5_key_file = /etc/audit/audit.key distribute_network = no + q_depth = 400 + overflow_action = SYSLOG Index: audit-plugins-path.patch =================================================================== --- audit-plugins-path.patch (revision 118) +++ audit-plugins-path.patch (revision 17) @@ -5,19 +5,8 @@ Adjust location of plugins built by audit-secondary. These should never have been in /sbin plus some (for SUSE) require lib dependancies on /usr/lib ---- audit-1.7.2/audisp/plugins/prelude/au-prelude.conf.orig 2008-04-23 11:56:11.946681000 +0200 -+++ audit-1.7.2/audisp/plugins/prelude/au-prelude.conf 2008-04-23 11:56:22.789827000 +0200 -@@ -5,7 +5,7 @@ - - active = no - direction = out --path = /sbin/audisp-prelude -+path = /usr/sbin/audisp-prelude - type = always - #args = - format = string ---- audit-1.7.2/audisp/plugins/remote/au-remote.conf.orig 2008-04-23 11:56:11.976660000 +0200 -+++ audit-1.7.2/audisp/plugins/remote/au-remote.conf 2008-04-23 11:56:30.958657000 +0200 +--- a/audisp/plugins/remote/au-remote.conf ++++ b/audisp/plugins/remote/au-remote.conf @@ -5,7 +5,7 @@ active = no @@ -27,8 +16,8 @@ type = always #args = format = string ---- audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf.orig 2008-04-23 11:56:11.993637000 +0200 -+++ audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf 2008-04-23 11:56:40.533070000 +0200 +--- a/audisp/plugins/zos-remote/audispd-zos-remote.conf ++++ b/audisp/plugins/zos-remote/audispd-zos-remote.conf @@ -8,7 +8,7 @@ active = no @@ -36,5 +25,5 @@ -path = /sbin/audispd-zos-remote +path = /usr/sbin/audispd-zos-remote type = always - args = /etc/audisp/zos-remote.conf + args = /etc/audit/zos-remote.conf format = string Index: audit-secondary.changes =================================================================== --- audit-secondary.changes (revision 118) +++ audit-secondary.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Removes audit-fno-common.patch: fixed in upstream +- Removes audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Mon Feb 1 18:13:18 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org> - Do not explicitly provide group(audit) in system-users-audit: @@ -24,7 +149,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit-secondary.spec =================================================================== --- audit-secondary.spec (revision 118) +++ audit-secondary.spec (revision 17) @@ -22,7 +22,7 @@ # The seperation is required to minimize unnecessary build cycles. %define _name audit Name: audit-secondary -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -34,9 +34,8 @@ Patch2: audit-no-gss.patch Patch3: audit-allow-manual-stop.patch Patch4: audit-ausearch-do-not-require-tclass.patch -Patch5: audit-python3.patch -Patch6: audit-fno-common.patch -Patch7: change-default-log_group.patch +Patch5: change-default-log_group.patch +Patch6: libev-werror.patch BuildRequires: audit-devel = %{version} BuildRequires: autoconf >= 2.12 BuildRequires: gcc-c++ @@ -55,6 +54,7 @@ BuildRequires: sysuser-tools BuildRequires: tcpd-devel BuildRequires: pkgconfig(libcap-ng) +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -127,14 +127,13 @@ %patch4 -p1 %patch5 -p1 %patch6 -p1 -%patch7 -p1 %if %{without python2} && %{with python3} # Fix python env call in tests if we only have Python3. # If both versions are present, python2 bindings are preferred by the tests and # unconditionally using /usr/bin/python3 breaks the tests # Probably the correct solution is to run the tests twice if both are present. -sed -i -e 's:#!/usr/bin/env python:#!/usr/bin/python3:g' auparse/test/auparse_test.py +perl -i -lpe 's{#!/usr/bin/env python\S+}{#!/usr/bin/python3}' auparse/test/auparse_test.py %endif %build @@ -144,15 +143,18 @@ export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{_name} \ --with-apparmor \ --with-libwrap \ --with-libcap-ng=yes \ -%ifarch aarch64 - --with-aarch64 \ -%endif - --disable-static + --disable-static \ + %{?_with_python3} \ + %{?_without_python} + make %{?_smp_mflags} %sysusers_generate_pre %{SOURCE1} audit @@ -197,7 +199,7 @@ #USR-MERGE %if !0%{?usrmerged} mkdir %{buildroot}/sbin/ -for prog in auditctl auditd ausearch autrace audispd aureport augenrules; do +for prog in auditctl auditd ausearch autrace aureport augenrules; do ln -s %{_sbindir}/$prog %{buildroot}/sbin/$prog done %endif @@ -235,8 +237,7 @@ %files -n audit %license COPYING -%doc README ChangeLog rules/[0-9]* rules/README-rules init.d/auditd.cron -%attr(644,root,root) %{_mandir}/man8/audispd.8.gz +%doc README ChangeLog rules init.d/auditd.cron %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz %attr(644,root,root) %{_mandir}/man8/auditd.8.gz %attr(644,root,root) %{_mandir}/man8/aureport.8.gz @@ -247,7 +248,6 @@ %attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz %attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz -%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz %attr(644,root,root) %{_mandir}/man8/auvirt.8.gz %attr(644,root,root) %{_mandir}/man8/augenrules.8.gz @@ -256,7 +256,6 @@ /sbin/auditd /sbin/ausearch /sbin/autrace -/sbin/audispd /sbin/augenrules /sbin/aureport %endif @@ -265,29 +264,28 @@ %attr(755,root,root) %{_sbindir}/ausearch %attr(750,root,root) %{_sbindir}/autrace %attr(750,root,root) %{_sbindir}/augenrules -%attr(750,root,root) %{_sbindir}/audispd +%attr(750,root,root) %{_sbindir}/audisp-syslog %attr(755,root,root) %{_bindir}/aulast %attr(755,root,root) %{_bindir}/aulastlog %attr(755,root,root) %{_bindir}/ausyscall %attr(755,root,root) %{_sbindir}/aureport %attr(755,root,root) %{_bindir}/auvirt %dir %attr(750,root,root) %{_sysconfdir}/audit -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/af_unix.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/syslog.conf +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/af_unix.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/syslog.conf %ghost %{_sysconfdir}/auditd.conf %ghost %{_sysconfdir}/audit.rules %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/auditd.conf %dir %attr(750,root,root) %{_sysconfdir}/audit/rules.d %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/rules.d/audit.rules -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audispd.conf %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audit-stop.rules %dir %attr(750,root,audit) %{_localstatedir}/log/audit %ghost %config(noreplace) %attr(640,root,audit) %{_localstatedir}/log/audit/audit.log %dir %attr(700,root,root) %{_localstatedir}/spool/audit %{_unitdir}/auditd.service %{_sbindir}/rcauditd +%{_datadir}/audit/ %files -n system-group-audit %{_sysusersdir}/system-group-audit.conf @@ -301,23 +299,24 @@ %if %{with python3} %files -n python3-audit -%attr(755,root,root) %{python3_sitearch}/_audit.so -%attr(755,root,root) %{python3_sitearch}/auparse.so -%{python3_sitearch}/audit.py* +%defattr(-,root,root,-) +%attr(755,root,root) %{python3_sitearch}/* %endif %files -n audit-audispd-plugins %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz +%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/audispd-zos-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/zos-remote.conf +%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz +%attr(750,root,root) %dir %{_sysconfdir}/audit +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/audispd-zos-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/zos-remote.conf %attr(750,root,root) %{_sbindir}/audisp-remote %attr(750,root,root) %{_sbindir}/audispd-zos-remote -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audisp-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/au-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audisp-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/au-remote.conf %changelog Index: audit.changes =================================================================== --- audit.changes (revision 118) +++ audit.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Remove audit-fno-common.patch: fixed in upstream +- Remove audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Wed Dec 2 11:49:28 UTC 2020 - Alexander Bergmann <abergmann@suse.com> - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) @@ -12,7 +137,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit.spec =================================================================== --- audit.spec (revision 118) +++ audit.spec (revision 17) @@ -17,7 +17,7 @@ Name: audit -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -35,6 +35,7 @@ BuildRequires: tcpd-devel Requires: libaudit1 = %{version} Requires: libauparse0 = %{version} +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -79,27 +80,30 @@ %build autoreconf -fi +cp INSTALL.tmp INSTALl export CFLAGS="%{optflags} -fno-strict-aliasing" export CXXFLAGS="$CFLAGS" export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{name} \ --with-apparmor \ - --with-libwrap \ - --without-libcap-ng \ + --with-libcap-ng=no \ --disable-static \ - --without-python \ -%ifarch aarch64 - --with-aarch64 \ -%endif + --with-python=no \ --disable-zos-remote + +make %{?_smp_mflags} -C common make %{?_smp_mflags} -C lib make %{?_smp_mflags} -C auparse make %{?_smp_mflags} -C docs %install +%make_install -C common %make_install -C lib %make_install -C auparse %make_install -C docs @@ -134,7 +138,7 @@ %{_libdir}/libauparse.so.* %files -n audit-devel -%doc contrib/skeleton.c contrib/plugin +%doc contrib/plugin %{_libdir}/libaudit.so %{_libdir}/libauparse.so %{_includedir}/libaudit.h Index: change-default-log_group.patch =================================================================== --- change-default-log_group.patch (revision 118) +++ change-default-log_group.patch (revision 17) @@ -16,6 +16,6 @@ log_file = /var/log/audit/audit.log -log_group = root +log_group = audit - log_format = RAW + log_format = ENRICHED flush = INCREMENTAL_ASYNC freq = 50 Index: audit-3.0.2.tar.gz =================================================================== Binary file audit-3.0.2.tar.gz (revision 17) added Index: libev-werror.patch =================================================================== --- libev-werror.patch (added) +++ libev-werror.patch (revision 17) @@ -0,0 +1,26 @@ +From: Jan Engelhardt <jengelh@inai.de> +Date: 2021-06-02 16:18:03.256597842 +0200 + +Cherry-pick http://cvs.schmorp.de/libev/ev_iouring.c?view=log&r1=1.25 +to fix some terrible code. + +[ 50s] ev_iouring.c: In function 'iouring_sqe_submit': +[ 50s] ev_iouring.c:300:1: error: no return statement in function returning non-void [-Werror=return-type] + +--- + src/libev/ev_iouring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: audit-3.0.1/src/libev/ev_iouring.c +=================================================================== +--- audit-3.0.1.orig/src/libev/ev_iouring.c ++++ audit-3.0.1/src/libev/ev_iouring.c +@@ -287,7 +287,7 @@ iouring_sqe_get (EV_P) + } + + inline_size +-struct io_uring_sqe * ++void + iouring_sqe_submit (EV_P_ struct io_uring_sqe *sqe) + { + unsigned idx = sqe - EV_SQES; Index: audit-2.8.5.tar.gz =================================================================== Binary file audit-2.8.5.tar.gz (revision 118) deleted Index: audit-fno-common.patch =================================================================== --- audit-fno-common.patch (revision 118) +++ audit-fno-common.patch (deleted) @@ -1,24 +0,0 @@ -From: Tony Jones <tonyj@suse.de> -Subject: Resolve errors when compiling with -fno-common -Git-commmit: 017e6c6ab95df55f34e339d2139def83e5dada1f -References: bsc#1160384 -Upsteam: pending - -Header definitios need to be external when building with -fno-common (which -is default in GCC 10). - -Fixes: ff25054df7ed -Signed-off-by: Tony Jones <tonyj@suse.de> - ---- a/src/ausearch-common.h -+++ b/src/ausearch-common.h -@@ -50,7 +50,7 @@ extern pid_t event_pid; - extern int event_exact_match; - extern uid_t event_uid, event_euid, event_loginuid; - extern const char *event_tuid, *event_teuid, *event_tauid; --slist *event_node_list; -+extern slist *event_node_list; - extern const char *event_comm; - extern const char *event_filename; - extern const char *event_hostname; - Index: audit-python3.patch =================================================================== --- audit-python3.patch (revision 118) +++ audit-python3.patch (deleted) @@ -1,292 +0,0 @@ -From: Tomas Chvatal <tchvatal@suse.com> -Date: Wed Feb 7 09:26:35 UTC 2018 -Subject: Convert tests to run under python3 -References: https://github.com/linux-audit/audit-userspace/pull/39 -Patch-mainline: no; pending with maintainer - -Adjust auparse_test to run with python3 and python2 - -Index: audit-2.8.1/auparse/test/auparse_test.py -=================================================================== ---- audit-2.8.1.orig/auparse/test/auparse_test.py -+++ audit-2.8.1/auparse/test/auparse_test.py -@@ -1,5 +1,7 @@ - #!/usr/bin/env python - -+from __future__ import print_function -+ - import os - srcdir = os.getenv('srcdir') - -@@ -30,29 +32,29 @@ def walk_test(au): - au.reset() - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt, au.get_num_records()) -+ print("event %d has %d records" % (event_cnt, au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt += 1 -@@ -62,25 +64,25 @@ def walk_test(au): - def light_test(au): - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event has %d records" % (au.get_num_records()) -+ print("event has %d records" % (au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -- print -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) -+ print("") - record_cnt += 1 - if not au.next_record(): break - if not au.parse_next_event(): break -@@ -97,9 +99,9 @@ def simple_search(au, source, where): - au.search_add_item("auid", "=", val, auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(where) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def compound_search(au, how): - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); -@@ -115,119 +117,119 @@ def compound_search(au, how): - - au.search_set_stop(auparse.AUSEARCH_STOP_FIELD) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def feed_callback(au, cb_event_type, event_cnt): - if cb_event_type == auparse.AUPARSE_CB_EVENT_READY: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt[0], au.get_num_records()) -+ print("event %d has %d records" % (event_cnt[0], au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt[0] += 1 - - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - --print "Starting Test 1, iterate..." -+print("Starting Test 1, iterate...") - while au.parse_next_event(): - if au.find_field("auid"): -- print "%s=%s" % (au.get_field_name(), au.get_field_str()) -- print "interp auid=%s" % (au.interpret_field()) -+ print("%s=%s" % (au.get_field_name(), au.get_field_str())) -+ print("interp auid=%s" % (au.interpret_field())) - else: -- print "Error iterating to auid" --print "Test 1 Done\n" -+ print("Error iterating to auid") -+print("Test 1 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 2, walk events, records, and fields..." -+print("Starting Test 2, walk events, records, and fields...") - au.reset() - walk_test(au) --print "Test 2 Done\n" -+print("Test 2 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 3, walk events, records of 1 buffer..." -+print("Starting Test 3, walk events, records of 1 buffer...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER, buf[1]) - au.reset() - light_test(au); --print "Test 3 Done\n" -+print("Test 3 Done\n") - --print "Starting Test 4, walk events, records of 1 file..." -+print("Starting Test 4, walk events, records of 1 file...") - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); - walk_test(au); --print "Test 4 Done\n" -+print("Test 4 Done\n") - --print "Starting Test 5, walk events, records of 2 files..." -+print("Starting Test 5, walk events, records of 2 files...") - au = auparse.AuParser(auparse.AUSOURCE_FILE_ARRAY, files); - walk_test(au); --print "Test 5 Done\n" -+print("Test 5 Done\n") - --print "Starting Test 6, search..." -+print("Starting Test 6, search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - au.search_add_item("auid", "=", "500", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if au.search_next_event(): -- print "Error search found something it shouldn't have" -+ print("Error search found something it shouldn't have") - else: -- print "auid = 500 not found...which is correct" -+ print("auid = 500 not found...which is correct") - au.search_clear() - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - #au.search_add_item("auid", "exists", None, auparse.AUSEARCH_RULE_CLEAR) - au.search_add_item("auid", "exists", "", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if not au.search_next_event(): -- print "Error searching for existence of auid" --print "auid exists...which is correct" --print "Testing BUFFER_ARRAY, stop on field" -+ print("Error searching for existence of auid") -+print("auid exists...which is correct") -+print("Testing BUFFER_ARRAY, stop on field") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_FIELD) --print "Testing BUFFER_ARRAY, stop on record" -+print("Testing BUFFER_ARRAY, stop on record") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_RECORD) --print "Testing BUFFER_ARRAY, stop on event" -+print("Testing BUFFER_ARRAY, stop on event") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_EVENT) --print "Testing test.log, stop on field" -+print("Testing test.log, stop on field") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_FIELD) --print "Testing test.log, stop on record" -+print("Testing test.log, stop on record") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_RECORD) --print "Testing test.log, stop on event" -+print("Testing test.log, stop on event") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_EVENT) --print "Test 6 Done\n" -+print("Test 6 Done\n") - --print "Starting Test 7, compound search..." -+print("Starting Test 7, compound search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - compound_search(au, auparse.AUSEARCH_RULE_AND) - compound_search(au, auparse.AUSEARCH_RULE_OR) --print "Test 7 Done\n" -+print("Test 7 Done\n") - --print "Starting Test 8, regex search..." -+print("Starting Test 8, regex search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Doing regex match...\n" -+print("Doing regex match...\n") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Test 8 Done\n" -+print("Test 8 Done\n") - - # Note: this should match Test 2 exactly - # Note: this should match Test 2 exactly --print "Starting Test 9, buffer feed..." -+print("Starting Test 9, buffer feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -241,10 +243,10 @@ for s in buf: - beg += chunk_len - au.feed(data) - au.flush_feed() --print "Test 9 Done\n" -+print("Test 9 Done\n") - - # Note: this should match Test 4 exactly --print "Starting Test 10, file feed..." -+print("Starting Test 10, file feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -254,9 +256,9 @@ while True: - if not data: break - au.feed(data) - au.flush_feed() --print "Test 10 Done\n" -+print("Test 10 Done\n") - --print "Finished non-admin tests\n" -+print("Finished non-admin tests\n") - - au = None - sys.exit(0) OBS-URL: https://build.opensuse.org/request/show/900434 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=119
2021-06-16 19:16:06 +02:00
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush & reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomáš Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid & success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa & rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha & IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Remove audit-fno-common.patch: fixed in upstream
- Remove audit-python3.patch: fixed in upstream
- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=114
2020-12-09 11:00:48 +01:00
-------------------------------------------------------------------
Wed Dec 2 11:49:28 UTC 2020 - Alexander Bergmann <abergmann@suse.com>
- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)
- Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=110
2020-06-01 19:13:53 +02:00
-------------------------------------------------------------------
Mon Jun 1 17:11:49 UTC 2020 - Enzo Matsumiya <ematsumiya@suse.com>
- Fix specfile to require libauparse0 and libaudit1 after splitting
audit-libs (bsc#1172295)
- Update to version 2.6.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=108
2020-01-16 21:02:22 +01:00
-------------------------------------------------------------------
Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com>
Accepting request 900434 from home:ematsumiya:branches:security - Adjust spec files to support new version - Include one fix for libev - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream old: security/audit new: home:ematsumiya:branches:security/audit rev None Index: audit-no-gss.patch =================================================================== --- audit-no-gss.patch (revision 118) +++ audit-no-gss.patch (revision 17) @@ -11,11 +11,12 @@ --- a/init.d/auditd.conf +++ b/init.d/auditd.conf -@@ -30,7 +30,4 @@ tcp_listen_queue = 5 - tcp_max_per_addr = 1 +@@ -30,8 +30,6 @@ tcp_max_per_addr = 1 ##tcp_client_ports = 1024-65535 tcp_client_max_idle = 0 --enable_krb5 = no + transport = TCP -krb5_principal = auditd -##krb5_key_file = /etc/audit/audit.key distribute_network = no + q_depth = 400 + overflow_action = SYSLOG Index: audit-plugins-path.patch =================================================================== --- audit-plugins-path.patch (revision 118) +++ audit-plugins-path.patch (revision 17) @@ -5,19 +5,8 @@ Adjust location of plugins built by audit-secondary. These should never have been in /sbin plus some (for SUSE) require lib dependancies on /usr/lib ---- audit-1.7.2/audisp/plugins/prelude/au-prelude.conf.orig 2008-04-23 11:56:11.946681000 +0200 -+++ audit-1.7.2/audisp/plugins/prelude/au-prelude.conf 2008-04-23 11:56:22.789827000 +0200 -@@ -5,7 +5,7 @@ - - active = no - direction = out --path = /sbin/audisp-prelude -+path = /usr/sbin/audisp-prelude - type = always - #args = - format = string ---- audit-1.7.2/audisp/plugins/remote/au-remote.conf.orig 2008-04-23 11:56:11.976660000 +0200 -+++ audit-1.7.2/audisp/plugins/remote/au-remote.conf 2008-04-23 11:56:30.958657000 +0200 +--- a/audisp/plugins/remote/au-remote.conf ++++ b/audisp/plugins/remote/au-remote.conf @@ -5,7 +5,7 @@ active = no @@ -27,8 +16,8 @@ type = always #args = format = string ---- audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf.orig 2008-04-23 11:56:11.993637000 +0200 -+++ audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf 2008-04-23 11:56:40.533070000 +0200 +--- a/audisp/plugins/zos-remote/audispd-zos-remote.conf ++++ b/audisp/plugins/zos-remote/audispd-zos-remote.conf @@ -8,7 +8,7 @@ active = no @@ -36,5 +25,5 @@ -path = /sbin/audispd-zos-remote +path = /usr/sbin/audispd-zos-remote type = always - args = /etc/audisp/zos-remote.conf + args = /etc/audit/zos-remote.conf format = string Index: audit-secondary.changes =================================================================== --- audit-secondary.changes (revision 118) +++ audit-secondary.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Removes audit-fno-common.patch: fixed in upstream +- Removes audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Mon Feb 1 18:13:18 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org> - Do not explicitly provide group(audit) in system-users-audit: @@ -24,7 +149,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit-secondary.spec =================================================================== --- audit-secondary.spec (revision 118) +++ audit-secondary.spec (revision 17) @@ -22,7 +22,7 @@ # The seperation is required to minimize unnecessary build cycles. %define _name audit Name: audit-secondary -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -34,9 +34,8 @@ Patch2: audit-no-gss.patch Patch3: audit-allow-manual-stop.patch Patch4: audit-ausearch-do-not-require-tclass.patch -Patch5: audit-python3.patch -Patch6: audit-fno-common.patch -Patch7: change-default-log_group.patch +Patch5: change-default-log_group.patch +Patch6: libev-werror.patch BuildRequires: audit-devel = %{version} BuildRequires: autoconf >= 2.12 BuildRequires: gcc-c++ @@ -55,6 +54,7 @@ BuildRequires: sysuser-tools BuildRequires: tcpd-devel BuildRequires: pkgconfig(libcap-ng) +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -127,14 +127,13 @@ %patch4 -p1 %patch5 -p1 %patch6 -p1 -%patch7 -p1 %if %{without python2} && %{with python3} # Fix python env call in tests if we only have Python3. # If both versions are present, python2 bindings are preferred by the tests and # unconditionally using /usr/bin/python3 breaks the tests # Probably the correct solution is to run the tests twice if both are present. -sed -i -e 's:#!/usr/bin/env python:#!/usr/bin/python3:g' auparse/test/auparse_test.py +perl -i -lpe 's{#!/usr/bin/env python\S+}{#!/usr/bin/python3}' auparse/test/auparse_test.py %endif %build @@ -144,15 +143,18 @@ export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{_name} \ --with-apparmor \ --with-libwrap \ --with-libcap-ng=yes \ -%ifarch aarch64 - --with-aarch64 \ -%endif - --disable-static + --disable-static \ + %{?_with_python3} \ + %{?_without_python} + make %{?_smp_mflags} %sysusers_generate_pre %{SOURCE1} audit @@ -197,7 +199,7 @@ #USR-MERGE %if !0%{?usrmerged} mkdir %{buildroot}/sbin/ -for prog in auditctl auditd ausearch autrace audispd aureport augenrules; do +for prog in auditctl auditd ausearch autrace aureport augenrules; do ln -s %{_sbindir}/$prog %{buildroot}/sbin/$prog done %endif @@ -235,8 +237,7 @@ %files -n audit %license COPYING -%doc README ChangeLog rules/[0-9]* rules/README-rules init.d/auditd.cron -%attr(644,root,root) %{_mandir}/man8/audispd.8.gz +%doc README ChangeLog rules init.d/auditd.cron %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz %attr(644,root,root) %{_mandir}/man8/auditd.8.gz %attr(644,root,root) %{_mandir}/man8/aureport.8.gz @@ -247,7 +248,6 @@ %attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz %attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz -%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz %attr(644,root,root) %{_mandir}/man8/auvirt.8.gz %attr(644,root,root) %{_mandir}/man8/augenrules.8.gz @@ -256,7 +256,6 @@ /sbin/auditd /sbin/ausearch /sbin/autrace -/sbin/audispd /sbin/augenrules /sbin/aureport %endif @@ -265,29 +264,28 @@ %attr(755,root,root) %{_sbindir}/ausearch %attr(750,root,root) %{_sbindir}/autrace %attr(750,root,root) %{_sbindir}/augenrules -%attr(750,root,root) %{_sbindir}/audispd +%attr(750,root,root) %{_sbindir}/audisp-syslog %attr(755,root,root) %{_bindir}/aulast %attr(755,root,root) %{_bindir}/aulastlog %attr(755,root,root) %{_bindir}/ausyscall %attr(755,root,root) %{_sbindir}/aureport %attr(755,root,root) %{_bindir}/auvirt %dir %attr(750,root,root) %{_sysconfdir}/audit -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/af_unix.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/syslog.conf +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/af_unix.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/syslog.conf %ghost %{_sysconfdir}/auditd.conf %ghost %{_sysconfdir}/audit.rules %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/auditd.conf %dir %attr(750,root,root) %{_sysconfdir}/audit/rules.d %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/rules.d/audit.rules -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audispd.conf %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audit-stop.rules %dir %attr(750,root,audit) %{_localstatedir}/log/audit %ghost %config(noreplace) %attr(640,root,audit) %{_localstatedir}/log/audit/audit.log %dir %attr(700,root,root) %{_localstatedir}/spool/audit %{_unitdir}/auditd.service %{_sbindir}/rcauditd +%{_datadir}/audit/ %files -n system-group-audit %{_sysusersdir}/system-group-audit.conf @@ -301,23 +299,24 @@ %if %{with python3} %files -n python3-audit -%attr(755,root,root) %{python3_sitearch}/_audit.so -%attr(755,root,root) %{python3_sitearch}/auparse.so -%{python3_sitearch}/audit.py* +%defattr(-,root,root,-) +%attr(755,root,root) %{python3_sitearch}/* %endif %files -n audit-audispd-plugins %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz +%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz -%attr(750,root,root) %dir %{_sysconfdir}/audisp -%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/audispd-zos-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/zos-remote.conf +%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz +%attr(750,root,root) %dir %{_sysconfdir}/audit +%attr(750,root,root) %dir %{_sysconfdir}/audit/plugins.d +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/audispd-zos-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/zos-remote.conf %attr(750,root,root) %{_sbindir}/audisp-remote %attr(750,root,root) %{_sbindir}/audispd-zos-remote -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audisp-remote.conf -%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/au-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audisp-remote.conf +%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/plugins.d/au-remote.conf %changelog Index: audit.changes =================================================================== --- audit.changes (revision 118) +++ audit.changes (revision 17) @@ -1,4 +1,129 @@ ------------------------------------------------------------------- +Mon Jun 14 20:54:49 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com> + +- Update to version 3.0.2 +- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) +- Optionally interpret auid in auditctl -l +- Update some syscall argument interpretations +- In auditd, do not allow spaces in the hostname name format +- Big documentation cleanup (MIZUTA Takeshi) +- Update syscall table to the 5.12 kernel +- Update the auparse normalizer for new event types +- Fix compiler warnings in ids subsystem +- Block a couple signals from flush & reconfigure threads +- In auditd, don't wait on flush thread when exiting +- Output error message if the path of input files are too long ausearch/report + +Included fixes from 3.0.1 +- Update syscall table to the 5.11 kernel +- Add new --eoe-timeout option to ausearch and aureport (Burn Alting) +- Only enable periodic timers when listening on the network +- Upgrade libev to 4.33 +- Add auparse_new_buffer function to auparse library +- Use the select libev backend unless aggregating events +- Add sudoers to some base audit rules +- Update the auparse normalizer for some new syscalls and event types + +Included fixes from 3.0 +- Generate checkpoint file even when no results are returned (Burn Alting) +- Fix log file creation when file logging is disabled entirely (Vlad Glagolev) +- Convert auparse_test to run with python3 (Tomáš Chvátal) +- Drop support for prelude +- Adjust backlog_wait_time in rules to the kernel default (#1482848) +- Remove ids key syntax checking of rules in auditctl +- Use SIGCONT to dump auditd internal state (#1504251) +- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) +- Fix parsing of uid & success for ausearch +- Add support for not equal operator in audit by executable (Ondrej Mosnacek) +- Hide lru symbols in auparse +- Add systemd process protections +- Fix aureport summary time range reporting +- Allow unlimited retries on startup for remote logging +- Add queue_depth to remote logging stats and increase default queue_depth size +- Fix segfault on shutdown +- Merge auditd and audispd code +- Close on execute init_pipe fd (#1587995) +- Breakout audisp syslog plugin to be standalone program +- Create a common internal library to reduce code +- Move all audispd config files under /etc/audit/ +- Move audispd.conf settings into auditd.conf +- Add queue depth statistics to internal state dump report +- Add network statistics to internal state dump report +- SIGUSR now also restarts queue processing if its suspended +- Update lookup tables for the 4.18 kernel +- Add auparse_normalizer support for SOFTWARE_UPDATE event +- Add 30-ospp-v42.rules to meet new Common Criteria requirements +- Deprecate enable_krb and replace with transport config opt for remote logging +- Mark netlabel events as simple events so that get processed quicker +- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) +- In aureport, fix segfault in file report +- Add auparse_normalizer support for labeled networking events +- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) +- In ausearch/auparse, event aging is off by a second +- In ausearch/auparse, correct event ordering to process oldest first +- Migrate auparse python test to python3 +- auparse_reset was not clearing everything it should +- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events +- In ausearch/report, lightly parse selinux portion of USER_AVC events +- Add bpf syscall command argument interpretation to auparse +- In ausearch/report, limit record size when malformed +- Port af_unix plugin to libev +- In auditd, fix extract_type function for network originating events +- In auditd, calculate right size and location for network originating events +- Make legacy script wait for auditd to terminate (#1643567) +- Treat all network originating events as VER2 so dispatcher doesn't format it +- If an event has a node name make it VER2 so dispatcher doesnt format it +- In audisp-remote do an initial connection attempt (#1625156) +- In auditd, allow expression of space left as a percentage (#1650670) +- On PPC64LE systems, only allow 64 bit rules (#1462178) +- Make some parts of auditd state report optional based on config +- Update to libev-4.25 +- Fix ausearch when checkpointing a single file (Burn Alting) +- Fix scripting in 31-privileged.rules wrt filecap (#1662516) +- In ausearch, do not checkpt if stdin is input source +- In libev, remove __cold__ attribute for functions to allow proper hardening +- Add tests to configure.ac for openldap support +- Make systemd support files use /run rather than /var/run (Christian Hesse) +- Fix minor memory leak in auditd kerberos credentials code +- Allow exclude and user filter by executable name (Ondrej Mosnacek) +- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test +- In ausearch/report fix --end to use midnight time instead of now (#1671338) +- Add substitue functions for strndupa & rawmemchr +- Fix memleak in auparse caused by corrected event ordering +- Fix legacy reload script to reload audit rules when daemon is reloaded +- Support for unescaping in trusted messages (Dmitry Voronin) +- In auditd, use standard template for DEAMON events (Richard Guy Briggs) +- In aureport, fix segfault for malformed USER_CMD events +- Add exe field to audit_log_user_command in libaudit +- In auditctl support filter on socket address families (Richard Guy Briggs) +- Deprecate support for Alpha & IA64 processors +- If space_left_action is rotate, allow it every time (#1718444) +- In auparse, drop standalone EOE events +- Add milliseconds column for ausearch extra time csv format +- Fix aureport first event reporting when no start given +- In audisp-remote, add new config item for startup connection errors +- Remove dependency on chkconfig +- Install rules to /usr/share/audit/sample-rules/ +- Split up ospp rules to make SCAP scanning easier (#1746018) +- In audisp-syslog, support interpreting records (#1497279) +- Audit USER events now sends msg as name value pair +- Add support for AUDIT_BPF event +- Auditd should not process AUDIT_REPLACE events +- Update syscall tables to the 5.5 kernel +- Improve personality interpretation by using PERS_MASK +- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup +- Change auparse python bindings to shared object (Issue #121) +- Add error messages for watch permissions +- If audit rules file doesn't exist log error message instead of info message +- Revise error message for unmatched options in auditctl +- In audisp-remote, fixup remote endpoint disappearin in ascii format +- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) +- In auditctl, add support for sending a signal to auditd + +- Remove audit-fno-common.patch: fixed in upstream +- Remove audit-python3.patch: fixed in upstream + +------------------------------------------------------------------- Wed Dec 2 11:49:28 UTC 2020 - Alexander Bergmann <abergmann@suse.com> - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) @@ -12,7 +137,7 @@ ------------------------------------------------------------------- Mon Jan 13 17:39:03 UTC 2020 - Tony Jones <tonyj@suse.com> -- Update to version 2.6.5: +- Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed Index: audit.spec =================================================================== --- audit.spec (revision 118) +++ audit.spec (revision 17) @@ -17,7 +17,7 @@ Name: audit -Version: 2.8.5 +Version: 3.0.2 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -35,6 +35,7 @@ BuildRequires: tcpd-devel Requires: libaudit1 = %{version} Requires: libauparse0 = %{version} +Provides: bundled(libev) = 4.33 %description The audit package contains the user space utilities for storing and @@ -79,27 +80,30 @@ %build autoreconf -fi +cp INSTALL.tmp INSTALl export CFLAGS="%{optflags} -fno-strict-aliasing" export CXXFLAGS="$CFLAGS" export LDFLAGS="-Wl,-z,relro,-z,now" # no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch %configure \ +%ifarch aarch64 + --with-aarch64 \ +%endif --enable-systemd \ --libexecdir=%{_libexecdir}/%{name} \ --with-apparmor \ - --with-libwrap \ - --without-libcap-ng \ + --with-libcap-ng=no \ --disable-static \ - --without-python \ -%ifarch aarch64 - --with-aarch64 \ -%endif + --with-python=no \ --disable-zos-remote + +make %{?_smp_mflags} -C common make %{?_smp_mflags} -C lib make %{?_smp_mflags} -C auparse make %{?_smp_mflags} -C docs %install +%make_install -C common %make_install -C lib %make_install -C auparse %make_install -C docs @@ -134,7 +138,7 @@ %{_libdir}/libauparse.so.* %files -n audit-devel -%doc contrib/skeleton.c contrib/plugin +%doc contrib/plugin %{_libdir}/libaudit.so %{_libdir}/libauparse.so %{_includedir}/libaudit.h Index: change-default-log_group.patch =================================================================== --- change-default-log_group.patch (revision 118) +++ change-default-log_group.patch (revision 17) @@ -16,6 +16,6 @@ log_file = /var/log/audit/audit.log -log_group = root +log_group = audit - log_format = RAW + log_format = ENRICHED flush = INCREMENTAL_ASYNC freq = 50 Index: audit-3.0.2.tar.gz =================================================================== Binary file audit-3.0.2.tar.gz (revision 17) added Index: libev-werror.patch =================================================================== --- libev-werror.patch (added) +++ libev-werror.patch (revision 17) @@ -0,0 +1,26 @@ +From: Jan Engelhardt <jengelh@inai.de> +Date: 2021-06-02 16:18:03.256597842 +0200 + +Cherry-pick http://cvs.schmorp.de/libev/ev_iouring.c?view=log&r1=1.25 +to fix some terrible code. + +[ 50s] ev_iouring.c: In function 'iouring_sqe_submit': +[ 50s] ev_iouring.c:300:1: error: no return statement in function returning non-void [-Werror=return-type] + +--- + src/libev/ev_iouring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: audit-3.0.1/src/libev/ev_iouring.c +=================================================================== +--- audit-3.0.1.orig/src/libev/ev_iouring.c ++++ audit-3.0.1/src/libev/ev_iouring.c +@@ -287,7 +287,7 @@ iouring_sqe_get (EV_P) + } + + inline_size +-struct io_uring_sqe * ++void + iouring_sqe_submit (EV_P_ struct io_uring_sqe *sqe) + { + unsigned idx = sqe - EV_SQES; Index: audit-2.8.5.tar.gz =================================================================== Binary file audit-2.8.5.tar.gz (revision 118) deleted Index: audit-fno-common.patch =================================================================== --- audit-fno-common.patch (revision 118) +++ audit-fno-common.patch (deleted) @@ -1,24 +0,0 @@ -From: Tony Jones <tonyj@suse.de> -Subject: Resolve errors when compiling with -fno-common -Git-commmit: 017e6c6ab95df55f34e339d2139def83e5dada1f -References: bsc#1160384 -Upsteam: pending - -Header definitios need to be external when building with -fno-common (which -is default in GCC 10). - -Fixes: ff25054df7ed -Signed-off-by: Tony Jones <tonyj@suse.de> - ---- a/src/ausearch-common.h -+++ b/src/ausearch-common.h -@@ -50,7 +50,7 @@ extern pid_t event_pid; - extern int event_exact_match; - extern uid_t event_uid, event_euid, event_loginuid; - extern const char *event_tuid, *event_teuid, *event_tauid; --slist *event_node_list; -+extern slist *event_node_list; - extern const char *event_comm; - extern const char *event_filename; - extern const char *event_hostname; - Index: audit-python3.patch =================================================================== --- audit-python3.patch (revision 118) +++ audit-python3.patch (deleted) @@ -1,292 +0,0 @@ -From: Tomas Chvatal <tchvatal@suse.com> -Date: Wed Feb 7 09:26:35 UTC 2018 -Subject: Convert tests to run under python3 -References: https://github.com/linux-audit/audit-userspace/pull/39 -Patch-mainline: no; pending with maintainer - -Adjust auparse_test to run with python3 and python2 - -Index: audit-2.8.1/auparse/test/auparse_test.py -=================================================================== ---- audit-2.8.1.orig/auparse/test/auparse_test.py -+++ audit-2.8.1/auparse/test/auparse_test.py -@@ -1,5 +1,7 @@ - #!/usr/bin/env python - -+from __future__ import print_function -+ - import os - srcdir = os.getenv('srcdir') - -@@ -30,29 +32,29 @@ def walk_test(au): - au.reset() - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt, au.get_num_records()) -+ print("event %d has %d records" % (event_cnt, au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt += 1 -@@ -62,25 +64,25 @@ def walk_test(au): - def light_test(au): - while True: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event has %d records" % (au.get_num_records()) -+ print("event has %d records" % (au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -- print -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) -+ print("") - record_cnt += 1 - if not au.next_record(): break - if not au.parse_next_event(): break -@@ -97,9 +99,9 @@ def simple_search(au, source, where): - au.search_add_item("auid", "=", val, auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(where) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def compound_search(au, how): - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); -@@ -115,119 +117,119 @@ def compound_search(au, how): - - au.search_set_stop(auparse.AUSEARCH_STOP_FIELD) - if not au.search_next_event(): -- print "Error searching for auid" -+ print("Error searching for auid") - else: -- print "Found %s = %s" % (au.get_field_name(), au.get_field_str()) -+ print("Found %s = %s" % (au.get_field_name(), au.get_field_str())) - - def feed_callback(au, cb_event_type, event_cnt): - if cb_event_type == auparse.AUPARSE_CB_EVENT_READY: - if not au.first_record(): -- print "Error getting first record" -+ print("Error getting first record") - sys.exit(1) - -- print "event %d has %d records" % (event_cnt[0], au.get_num_records()) -+ print("event %d has %d records" % (event_cnt[0], au.get_num_records())) - - record_cnt = 1 - while True: -- print " record %d of type %d(%s) has %d fields" % \ -+ print(" record %d of type %d(%s) has %d fields" % \ - (record_cnt, - au.get_type(), audit.audit_msg_type_to_name(au.get_type()), -- au.get_num_fields()) -- print " line=%d file=%s" % (au.get_line_number(), au.get_filename()) -+ au.get_num_fields())) -+ print(" line=%d file=%s" % (au.get_line_number(), au.get_filename())) - event = au.get_timestamp() - if event is None: -- print "Error getting timestamp - aborting" -+ print("Error getting timestamp - aborting") - sys.exit(1) - -- print " event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)) -+ print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host))) - au.first_field() - while True: -- print " %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field()) -+ print(" %s=%s (%s)" % (au.get_field_name(), au.get_field_str(), au.interpret_field())) - if not au.next_field(): break -- print -+ print("") - record_cnt += 1 - if not au.next_record(): break - event_cnt[0] += 1 - - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - --print "Starting Test 1, iterate..." -+print("Starting Test 1, iterate...") - while au.parse_next_event(): - if au.find_field("auid"): -- print "%s=%s" % (au.get_field_name(), au.get_field_str()) -- print "interp auid=%s" % (au.interpret_field()) -+ print("%s=%s" % (au.get_field_name(), au.get_field_str())) -+ print("interp auid=%s" % (au.interpret_field())) - else: -- print "Error iterating to auid" --print "Test 1 Done\n" -+ print("Error iterating to auid") -+print("Test 1 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 2, walk events, records, and fields..." -+print("Starting Test 2, walk events, records, and fields...") - au.reset() - walk_test(au) --print "Test 2 Done\n" -+print("Test 2 Done\n") - - # Reset, now lets go to beginning and walk the list manually */ --print "Starting Test 3, walk events, records of 1 buffer..." -+print("Starting Test 3, walk events, records of 1 buffer...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER, buf[1]) - au.reset() - light_test(au); --print "Test 3 Done\n" -+print("Test 3 Done\n") - --print "Starting Test 4, walk events, records of 1 file..." -+print("Starting Test 4, walk events, records of 1 file...") - au = auparse.AuParser(auparse.AUSOURCE_FILE, srcdir + "/test.log"); - walk_test(au); --print "Test 4 Done\n" -+print("Test 4 Done\n") - --print "Starting Test 5, walk events, records of 2 files..." -+print("Starting Test 5, walk events, records of 2 files...") - au = auparse.AuParser(auparse.AUSOURCE_FILE_ARRAY, files); - walk_test(au); --print "Test 5 Done\n" -+print("Test 5 Done\n") - --print "Starting Test 6, search..." -+print("Starting Test 6, search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - au.search_add_item("auid", "=", "500", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if au.search_next_event(): -- print "Error search found something it shouldn't have" -+ print("Error search found something it shouldn't have") - else: -- print "auid = 500 not found...which is correct" -+ print("auid = 500 not found...which is correct") - au.search_clear() - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - #au.search_add_item("auid", "exists", None, auparse.AUSEARCH_RULE_CLEAR) - au.search_add_item("auid", "exists", "", auparse.AUSEARCH_RULE_CLEAR) - au.search_set_stop(auparse.AUSEARCH_STOP_EVENT) - if not au.search_next_event(): -- print "Error searching for existence of auid" --print "auid exists...which is correct" --print "Testing BUFFER_ARRAY, stop on field" -+ print("Error searching for existence of auid") -+print("auid exists...which is correct") -+print("Testing BUFFER_ARRAY, stop on field") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_FIELD) --print "Testing BUFFER_ARRAY, stop on record" -+print("Testing BUFFER_ARRAY, stop on record") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_RECORD) --print "Testing BUFFER_ARRAY, stop on event" -+print("Testing BUFFER_ARRAY, stop on event") - simple_search(au, auparse.AUSOURCE_BUFFER_ARRAY, auparse.AUSEARCH_STOP_EVENT) --print "Testing test.log, stop on field" -+print("Testing test.log, stop on field") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_FIELD) --print "Testing test.log, stop on record" -+print("Testing test.log, stop on record") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_RECORD) --print "Testing test.log, stop on event" -+print("Testing test.log, stop on event") - simple_search(au, auparse.AUSOURCE_FILE, auparse.AUSEARCH_STOP_EVENT) --print "Test 6 Done\n" -+print("Test 6 Done\n") - --print "Starting Test 7, compound search..." -+print("Starting Test 7, compound search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) - compound_search(au, auparse.AUSEARCH_RULE_AND) - compound_search(au, auparse.AUSEARCH_RULE_OR) --print "Test 7 Done\n" -+print("Test 7 Done\n") - --print "Starting Test 8, regex search..." -+print("Starting Test 8, regex search...") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Doing regex match...\n" -+print("Doing regex match...\n") - au = auparse.AuParser(auparse.AUSOURCE_BUFFER_ARRAY, buf) --print "Test 8 Done\n" -+print("Test 8 Done\n") - - # Note: this should match Test 2 exactly - # Note: this should match Test 2 exactly --print "Starting Test 9, buffer feed..." -+print("Starting Test 9, buffer feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -241,10 +243,10 @@ for s in buf: - beg += chunk_len - au.feed(data) - au.flush_feed() --print "Test 9 Done\n" -+print("Test 9 Done\n") - - # Note: this should match Test 4 exactly --print "Starting Test 10, file feed..." -+print("Starting Test 10, file feed...") - au = auparse.AuParser(auparse.AUSOURCE_FEED); - event_cnt = 1 - au.add_callback(feed_callback, [event_cnt]) -@@ -254,9 +256,9 @@ while True: - if not data: break - au.feed(data) - au.flush_feed() --print "Test 10 Done\n" -+print("Test 10 Done\n") - --print "Finished non-admin tests\n" -+print("Finished non-admin tests\n") - - au = None - sys.exit(0) OBS-URL: https://build.opensuse.org/request/show/900434 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=119
2021-06-16 19:16:06 +02:00
- Update to version 2.8.5:
- Update to version 2.6.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=108
2020-01-16 21:02:22 +01:00
* Fix segfault on shutdown
* Fix hang on startup (#1587995)
* Add sleep to script to dump state so file is ready when needed
* Add auparse_normalizer support for SOFTWARE_UPDATE event
* Mark netlabel events as simple events so that get processed quicker
* When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
* Add 30-ospp-v42.rules to meet new Common Criteria requirements
* Update lookup tables for the 4.18 kernel
* In aureport, fix segfault in file report
* Add auparse_normalizer support for labeled networking events
* Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
* Event aging is off by a second
* In ausearch/auparse, correct event ordering to process oldest first
* auparse_reset was not clearing everything it should
* Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
* In ausearch/report, lightly parse selinux portion of USER_AVC events
* In ausearch/report, limit record size when malformed
* In auditd, fix extract_type function for network originating events
* In auditd, calculate right size and location for network originating events
* Treat all network originating events as VER2 so dispatcher doesn't format it
* In audisp-remote do an initial connection attempt (#1625156)
* In auditd, allow expression of space left as a percentage (#1650670)
* On PPC64LE systems, only allow 64 bit rules (#1462178)
* Make some parts of auditd state report optional based on config
* Fix ausearch when checkpointing a single file (Burn Alting)
* Fix scripting in 31-privileged.rules wrt filecap (#1662516)
* In ausearch, do not checkpt if stdin is input source
* In libev, remove __cold__ attribute for functions to allow proper hardening
* Add tests to configure.ac for openldap support
* Make systemd support files use /run rather than /var/run (Christian Hesse)
* Fix minor memory leak in auditd kerberos credentials code
* Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
* In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Remote zos building is now a configurable option.
It should be disabled in audit (and left enabled in audit-secondary).
Accepting request 687275 from home:jengelh:sct - Reduce scriptlets' hard dependency on systemd. - Make use of some %make_install. OBS-URL: https://build.opensuse.org/request/show/687275 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=104
2019-06-08 18:58:52 +02:00
-------------------------------------------------------------------
Thu Mar 21 10:33:03 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
- Make use of some %make_install.
Accepting request 618655 from home:1Antoine1:branches:security - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). OBS-URL: https://build.opensuse.org/request/show/618655 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=102
2018-06-28 03:17:18 +02:00
-------------------------------------------------------------------
Sat Jun 23 08:16:07 UTC 2018 - antoine.belvire@opensuse.org
- Update to version 2.8.4:
* Generate checkpoint file even when not results are returned
(Burn Alting).
* Fix log file creation when file logging is disabled entirely
(Vlad Glagolev).
* Use SIGCONT to dump auditd internal state (rh#1504251).
* Fix parsing of virtual timestamp fields in ausearch_expression
(rh#1515903).
* Fix parsing of uid & success for ausearch.
* Hide lru symbols in auparse.
* Fix aureport summary time range reporting.
* Allow unlimited retries on startup for remote logging.
* Add queue_depth to remote logging stats and increase default
queue_depth size.
-------------------------------------------------------------------
Sun Jun 17 10:48:40 UTC 2018 - antoine.belvire@opensuse.org
- Update to version 2.8.3:
* Correct msg function name in lru debug code.
* Fix a segfault in auditd when dns resolution isn't available.
* Make a reload legacy service for auditd.
* In auparse python bindings, expose some new types that were
missing.
* In normalizer, pickup subject kind for user_login events.
* Fix interpretation of unknown ioctcmds (rh#1540507).
* Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, &
RESP_ORIGIN_BLOCK_TIMED events.
* In auparse_normalize for USER_LOGIN events, map acct for
subj_kind.
* Fix logging of IPv6 addresses in DAEMON_ACCEPT events
(rh#1534748).
* Do not rotate auditd logs when num_logs < 2 (brozs).
Accepting request 588034 from home:jones_tony:branches:security - Change openldap dependency to client only (bsc#1085003) - Resolve issue with previous change if both Python2 and Python3 are present, tests were failing as python2 bindings are preferred in this case. - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES OBS-URL: https://build.opensuse.org/request/show/588034 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=99
2018-03-17 00:10:56 +01:00
-------------------------------------------------------------------
Fri Mar 16 19:41:29 UTC 2018 - tonyj@suse.com
- Update header in audit-python3.patch
- Update patch guidelines in README-BEFORE-ADDING-PATCHES
Accepting request 580988 from openSUSE:Factory:Staging:O - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname OBS-URL: https://build.opensuse.org/request/show/580988 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=98
2018-03-01 22:24:42 +01:00
-------------------------------------------------------------------
Wed Feb 7 09:26:35 UTC 2018 - tchvatal@suse.com
- Add patch to fix test run without python2 interpreter:
* audit-python3.patch
- Update to 2.8.2 release:
* Update tables for 4.14 kernel
* Fixup ipv6 server side binding
* AVC report from aureport was missing result column header (#1511606)
* Add SOFTWARE_UPDATE event
* In ausearch/report pickup any path and new-disk fields as a file
* Fix value returned by auditctl --reset-lost (Richard Guy Briggs)
* In auparse, fix expr_create_timestamp_comparison_ex to be numeric field
* Fix building on old systems without linux/fanotify.h
* Fix shell portability issues reported by shellcheck
* Auditd validate_email should not use gethostbyname
Accepting request 539420 from home:avindra - Update to version 2.8.1. See audit.spec (libaudit1) for upstream changelog - Remove audit-implicit-writev.patch (fixed upstream across 2 commits) * 3b30db20ad983274989ce9a522120c3c225436b3 * 07132c22314e9abbe64d1031fd8734243285bb3f - Cleanup with spec-cleaner - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog OBS-URL: https://build.opensuse.org/request/show/539420 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=91
2017-11-09 14:54:55 +01:00
-------------------------------------------------------------------
Sat Nov 4 21:12:09 UTC 2017 - aavindraa@gmail.com
- Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes)
* many features added to auparse_normalize
* cli option added to auditd and audispd for setting config dir
* in auditd, restore the umask after creating a log file
* option added to auditd for skipping email verification
- Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog
Accepting request 512289 from home:jengelh:branches:security - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. OBS-URL: https://build.opensuse.org/request/show/512289 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=87
2017-08-03 10:14:13 +02:00
-------------------------------------------------------------------
Mon Jul 24 13:59:06 UTC 2017 - jengelh@inai.de
- Rectify RPM groups, diversify descriptions.
- Remove mentions of static libraries because they are not built.
Accepting request 383289 from home:scarabeus_iv:branches:security - Create folder for the m4 file from previous commit to avoid install failure OBS-URL: https://build.opensuse.org/request/show/383289 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=83
2016-04-04 11:18:16 +02:00
-------------------------------------------------------------------
Accepting request 511710 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/511710 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=85
2017-07-20 22:07:48 +02:00
Tue Jul 18 18:32:56 UTC 2017 - tonyj@suse.com
- Update to version 2.7.7 release
Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog
-------------------------------------------------------------------
Accepting request 383289 from home:scarabeus_iv:branches:security - Create folder for the m4 file from previous commit to avoid install failure OBS-URL: https://build.opensuse.org/request/show/383289 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=83
2016-04-04 11:18:16 +02:00
Sat Apr 2 18:14:51 UTC 2016 - tchvatal@suse.com
- Create folder for the m4 file from previous commit to avoid install
failure
Accepting request 382986 from home:scarabeus_iv:branches:security - Version update to 2.5. See audit.spec (libaudit1) for upstream changelog - Cleanup with spec-cleaner - Sort out bit /sbin /usr/sbin/ installation - Install the rules as documentation - Remove needless %py_requires from python subpkgs - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use -C parameter of make - Install m4 file to the devel package OBS-URL: https://build.opensuse.org/request/show/382986 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=82
2016-04-01 18:36:15 +02:00
-------------------------------------------------------------------
Fri Apr 1 14:15:58 UTC 2016 - tchvatal@suse.com
- Version update to 2.5 release
- Refresh two patches and README to contain SUSE and not SuSE
* audit-allow-manual-stop.patch
* audit-plugins-path.patch
- Cleanup with spec-cleaner and do not use subshells but rather use
-C parameter of make
- Install m4 file to the devel package
Accepting request 347165 from home:posophe:branches:security little fix OBS-URL: https://build.opensuse.org/request/show/347165 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=80
2015-12-03 15:45:33 +01:00
-------------------------------------------------------------------
Wed Dec 2 12:14:38 UTC 2015 - p.drouand@gmail.com
- Do not depend on insserv nor fillup; the package provides
neither sysconfig nor sysvinit files
- Update to version 2.4.1 Changelog 2.4.1 - Make python3 support easier - Add support for ppc64le (Tony Jones) - Add some translations for a1 of ioctl system calls - Add command & virtualization reports to aureport - Update aureport config report for new events - Add account modification summary report to aureport - Add GRP_MGMT and GRP_CHAUTHTOK event types - Correct aureport account change reports - Add integrity event report to aureport - Add config change summary report to aureport - Adjust some syslogging level settings in audispd - Improve parsing performance in everything - When ausearch outputs a line, use the previously parsed values (Burn Alting) - Improve searching and interpreting groups in events - Fully interpret the proctitle field in auparse - Correct libaudit and auditctl support for kernel features - Add support for backlog_time_wait setting via auditctl - Update syscall tables for the 3.18 kernel - Ignore DNS failure for email validation in auditd (#1138674) - Allow rotate as action for space_left and disk_full in auditd.conf - Correct login summary report of aureport - Auditctl syscalls can be comma separated list now - Update rules for new subsystems and capabilities - Drop patch audit-add-ppc64le-mach-support.patch (already upstream) OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=74
2014-11-26 17:13:05 +01:00
-------------------------------------------------------------------
Accepting request 329223 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/329223 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=78
2015-09-05 00:09:27 +02:00
Fri Aug 21 18:58:18 UTC 2015 - tonyj@suse.com
- Update to version 2.4.4 (bsc#941922, CVE-2015-5186)
- Remove patch 'audit-no_m4_dir.patch'
(added Fri Apr 26 11:14:39 UTC 2013 by mmeister@suse.com)
No idea what earlier 'automake' build error this was trying to fix but
it broke the handling of "--without-libcap-ng". Anyways, no build error
occurs now and m4 path is also needed in v2.4.4 to find ax_prog_cc_for_build
- Require pkgconfig for build
Changelog 2.4.4
- Fix linked list correctness in ausearch/report
- Add more cross compile fixups (Clayton Shotwell)
- Update auparse python bindings
- Update libev to 4.20
- Fix CVE-2015-5186 Audit: log terminal emulator escape sequences handling
Changelog 2.4.3
- Add python3 support for libaudit
- Cleanup automake warnings
- Add AuParser_search_add_timestamp_item_ex to python bindings
- Add AuParser_get_type_name to python bindings
- Correct processing of obj_gid in auditctl (Aleksander Zdyb)
- Make plugin config file parsing more robust for long lines (#1235457)
- Make auditctl status print lost field as unsigned number
- Add interpretation mode for auditctl -s
- Add python3 support to auparse library
- Make --enable-zos-remote a build time configuration option (Clayton Shotwell)
- Updates for cross compiling (Clayton Shotwell)
- Add MAC_CHECK audit event type
- Add libauparse pkgconfig file (Aleksander Zdyb)
Changelog 2.4.2
- Ausearch should parse exe field in SECCOMP events
- Improve output for short mode interpretations in auparse
- Add CRYPTO_IKE_SA and CRYPTO_IPSEC_SA events
- If auditctl is reading rules from a file, send messages to syslog (#1144252)
- Correct lookup of ppc64le when determining machine type
- Increase time buffer for wide character numbers in ausearch/report (#1200314)
- In aureport, add USER_TTY events to tty report
- In audispd, limit reporting of queue full messages (#1203810)
- In auditctl, don't segfault when invalid options passed (#1206516)
- In autrace, remove some older unimplemented syscalls for aarch64 (#1185892)
- In auditctl, correct lookup of aarch64 in arch field (#1186313)
- Update lookup tables for 4.1 kernel
-------------------------------------------------------------------
- Update to version 2.4.1 Changelog 2.4.1 - Make python3 support easier - Add support for ppc64le (Tony Jones) - Add some translations for a1 of ioctl system calls - Add command & virtualization reports to aureport - Update aureport config report for new events - Add account modification summary report to aureport - Add GRP_MGMT and GRP_CHAUTHTOK event types - Correct aureport account change reports - Add integrity event report to aureport - Add config change summary report to aureport - Adjust some syslogging level settings in audispd - Improve parsing performance in everything - When ausearch outputs a line, use the previously parsed values (Burn Alting) - Improve searching and interpreting groups in events - Fully interpret the proctitle field in auparse - Correct libaudit and auditctl support for kernel features - Add support for backlog_time_wait setting via auditctl - Update syscall tables for the 3.18 kernel - Ignore DNS failure for email validation in auditd (#1138674) - Allow rotate as action for space_left and disk_full in auditd.conf - Correct login summary report of aureport - Auditctl syscalls can be comma separated list now - Update rules for new subsystems and capabilities - Drop patch audit-add-ppc64le-mach-support.patch (already upstream) OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=74
2014-11-26 17:13:05 +01:00
Mon Nov 24 14:55:22 UTC 2014 - mq@suse.cz
- Update to version 2.4.1
Changelog 2.4.1
- Make python3 support easier
- Add support for ppc64le (Tony Jones)
- Add some translations for a1 of ioctl system calls
- Add command & virtualization reports to aureport
- Update aureport config report for new events
- Add account modification summary report to aureport
- Add GRP_MGMT and GRP_CHAUTHTOK event types
- Correct aureport account change reports
- Add integrity event report to aureport
- Add config change summary report to aureport
- Adjust some syslogging level settings in audispd
- Improve parsing performance in everything
- When ausearch outputs a line, use the previously parsed values (Burn Alting)
- Improve searching and interpreting groups in events
- Fully interpret the proctitle field in auparse
- Correct libaudit and auditctl support for kernel features
- Add support for backlog_time_wait setting via auditctl
- Update syscall tables for the 3.18 kernel
- Ignore DNS failure for email validation in auditd (#1138674)
- Allow rotate as action for space_left and disk_full in auditd.conf
- Correct login summary report of aureport
- Auditctl syscalls can be comma separated list now
- Update rules for new subsystems and capabilities
- Drop patch audit-add-ppc64le-mach-support.patch (already upstream)
Accepting request 247315 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/247315 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=72
2014-09-03 01:07:21 +02:00
-------------------------------------------------------------------
Tue Sep 2 17:33:11 UTC 2014 - tonyj@suse.com
- Update to version 2.4
Changelog 2.4
- Optionally parse loginuids, (e)uids, & (e)gids in ausearch/report
- In auvirt, anomaly events don't have uuid (#1111448)
- Fix category handling in various records (#1120286)
- Fix ausearch handling of session id on 32 bit systems
- Set systemd startup to wait until systemd-tmpfiles-setup.service (#1097314)
- Interpret a0 of socketcall and ipccall syscalls
- Add pkgconfig file for libaudit
- Add go language bindings for limited use of libaudit
- Fix ausearch handling of exit code on 32 bit systems
- Fix bug in aureport string linked list handling
- Document week-ago time setting in ausearch/report man page
- Update tables for 3.16 kernel
- In aulast, on bad logins only record user_login proof and use it
- Add libaudit API for kernel features
- If audit=0 on kernel cmnd line, skip systemd activation (Cristian Rodríguez)
- Add checkpoint --start option to ausearch (Burn Alting)
- Fix arch matching in ausearch
- Add --loginuid-immutable option to auditctl
- Fix memory leak in auditd when log_format is set to NOLOG
- Update auditctl to display features in the status command
- Add ausearch_add_timestamp_item_ex() to auparse
Changelog 2.3.7
- Limit number of options in a rule in libaudit
- Auditctl cannot load rule with lots of syscalls (#1089713)
- In ausearch, fix checkpointing when inode is reused by new log (Burn Alting)
- Add PROCTITLE and FEATURE_CHANGE event types
-------------------------------------------------------------------
Tue Sep 2 17:33:11 UTC 2014 - tonyj@suse.com
- Add support for ppc64le (bnc#891861)
New patch: audit-add-ppc64le-mach-support.patch
Accepting request 230410 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/230410 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=66
2014-04-17 00:35:54 +02:00
-------------------------------------------------------------------
Tue Apr 15 00:50:50 UTC 2014 - tonyj@suse.com
- Update to version 2.3.6
Changelog 2.3.6
- Add an option to auditctl to interpret a0 - a3 of syscall rules when listing
- Improve ARM and AARCH64 support (AKASHI Takahiro)
- Add ausearch --checkpoint feature (Burn Alting)
- Add --arch option to ausearch
- Improve too long config line in audispd, auditd, and auparse (#1071580)
- Fix aulast to accept the new AUDIT_LOGIN record format
- Remove clear_config symbol in auparse
Changelog 2.3.5
- In CRYPTO_KEY_USER events, do not interpret the 'fp' field
- Change formatting of rules listing in auditctl to look like audit.rules
- Change auditctl to do all netlink comm and then print rules
- Add a debug option to ausearch to find skipped events
- Parse subject, auid, and ses in LOGIN events (3.14 kernel changed format)
- In auditd, when shifting logs, ignore the num_logs setting (#950158)
- Allow passing a directory as the input file for ausearch/report (LC Bruzenak)
- Interpret syscall fields in SECCOMP events
- Increase a couple buffers to handle longer input
Changelog 2.3.4
- Parse path in CONFIG_CHANGE events
- In audisp-remote, fix retry logic for temporary network failures
- In auparse, add get_type_name function
- Add --no-config command option to aureport
- Fix interpretting MCS seliunx contexts in ausearch (#970675)
- In auparse, classify selinux contexts as MAC_LABEL field type
- In ausearch/report parse vm-ctx and img-ctx as selinux labels
- Update translation tables for the 3.14 kernel
Accepting request 221023 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/221023 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=60
2014-02-05 17:51:31 +01:00
-------------------------------------------------------------------
Tue Feb 4 00:05:38 UTC 2014 - tonyj@suse.com
- Update to version 2.3.3
Changelog 2.3.3
- Documentation updates
- Add AUDIT_USER_MAC_CONFIG_CHANGE event for MAC policy changes
- Update interpreting scheduler policy names
- Update automake files to automake-1.13.4
- Remove CAP_COMPROMISE_KERNEL interpretation
- Parse name field in AVC's (#1049916)
- Add missing typedef for auparse_type_t enumeration (#1053424)
- Fix parsing encoded filenames in records
- Parse SECCOMP events
Accepting request 209349 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/209349 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=57
2013-12-03 23:28:29 +01:00
-------------------------------------------------------------------
Tue Nov 26 18:26:57 UTC 2013 - tonyj@suse.com
- Update to version 2.3.2
Changelog 2.3.2
- Put RefuseManualStop in the right systemd section (#969345)
- Add legacy restart scripts for systemd support
- Add more syscall argument interpretations
- Add 'unset' keyword for uid & gid values in auditctl
- In ausearch, parse obj in IPC records
- In ausearch, parse subj in DAEMON_ROTATE records
- Fix interpretation of MQ_OPEN and MQ_NOTIFY events
- In auditd, restart dispatcher on SIGHUP if it had previously exited
- In audispd, exit when no active plugins are detected on reconfigure
- In audispd, clear signal mask set by libev so that SIGHUP works again
- In audispd, track binary plugins and restart if binary was updated
- In audispd, make sure we send signals to the correct process
- In auditd, clear signal mask when spawning any child process
- In audispd, make builtin plugins respond to SIGHUP
- In auparse, interpret mode flags of open syscall if O_CREAT is passed
- In audisp-remote, don't make address lookup always a permanent failure
- In audisp-remote, remove EOE events more efficiently
- In auditd, log the reason when email account is not valid
- In audisp-remote, change default remote_ending action to reconnect
- Add support for Aarch64 processors
Changelog 2.3.1
- Rearrange auditd setting enabled and pid to avoid a race (#910568)
- Interpret the ocomm field from OBJ_PID records
- Fix missing 'then' statement in sysvinit script
- Switch ausearch to use libauparse for interpretting fields
- In libauparse, interpret prctl arg0, sched_setscheduler arg1
- In auparse, check source_list isn't NULL when opening next file (Liequan Che)
- In libauparse, interpret send* flags argument
- In libauparse, interpret level and name options for set/getsockopt
- In ausearch/report, don't flush events until last file (Burn Alting)
- Don't use systemctl to stop the audit daemon
Changelog 2.3
- The clone(2) man page is really clone(3), fix interpretation of clone syscall
- Add systemd support for reload (#901533)
- Allow -F msgtype on the user filter
- Add legacy support for resuming logging under systemd (#830780)
- Add legacy support for rotating logs under systemd (#916611)
- In auditd, collect SIGUSR2 info for DAEMON_RESUME events
- Updated man pages
- Update libev to 4.15
- Update syscall tables for 3.9 kernel
- Interpret MQ_OPEN events
- Add augenrules support (Burn Alting)
- Consume less stack sending audit events
- remove libcap-ng too from audit.spec as it's only needed for plugins (and libcap-ng itself needs python to build bindings) OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=53
2013-06-28 11:31:27 +02:00
-------------------------------------------------------------------
Fri Jun 28 09:30:54 UTC 2013 - coolo@suse.com
- remove libcap-ng too from audit.spec as it's only needed for plugins
(and libcap-ng itself needs python to build bindings)
Accepting request 181246 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/181246 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=52
2013-06-28 10:51:36 +02:00
-------------------------------------------------------------------
Thu Jun 27 15:15:07 UTC 2013 - tonyj@suse.com
- Eliminate build cycles. audit.spec now builds only libs/devel.
Remainder (including daemon) built from audit-secondary.spec
Accepting request 173494 from openSUSE:Factory:Staging:Automake - Removed AC_CONFIG_MACRO_DIR([m4]) from configure.ac to fix build with new automake OBS-URL: https://build.opensuse.org/request/show/173494 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=49
2013-04-29 12:57:24 +02:00
-------------------------------------------------------------------
Fri Apr 26 11:14:39 UTC 2013 - mmeister@suse.com
- audit-no_m4_dir.patch: Removed AC_CONFIG_MACRO_DIR([m4]) from configure.ac to fix build with new automake buildrequired and the lack of those requires causes a broken configure script after autoreconf add pkgconfig(libcap-ng) to both audit and audit-secondary, cap-ng is actually only use in the latter. OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=50
2013-04-30 15:55:28 +02:00
- audit-no_m4_dir.patch: Removed AC_CONFIG_MACRO_DIR([m4]) from
configure.ac to fix build with new automake
Accepting request 173494 from openSUSE:Factory:Staging:Automake - Removed AC_CONFIG_MACRO_DIR([m4]) from configure.ac to fix build with new automake OBS-URL: https://build.opensuse.org/request/show/173494 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=49
2013-04-29 12:57:24 +02:00
Accepting request 161029 from home:elvigia:branches:security - Buildrequires cap-ng library - --with-libcap-ng=yes has no effect if libcap-ng is not buildrequired and the lack of those requires causes a broken configure script after autoreconf add pkgconfig(libcap-ng) to both audit and audit-secondary, cap-ng is actually only use in the latter. - Version 2.2.3 - Code cleanups - In spec file, don't own lib64/audit - Update man pages - Aureport no longer reads auditd.conf when stdin is used - Don't let systemd kill auditd if auditctl errors out - Update syscall table for 3.7 and 3.8 kernels - Add interpretation for setns and unshare syscalls - Code cleanup (Tyler Hicks) - Documentation cleanups (Laurent Bigonville) - Add dirfd interpretation to the *at functions - Add termination signal to clone flags interpretation - Update stig.rules - In auditctl, when listing rules don't print numeric value of dir fields - Add support for rng resource type in auvirt - Fix aulast bad login output (#922508) - In ausearch, allow negative numbers for session and auid searches - In audisp-remote, if disk_full_action is stop then stop sending (#908977) OBS-URL: https://build.opensuse.org/request/show/161029 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=47
2013-03-26 09:57:41 +01:00
-------------------------------------------------------------------
Mon Mar 25 17:25:31 UTC 2013 - crrodriguez@opensuse.org
- --with-libcap-ng=yes has no effect if libcap-ng is not
- audit-no_m4_dir.patch: Removed AC_CONFIG_MACRO_DIR([m4]) from configure.ac to fix build with new automake buildrequired and the lack of those requires causes a broken configure script after autoreconf add pkgconfig(libcap-ng) to both audit and audit-secondary, cap-ng is actually only use in the latter. OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=50
2013-04-30 15:55:28 +02:00
buildrequired and the lack of those requires causes a broken
configure script after autoreconf add pkgconfig(libcap-ng)
to both audit and audit-secondary, cap-ng is actually only
use in the latter.
Accepting request 161029 from home:elvigia:branches:security - Buildrequires cap-ng library - --with-libcap-ng=yes has no effect if libcap-ng is not buildrequired and the lack of those requires causes a broken configure script after autoreconf add pkgconfig(libcap-ng) to both audit and audit-secondary, cap-ng is actually only use in the latter. - Version 2.2.3 - Code cleanups - In spec file, don't own lib64/audit - Update man pages - Aureport no longer reads auditd.conf when stdin is used - Don't let systemd kill auditd if auditctl errors out - Update syscall table for 3.7 and 3.8 kernels - Add interpretation for setns and unshare syscalls - Code cleanup (Tyler Hicks) - Documentation cleanups (Laurent Bigonville) - Add dirfd interpretation to the *at functions - Add termination signal to clone flags interpretation - Update stig.rules - In auditctl, when listing rules don't print numeric value of dir fields - Add support for rng resource type in auvirt - Fix aulast bad login output (#922508) - In ausearch, allow negative numbers for session and auid searches - In audisp-remote, if disk_full_action is stop then stop sending (#908977) OBS-URL: https://build.opensuse.org/request/show/161029 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=47
2013-03-26 09:57:41 +01:00
-------------------------------------------------------------------
Mon Mar 25 16:58:10 UTC 2013 - crrodriguez@opensuse.org
- Version 2.2.3
- Code cleanups
- In spec file, don't own lib64/audit
- Update man pages
- Aureport no longer reads auditd.conf when stdin is used
- Don't let systemd kill auditd if auditctl errors out
- Update syscall table for 3.7 and 3.8 kernels
- Add interpretation for setns and unshare syscalls
- Code cleanup (Tyler Hicks)
- Documentation cleanups (Laurent Bigonville)
- Add dirfd interpretation to the *at functions
- Add termination signal to clone flags interpretation
- Update stig.rules
- In auditctl, when listing rules don't print numeric value of dir fields
- Add support for rng resource type in auvirt
- Fix aulast bad login output (#922508)
- In ausearch, allow negative numbers for session and auid searches
- In audisp-remote, if disk_full_action is stop then stop sending (#908977)
Accepting request 160635 from home:elvigia:branches:security - remove sysvinit scripts. OBS-URL: https://build.opensuse.org/request/show/160635 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=45
2013-03-23 07:14:34 +01:00
-------------------------------------------------------------------
Fri Mar 22 19:35:47 UTC 2013 - crrodriguez@opensuse.org
- remove sysvinit scripts.
Accepting request 150497 from home:elvigia:branches:security ** Please send to 12.3 because starting the audit daemon is broken with systemd **** - remove old tarball and update -secondary spec - Audit 2.2.2 , the purpose of this update is too add compatibility with systemd for 12.3 - In auditd, tcp_max_per_addr was allowing 1 more connection than specified - In ausearch, fix matching of object records - Auditctl was returning -1 when listing rules filtered on a key field - Add interpretations for CAP_BLOCK_SUSPEND and CAP_COMPROMISE_KERNEL - Add armv5tejl, armv5tel, armv6l and armv7l machine types (Nathaniel Husted) - Updates for the 3.6 kernel - Add auparse_feed_has_data function to libauparse - Update audisp-prelude to use auparse_feed_has_data - Add support to conditionally build auditd network listener (Tyler Hicks) - In auditd, reset a flag after receiving USR1 signal info when rotating logs - Add optional systemd init script support - Add support for SECCOMP event type - Don't interpret aN_len field in EXECVE records (#869555) - In audisp-remote, do better job of draining queue - Fix capability parsing in ausearch/auparse - Interpret BPRM_FCAPS capability fields - Add ANOM_LINK event type OBS-URL: https://build.opensuse.org/request/show/150497 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=43
2013-01-31 13:22:54 +01:00
-------------------------------------------------------------------
Wed Jan 30 23:19:33 UTC 2013 - crrodriguez@opensuse.org
- remove old tarball and update -secondary spec
-------------------------------------------------------------------
Wed Jan 30 23:12:19 UTC 2013 - crrodriguez@opensuse.org
- Audit 2.2.2 , the purpose of this update is too add compatibility
with systemd for 12.3
- In auditd, tcp_max_per_addr was allowing 1 more connection than specified
- In ausearch, fix matching of object records
- Auditctl was returning -1 when listing rules filtered on a key field
- Add interpretations for CAP_BLOCK_SUSPEND and CAP_COMPROMISE_KERNEL
- Add armv5tejl, armv5tel, armv6l and armv7l machine types (Nathaniel Husted)
- Updates for the 3.6 kernel
- Add auparse_feed_has_data function to libauparse
- Update audisp-prelude to use auparse_feed_has_data
- Add support to conditionally build auditd network listener (Tyler Hicks)
- In auditd, reset a flag after receiving USR1 signal info when rotating logs
- Add optional systemd init script support
- Add support for SECCOMP event type
- Don't interpret aN_len field in EXECVE records (#869555)
- In audisp-remote, do better job of draining queue
- Fix capability parsing in ausearch/auparse
- Interpret BPRM_FCAPS capability fields
- Add ANOM_LINK event type
Accepting request 149539 from home:jengelh:branches:security - Executing autoreconf requires autoconf OBS-URL: https://build.opensuse.org/request/show/149539 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=41
2013-01-22 15:09:24 +01:00
-------------------------------------------------------------------
Tue Jan 22 12:34:00 UTC 2013 - jengelh@inai.de
- Executing autoreconf requires autoconf
Accepting request 137972 from home:coolo:branches:openSUSE:Factory - Update to version 2.2.1, see audit's changes - update to 2.2.1, upstream changelog: 2.2.1 - Add more interpretations in auparse for syscall parameters - Add some interpretations to ausearch for syscall parameters - In ausearch/report and auparse, allocate extra space for node names - Update syscall tables for the 3.3.0 kernel - Update libev to 4.0.4 - Reduce the size of some applications - In auditctl, check usage against euid rather than uid 2.2 - Correct all rules for clock_settime - Fix possible segfault in auparse library - Handle malformed socket addresses better - Improve performance in audit_log_user_message() - Improve performance in writing to the log file in auditd - Syscall update for accept4 and recvmmsg - Update autrace resource usage mode syscall list - Improved sample rules for recent syscalls - Add some debug info to audisp-remote startup and shutdown - Make compiling with Python optional - In auditd, if disk_error_action is ignore, don't syslog anything - Fix some memory leaks - If audispd is stopping, don't restart children - Add support in auditctl for shell escaped filenames (Alexander) - Add search support for virt events (Marcelo Cerri) - Update interpretation tables - Sync auparse's auditd config parser with auditd's parser OBS-URL: https://build.opensuse.org/request/show/137972 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=39
2012-10-12 15:06:39 +02:00
-------------------------------------------------------------------
Fri Oct 12 12:51:13 UTC 2012 - coolo@suse.com
- update to 2.2.1, upstream changelog:
2.2.1
- Add more interpretations in auparse for syscall parameters
- Add some interpretations to ausearch for syscall parameters
- In ausearch/report and auparse, allocate extra space for node names
- Update syscall tables for the 3.3.0 kernel
- Update libev to 4.0.4
- Reduce the size of some applications
- In auditctl, check usage against euid rather than uid
2.2
- Correct all rules for clock_settime
- Fix possible segfault in auparse library
- Handle malformed socket addresses better
- Improve performance in audit_log_user_message()
- Improve performance in writing to the log file in auditd
- Syscall update for accept4 and recvmmsg
- Update autrace resource usage mode syscall list
- Improved sample rules for recent syscalls
- Add some debug info to audisp-remote startup and shutdown
- Make compiling with Python optional
- In auditd, if disk_error_action is ignore, don't syslog anything
- Fix some memory leaks
- If audispd is stopping, don't restart children
- Add support in auditctl for shell escaped filenames (Alexander)
- Add search support for virt events (Marcelo Cerri)
- Update interpretation tables
- Sync auparse's auditd config parser with auditd's parser
- In ausearch, also use cwd fields in file name searchs
- In ausearch, parse cwd in USER_CMD events
- In ausearch, correct parsing of uid in user space events
- In ausearch, update parsing of integrity events
- Apply some text cleanups from Debian (Russell Coker)
- In auditd, relax some permission checks for external apps
- Add ROLE_MODIFY event type
- In auditctl, new -c option to continue through bad rules but with failed exit
- Add auvirt program to do special reporting on virt events (Marcelo Cerri)
- Add interfield comparison support to auditctl (Peter Moody)
- Update auparse type intepretation for apparmor (Marcelo Cerri)
- Increase tcp_max_per_addr maximum to 1024.
- remove audit-no_python.patch, there is a configure switch for that now
- remove prereq on sysvinit
Accepting request 107576 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/107576 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=37
2012-02-29 19:06:19 +01:00
-------------------------------------------------------------------
Tue Feb 28 21:55:39 UTC 2012 - tonyj@suse.com
- Update to version 2.1.3, upstream changelog:
- 2.1.3
- Fix parsing of EXECVE records to not escape argc field
- If auditd's disk is full, send the right reason to client (#715315)
- Add CAP_WAKE_ALARM to interpretations
- Some updates to audisp-remote's remote-fgets function (Mirek Trmac)
- Add detection of TTY events to audisp-prelude (Matteo Sessa)
- Updated syscall tables for the 3.0 kernel
- Update linker flags for better relro support
- Make default size of logs bigger (#727310)
- Extract obj from NETFILTER_PKT events
- Disable 2 kerberos config options in audisp-remote.conf
- 2.1.2
- In ausearch/report, fix a segfault caused by MAC_POLICY_LOAD records
- In ausearch/report, add and update parsers
- In auditd, cleanup DAEMON_ACCEPT and DAEMON_CLOSE addr fields
- In ausearch/report, parse addr field of DAEMON_ACCEPT & DAEMON_CLOSE records
- In auditd, move startup success to after events are registered
- If auditd shutsdown due to failed tcp init, write a DAEMON_ABORT event
- Update auditd to avoid the oom killer in new kernels (Andreas Jaeger)
- Parse and interpret NETFILTER_PKT events correctly
- Return error if auditctl -l fails (#709345)
- In audisp-remote, replace glibc's fgets with custom implementation
Accepting request 85948 from home:coolo:removelibtool add libtool as buildrequires so we no longer rely on libtool in the project config of factory - it's only needed by <10% of all packages OBS-URL: https://build.opensuse.org/request/show/85948 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=35
2011-10-02 17:39:13 +02:00
-------------------------------------------------------------------
Fri Sep 30 20:07:43 UTC 2011 - coolo@suse.com
- add libtool as buildrequire to make the spec file more reliable
Accepting request 82852 from home:jengelh:bl-a - Remove redundant tags/sections from specfile - Add audit-devel to baselibs OBS-URL: https://build.opensuse.org/request/show/82852 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=33
2011-09-29 21:23:17 +02:00
-------------------------------------------------------------------
Sat Sep 17 13:38:24 UTC 2011 - jengelh@medozas.de
- Remove redundant tags/sections from specfile
- Add audit-devel to baselibs
Accepting request 70025 from home:msmeissn:branches:security fixed licenses of libaudit and libauparse to be lgplv 2.1, not gpl v OBS-URL: https://build.opensuse.org/request/show/70025 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=29
2011-05-11 17:36:01 +02:00
-------------------------------------------------------------------
Wed May 11 09:39:35 CEST 2011 - meissner@suse.de
- Adjust license of libaudit and libauparse to be
LGPLv2.1 or later.
Accepting request 68631 from home:jones_tony:branches:security OBS-URL: https://build.opensuse.org/request/show/68631 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=27
2011-04-28 02:17:07 +02:00
-------------------------------------------------------------------
Wed Apr 27 00:04:23 UTC 2011 - tonyj@novell.com
- Update to version 2.1.1, upstream changelog:
- 2.1.1
- When ausearch is interpretting, output "as is" if no = is found
- Correct socket setup in remote logging
- Adjusted a couple default settings for remote logging and init script
- Audispd was not marking restarted plugins as active
- Audisp-remote should keep a capability if local_port < 1024
- When audispd restarts plugin, send event in its preferred format
- In audisp-remote, make all I/O asynchronous
- In audisp-remote, add sigusr1 handler to dump internal state
- Fix autrace to use correct syscalls on s390 and s390x systems
- Add shutdown syscall to remote logging teardowns
- Correct autrace rule for 32 bits systems
2.1
- Update auditctl man page for new field on user filter
- Fix crash in aulast when auid is foreign to the system
- Code cleanups
- Add store and forward model to audispd-remote (Mirek Trmac)
- Free memory on failed startups in audisp-prelude
- Fix memory leak in aureport
- Fix parsing state problem in libauparse
- Improve the robustness of libaudit field encoding functions
- Update capability tables
- In auditd, make failure action config checking consistent
- In auditd, check that NULL is not being passed to safe_exec
- In audisp-remote, overflow_action wasn't suspending if that action was chosen
- Update interpretations for virt events
- Improve remote logging warning and error messages
- Add interpretations for netfilter events
2.0.6
- ausearch/report performance improvements
- Synchronize all sample syscall rules to use action,list
- If program name provided to audit_log_acct_message, escape it
- Fix man page for the audit_encode_nv_string function (#647131)
- If value is NULL, don't segfault (#647128)
- Fix simple event parsing to not assume session id can't be last (Peng Haitao)
- Add support for new mmap audit event type
- Add ability for audispd syslog plugin to choose facility local0-7 (#593340)
- Fix autrace to use correct syscalls on i386 systems (Peng Haitao)
- On startup and reconfig, check for excess logs and unlink them
- Add a couple missing parser debug messages
- Fix error output resolving numeric address and update man page
- Add netfilter event types
- Fix spelling error in audit.rules man page (#667845)
- Improve warning in auditctl regarding immutable mode (#654883)
- Update syscall tables for the 2.6.37 kernel
- In ausearch, allow searching for auid -1
- Add queue overflow_action to audisp-remote to control queue overflows
- Update sample rules for new syscalls and packages
Accepting request 62244 from home:a_jaeger:branches:openSUSE:Factory looks good OBS-URL: https://build.opensuse.org/request/show/62244 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=25
2011-02-21 14:30:00 +01:00
-------------------------------------------------------------------
Mon Feb 21 10:33:40 UTC 2011 - aj@suse.de
- Fix value of oom_score_adj.
Accepting request 55136 from home:coolo:branches:openSUSE:Factory OBS-URL: https://build.opensuse.org/request/show/55136 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=23
2010-12-08 19:45:55 +01:00
-------------------------------------------------------------------
Tue Dec 7 21:17:24 UTC 2010 - coolo@novell.com
- prereq init script syslog
Accepting request 52353 from home:elvigia:branches:security OBS-URL: https://build.opensuse.org/request/show/52353 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=22
2010-11-09 13:34:18 +01:00
-------------------------------------------------------------------
Sun Nov 7 23:00:15 UTC 2010 - cristian.rodriguez@opensuse.org
- use full RELRO.
Updating link to change in openSUSE:Factory/audit revision 39.0 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=e38cdd0b691b6b60755903cb397b7849
2010-10-08 01:12:17 +02:00
-------------------------------------------------------------------
Tue Sep 28 22:41:14 UTC 2010 - tonyj@novell.com
- Update to version 2.0.5 (drop: audit-as_needed.patch)
- Update README-BEFORE-ADDING-PATCHES
- Upstream 2.0.5 changelog:
- Make auparse handle empty AUSOURCE_FILE_ARRAY correctly (Miloslav Trmač)
- On i386, audit rules do not work on inode's with a large number (#554553)
- Fix displaying of inode values to be unsigned integers when listing rules
- Correct Makefile install of audispd (Jason Tang)
- Syscall table updates for 2.6.34 kernel
- Add definitions for service start and stop
- Fix handling of ignore errors in auditctl
- Fix gssapi support to build with new linker options
- Add virtualization event types
- Update aureport program help and man pages to show all options
-------------------------------------------------------------------
Tue Sep 28 07:22:05 UTC 2010 - aj@suse.de
- Annotate patch audit-oom_score_adj.
-------------------------------------------------------------------
Mon Sep 27 08:47:32 UTC 2010 - aj@suse.de
- Use /proc/<pid>/oom_score_adj if available.
Updating link to change in openSUSE:Factory/audit revision 38.0 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=3d3241e0b15443eae39871a7fdf480eb
2010-07-30 12:34:44 +02:00
-------------------------------------------------------------------
Mon Jun 28 06:38:35 UTC 2010 - jengelh@medozas.de
- use %_smp_mflags
Accepting request 42081 from home:jones_tony:branches:security Copy from home:jones_tony:branches:security/audit via accept of submit request 42081 revision 2. Request was accepted with message: OBS-URL: https://build.opensuse.org/request/show/42081 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=14
2010-06-25 23:50:35 +02:00
-------------------------------------------------------------------
Fri Jun 25 21:22:51 UTC 2010 - tonyj@novell.com
- Minor changes to README-BEFORE-ADDING-PATCHES file.
- Add this file as %source in spec
Updating link to change in openSUSE:Factory/audit revision 34.0 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=4fa5a897999b3867dbdd76d1680e2ff7
2010-06-25 20:41:59 +02:00
-------------------------------------------------------------------
Fri Jun 25 17:50:31 CEST 2010 - dmueller@suse.de
- obsolete -XXbit package
Updating link to change in openSUSE:Factory/audit revision 33.0 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=2e549d51645610c56d39ee90f5dfd448
2010-05-05 20:41:24 +02:00
-------------------------------------------------------------------
Tue May 4 10:51:58 CEST 2010 - tonyj@suse.de
- Update to version 2.0.4. This is a major version update,
libaudit.so has changed version. There is no backward compatibility.
audit-libs has been split into libaudit1 and libauparse0.
- Redhat changelog for 2.0 - 2.0.4 follows:
* 2.0.4
- Make alpha processor support optional
- Add support for the arm eabi processor
- add a compatible regexp processing capability to auparse (Miloslav Trmač)
- Fix regression in parsing user space originating records in aureport
- Add tcp_max_per_addr option in auditd.conf to limit concurrent connections
- Rearrange shutdown of auditd to allow DAEMON_END event more time
* 2.0.3
- In auditd, tell libev to stop processing a connection when idle timeout
- In auditd, tell libev to stop processing a connection when shutting down
- Interpret CAPSET records in ausearch/auparse
* 2.0.2
- If audisp-remote plugin has a queue at exit, use non-zero exit code
- Fix autrace to use the exit filter
- In audisp-remote, add a sigchld handler
- In auditd, check for duplicate remote connections before accepting
- Remove trailing ':' if any are at the end of acct fields in ausearch
- Update remote logging code to do better sanity check of data
- Fix audisp-prelude to prefer files if multiple path records are encountered
- Add libaudit.conf man page
- In auditd, disconnect idle clients
* 2.0.1
- Aulast now reads daemon_start events for the kernel version of reboot
- Clarify the man pages for ausearch/report regarding locale and date formats
- Fix getloginuid for python bindings
- Disable the audispd af_unix plugin by default
- Add a couple new init script actions for LSB 3.2
- In audisp-remote plugin, timeout network reads (#514090)
- Make some error logging in audisp-remote plugin more prominent
- Add audit.rules man page
- Interpret the session field in audit events
* 2.0
- Remove system-config-audit
- Get rid of () from userspace originating events
- Removed old syscall rules API - not needed since 2.6.16
- Remove all use of the old rule structs from API
- Fix uninitialized variable in auditd log rotation
- Add libcap-ng support for audispd plugins
- Removed ancient defines that are part of kernel 2.6.29 headers
- Bump soname number for libaudit
- In auditctl, deprecate the entry filter and move rules to exit filter
- Parse integrity audit records in ausearch/report (Mimi Zohar)
- Updated syscall table for 2.6.31 kernel
- Remove support for the legacy negate syscall rule operator
- In auditd reset syslog warnings if disk space becomes available
Accepting request 24465 from security Copy from security/audit based on submit request 24465 from user msmeissn OBS-URL: https://build.opensuse.org/request/show/24465 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=30
2009-11-16 09:56:53 +01:00
-------------------------------------------------------------------
Accepting request 39398 from security checked in (request 39398) OBS-URL: https://build.opensuse.org/request/show/39398 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=11
2010-05-05 20:41:23 +02:00
Sun Dec 13 15:39:09 CET 2009 - jengelh@medozas.de
Accepting request 29108 from security Copy from security/audit based on submit request 29108 from user msmeissn OBS-URL: https://build.opensuse.org/request/show/29108 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=31
2010-01-14 15:25:16 +01:00
Accepting request 39398 from security checked in (request 39398) OBS-URL: https://build.opensuse.org/request/show/39398 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=11
2010-05-05 20:41:23 +02:00
- add baselibs.conf as a source
Accepting request 29108 from security Copy from security/audit based on submit request 29108 from user msmeissn OBS-URL: https://build.opensuse.org/request/show/29108 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=31
2010-01-14 15:25:16 +01:00
Accepting request 39398 from security checked in (request 39398) OBS-URL: https://build.opensuse.org/request/show/39398 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=11
2010-05-05 20:41:23 +02:00
-------------------------------------------------------------------
Tue Nov 3 19:11:33 UTC 2009 - coolo@novell.com
- updated patches to apply with fuzz=0
Accepting request 24465 from security Copy from security/audit based on submit request 24465 from user msmeissn OBS-URL: https://build.opensuse.org/request/show/24465 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=30
2009-11-16 09:56:53 +01:00
-------------------------------------------------------------------
Mon Sep 28 16:23:29 CEST 2009 - crrodriguez@suse.de
- do not package static libraries
- fix -devel package dependencies
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=28
2009-06-29 14:31:39 +02:00
-------------------------------------------------------------------
Sat Jun 20 12:33:00 CEST 2009 - cmorve69@yahoo.es
- fixed build with --as-needed
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=27
2009-06-19 23:20:55 +02:00
-------------------------------------------------------------------
Fri Jun 19 10:35:46 CEST 2009 - coolo@novell.com
- disable as-needed for this package as it fails to build with it
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=25
2009-04-23 20:22:52 +02:00
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=26
2009-06-05 22:36:33 +02:00
Mon May 11 17:20:28 CEST 2009 - tonyj@suse.de
- Update from 1.7.7 to 1.7.13.
- Redhat changelog for 1.7.8 - 1.7.13 follows:
* Tue Apr 21 2009 Steve Grubb <sgrubb@redhat.com> 1.7.13-1
- Disable libev asserts unless --with-debug passed to configure
- Handle kernel 2.6.29's audit = 0 boot parameter better
- Install audit.py file in arch specific python directory (Dan Walsh)
- Fix problem with negative uids in audit rules on 32 bit systems
- When file type is unknown, output octal for mode field (Miloslav Trmač)
- Update tty keystroke interpretations (Miloslav Trmač)
* Tue Feb 24 2009 Steve Grubb <sgrubb@redhat.com> 1.7.12-1
- Add definitions for crypto events
- Fix regression where msgtype couldn't be used as a range in audit rules
- In libaudit, extend time spent checking reply
- In acct events, prefer id over acct if given
- In aulast, try id and acct in USER_LOGIN events
- When in immutable mode, have auditctl tell user instead of sending rules
- Add option to sysconfig to disable audit system on auditd stop
- Add tcp_wrappers config option to auditd
- Aulastlog can now take input from stdin
- Update libaudit python bindings to throw exceptions on error
- Adjust formatting of TTY data in libauparse to be like ausearch/report
- Add more key mappings to TTY interpretations
- Add internal queue to audisp-remote
- Fix failure action code to allow executables in audisp-remote (Chu Li)
- Fix memory leak when NOLOG log_format option given to auditd
- Quieten some of the reconnect text being sent to syslog in audisp-remote
- Apply some libev fixups to auditd
- Cleanup shutdown sequence of auditd
- Allow auditd log rotation via SIGUSR1 when NOLOG log format option given
* Sat Jan 10 2009 Steve Grubb <sgrubb@redhat.com> 1.7.11-1
- Don't error out in auditd when calling setsid
- Reformat a couple auditd error messages (Oden Eriksson)
- If log rotate fails, leave the old log writable
- Fixed bug in setting up auditd event loop when listening
- Warn if on biarch machine and auditctl rules show a syscall mismatch
- Audisp-remote was not parsing some config options correctly
- In auparse, check for single key in addition to virtual keys
- When auditd shuts down, send AUDIT_RMW_TYPE_ENDING messages to clients
- Created reconnect option to remote ending setting of audisp-remote
* Sat Dec 13 2008 Steve Grubb <sgrubb@redhat.com> 1.7.10-1
- Fix ausearch and aureport to handle out of order events
- Add line-buffer option to ausearch & timeout pipe input (Tony Jones)
- Add support in ausearch/report for tty data
- In audisp-remote, allow the keyword "any" for local_port
- Tighten parsing for -m and -w options in auditctl
- Add session query hint for aulast proof
- Fix audisp-remote to tolerate krb5 config options when not supported
- Created new aureport option for tty keystroke report
- audispd should detect backup config files and not use them
- When checking for ack in netlink interface, retry on EAGAIN a few times
- In aureport, fix mods report to show acct acted upon
* Wed Nov 05 2008 Steve Grubb <sgrubb@redhat.com> 1.7.9-1
- Fix uninitialized variable in aureport causing segfault
- Quieten down the gssapi not supported messages
- Fix bug interpretting i386 logs on x86_64 machines
- If kernel is in immutable mode, auditd should not send enable command
- Fix ausearch/report recent and now time keyword lookups
- Created aulast program
- prelude plugin should pull auid for login alert from 2nd uid field
- Add system boot, shutdown, and run level change events
- Add max_restarts to audispd.conf to limit times a plugin is restarted
- Expand session detection in ausearch
* Wed Oct 22 2008 Steve Grubb <sgrubb@redhat.com> 1.7.8-1
- Interpret TTY audit data in auparse (Miloslav Trmač)
- Extract terminal from USER_AVC events for ausearch/report (Peng Haitao)
- Add USER_AVCs to aureport's avc reporting (Peng Haitao)
- Short circuit hostname resolution in libaudit if host is empty
- If log_group and user are not root, don't check dispatcher perms
- Fix a bug when executing "ausearch -te today PM"
- Add --exit search option to ausearch
- Fix parsing config file when kerberos is disabled
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=25
2009-04-23 20:22:52 +02:00
Tue Apr 14 14:52:39 CEST 2009 - dmueller@suse.de
- refresh patches
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=24
2008-12-15 11:59:36 +01:00
-------------------------------------------------------------------
Wed Dec 10 12:34:56 CET 2008 - olh@suse.de
- use Obsoletes: -XXbit only for ppc64 to help solver during distupgrade
(bnc#437293)
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=23
2008-12-05 15:04:37 +01:00
-------------------------------------------------------------------
Fri Dec 5 02:30:03 CET 2008 - tonyj@suse.de
- Revision to previous fix for bnc#445353.
These should go into SLES11 RC1.
1) Add --line-buffered option to limit when stdout is flushed (performance).
2) Testing found a related bug where (if input is a pipe) the last logical
record would permanently be queued waiting for a subsequent record indicating
end of the previous. This subsequent record may never arrive. Timer is
now run causing this record to be flushed if no new record arrives within
timeout. This fix is upstream also.
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=22
2008-11-21 15:13:03 +01:00
-------------------------------------------------------------------
Fri Nov 21 08:45:03 CET 2008 - tonyj@suse.de
- Force ausearch to flush stdout if pipe (bnc#445353)
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=21
2008-11-02 15:33:58 +01:00
-------------------------------------------------------------------
Thu Oct 30 12:34:56 CET 2008 - olh@suse.de
- obsolete old -XXbit packages (bnc#437293)
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=20
2008-09-29 17:28:30 +02:00
-------------------------------------------------------------------
Fri Sep 26 23:27:59 CEST 2008 - tonyj@suse.de
- Update from 1.7.4 to 1.7.7. GSS support disabled for present
- Redhat changelog for 1.7.5 - 1.7.7 follows:
* Wed Sep 11 2008 Steve Grubb <sgrubb@redhat.com> 1.7.7-1
- Bug fixes for gss code in remote logging (DJ Delorie)
- Fix ausearch -i to keep the node field in the output
- ausyscall now does strstr match on syscall names
- Makefile cleanup (Philipp Hahn)
- Add watched syscall support to audisp-prelude
- Use the right define for tcp_wrappers in auditd
- Expose encoding API for fields being logged from user space
* Wed Sep 11 2008 Steve Grubb <sgrubb@redhat.com> 1.7.6-1
- Update event record list and aureport classifications (Yu Zhiguo/Peng Haitao)
- Add subject to audit daemon events (Chu Li)
- Fix parsing of acct & exe fields in user records (Peng Haitao)
- Make client error handling in audisp-remote robust (DJ Delorie)
- Add tcp_wrappers support for auditd
- Updated syscall tables for 2.6.27 kernel
- Add heartbeat exchange to remote logging protocol (DJ Delorie)
- Audit connect/disconnect of remote clients
- In ausearch, collect pid from AVC records (Peng Haitao)
- Add auparse_get_field_type function to describe field's contents
- Add GSS/Kerberos encryption to the remote protocol (DJ Delorie)
* Mon Aug 25 2008 Steve Grubb <sgrubb@redhat.com> 1.7.5-1
- Update system-config-audit to 0.4.8
- Whole lot of bug fixes - see ChangeLog for details
- Reimplement auditd main loop using libev
- Add TCP listener to auditd to receive remote events
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=19
2008-08-06 01:41:00 +02:00
-------------------------------------------------------------------
Tue Aug 5 03:13:56 CEST 2008 - tonyj@suse.de
- Remove audit rules on audit stop (bnc#409093)
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=17
2008-06-25 18:53:54 +02:00
-------------------------------------------------------------------
Wed Jun 25 01:50:54 CEST 2008 - tonyj@suse.de
- Update from 1.7.2 to 1.7.4
- Redhat changelog for 1.7.3 - 1.7.4 follows:
* Mon May 19 2008 Steve Grubb <sgrubb@redhat.com> 1.7.4-1
- Fix interpreting of keys in syscall records
- Interpret audit rule config change list fields
- Don't error on name=(null) PATH records in ausearch/report
- Add key report to aureport
- Fix --end today to be now
- Added python bindings for auparse_goto_record_num
- Update system-config-audit to 0.4.7 (Miloslav Trmac)
- Add support for the filetype field option in auditctl
- In audispd boost priority after starting children
* Fri May 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.3-1
- Fix path processing in AVC records.
- auparse_find_field_next() wasn't resetting field ptr going to next record.
- auparse_find_field() wasn't checking current field before iterating
- cleanup some string handling in audisp-prelude plugin
- Update auditctl man page
- Fix output of keys in ausearch interpretted mode
- Fix ausearch/report --start now to not be reset to midnight
- Added auparse_goto_record_num function
- Prelude plugin now uses auparse_goto_record_num to avoid skipping a record
- audispd now has a priority boost config option
- Look for laddr in avcs reported via prelude
- Detect page 0 mmaps and alert via prelude
- Update from 1.6.8 to 1.7.2
- Complete fix for BNC# 378725
- Redhat changelog for 1.6.9-1.7.2 follows:
* Wed Apr 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-1
- gen_table.c now includes IPC defines to avoid glibc-headers wild goose chase
- ausyscall program added for cross referencing syscall name and number info
- Add login session ID search capability to ausearch
* Tue Apr 08 2008 Steve Grubb <sgrubb@redhat.com> 1.7.1-1
- Remove LSB headers info for init scripts
- Fix buffer overflow in audit_log_user_command, again (#438840)
- Fix memory leak in EOE code in auditd (#440075)
- In auditctl, don't use new operators in legacy rule format
- Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
- Add example STIG rules file
- Add string table lookup performance improvement patch (Miloslav Trmac)
- auparse_find_field_next performance improvement
* Sun Mar 30 2008 Steve Grubb <sgrubb@redhat.com> 1.7-1
- Improve input error handling in audispd
- Improve end of event detection in auparse library
- Improve handling of abstract namespaces
- Add test mode for prelude plugin
- Handle user space avcs in prelude plugin
- Audit event serial number now recorded in idmef alert
- Add --just-one option to ausearch
- Fix watched account login detection for some failed login attempts
- Couple fixups in audit logging functions (Miloslav Trmac)
- Add support in auditctl for virtual keys
- Added new type for user space MAC policy load events
- auparse_find_field_next was not iterating correctly, fixed it
- Add idmef alerts for access or execution of watched file
- Fix buffer overflow in audit_log_user_command
- Add basic remote logging plugin - only sends & no flow control
- Update ausearch with interpret fixes from auparse
* Sun Mar 09 2008 Steve Grubb <sgrubb@redhat.com> 1.6.9-1
- Apply hidden attribute cleanup patch (Miloslav Trmac)
- Apply auparse expression interface patch (Miloslav Trmac)
- Fix potential memleak in audit event dispatcher
- Change default audispd queue depth to 80
- Update system-config-audit to version 0.4.6 (Miloslav Trmac)
- audisp-prelude alerts now controlled by config file
- Updated syscall table for 2.6.25 kernel
- Apply patch correcting acct field being misencoded (Miloslav Trmac)
- Added watched account login detection for prelude plugin
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=15
2008-04-25 15:32:44 +02:00
-------------------------------------------------------------------
Wed Apr 23 14:17:17 CEST 2008 - tonyj@suse.de
- Fix for bnc#378725 VUL-0: audit buffer overflow
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=12
2008-03-28 15:45:19 +01:00
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=13
2008-04-10 13:07:25 +02:00
Thu Apr 10 12:54:45 CEST 2008 - ro@suse.de
- added baselibs.conf file to build xxbit packages
for multilib support
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=12
2008-03-28 15:45:19 +01:00
Wed Mar 26 21:29:38 CET 2008 - tonyj@suse.de
- Update from 1.6.2 to 1.6.8.
- Move audisp-plugins to new secondary spec (along with existing
python libs).
- Redhat changelog follows:
* Thu Feb 14 2008 Steve Grubb <sgrubb@redhat.com> 1.6.8-1
- Update for gcc 4.3
- Cleanup descriptors in audispd before running plugin
- Fix 'recent' keyword for aureport/search
- Fix SE Linux policy for zos_remote plugin
- Add event type for group password authentication attempts
- Couple of updates to the translation tables
- Add detection of failed group authentication to audisp-prelude
* Thu Jan 31 2008 Steve Grubb <sgrubb@redhat.com> 1.6.7-1
- In ausearch/report, prefer -if to stdin
- In ausearch/report, add new command line option --input-logs (#428860)
- Updated audisp-prelude based on feedback from prelude-devel
- Added prelude alert for promiscuous socket being opened
- Added prelude alert for SE Linux policy enforcement changes
- Added prelude alerts for Forbidden Login Locations and Time
- Applied patch to auparse fixing error handling of searching by
interpreted value (Miloslav Trmac)
* Sat Jan 19 2008 Steve Grubb <sgrubb@redhat.com> 1.6.6-1
- Add prelude IDS plugin for IDMEF alerts
- Add --user option to aulastlog command
- Use desktop-file-install for system-config-audit
* Mon Jan 07 2008 Steve Grubb <sgrubb@redhat.com> 1.6.5-1
- Add more errno strings for exit codes in auditctl
- Fix config parser to allow either 0640 or 0600 for audit logs (#427062)
- Check for audit log being writable by owner in auditd
- If auditd logging was suspended, it can be resumed with SIGUSR2 (#251639)
- Updated CAPP, LSPP, and NISPOM rules for new capabilities
- Added aulastlog utility
* Sat Dec 29 2007 Steve Grubb <sgrubb@redhat.com> 1.6.4-1
- fchmod of log file was on wrong variable (#426934)
- Allow use of errno strings for exit codes in audit rules
* Thu Dec 27 2007 Steve Grubb <sgrubb@redhat.com> 1.6.3-1
- Add kernel release string to DEAMON_START events
- Fix keep_logs when num_logs option disabled (#325561)
- Fix auparse to handle node fields for syscall records
- Update system-config-audit to version 0.4.5 (Miloslav Trmac)
- Add keyword week-ago to aureport & ausearch start/end times
- Fix audit log permissions on rotate. If group is root 0400, otherwise 0440
- Add RACF zos remote audispd plugin (Klaus Kiwi)
- Add event queue overflow action to audispd
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=11
2008-03-19 11:57:31 +01:00
-------------------------------------------------------------------
Tue Mar 18 14:43:11 CET 2008 - schwab@suse.de
- Use autoreconf.
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=8
2007-10-31 12:24:11 +01:00
-------------------------------------------------------------------
Wed Oct 31 07:08:38 CET 2007 - tonyj@suse.de
- Incorporate 1 more Redhat fixe post 1.6.2
- Go back to 10.2 behaviour wrt to starting in disabled state.
This time using patch submitted upstream, fix for #Bug 333739
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=7
2007-10-11 18:47:28 +02:00
-------------------------------------------------------------------
Wed Oct 10 23:18:24 CEST 2007 - tonyj@suse.de
- Upgrade to 1.6.2
Plus two bugs discovered in Fedora, will be fixed in 1.6.3
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=6
2007-07-27 01:18:47 +02:00
-------------------------------------------------------------------
Wed Jul 25 01:13:09 CEST 2007 - tonyj@suse.de
- Upgrade to 1.5.5
Correct bug in audit_make_equivalent function (Al Viro)
Local: add AppArmor audit ID (upstream in 1.5.6)
don't build RedHat system-config-audit
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=3
2007-05-09 00:57:25 +02:00
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=4
2007-07-12 03:01:37 +02:00
Thu Jul 12 01:38:36 CEST 2007 - tonyj@suse.de
- Upgrade to 1.5.4
Add feed interface to auparse library (John Dennis)
Apply patch to libauparse for unresolved symbols (#241178)
Apply patch to add line numbers for file events in libauparse (John Dennis)
Change seresults to seresult in libauparse (John Dennis)
Add unit32_t definition to swig (#244210)
Add support for directory auditing
Update acct field to be escaped
- Fix for #280487 "%ghost /var/log/audit/audit.log will remove the logfile"
-------------------------------------------------------------------
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=3
2007-05-09 00:57:25 +02:00
Mon May 7 11:24:29 CEST 2007 - rguenther@suse.de
- Drop pkg-config BuildRequires introduced by last change.
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=2
2007-05-06 17:10:42 +02:00
-------------------------------------------------------------------
Wed May 2 19:08:53 CEST 2007 - tonyj@suse.de
- Upgrade to 1.5.3. Drop AUDITD_DISABLE_CONTEXTS from audit sysconfig
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=1
2007-01-15 23:51:54 +01:00
-------------------------------------------------------------------
Wed Nov 29 02:46:08 CET 2006 - tonyj@suse.de
- Upgrade to 1.2.9 (drop several patches which are now upstream)
- Move to using /etc/audit directory for config files
-------------------------------------------------------------------
Thu Aug 31 22:57:52 CEST 2006 - tonyj@suse.de
- Upgrade to 1.2.6-1
-------------------------------------------------------------------
Sat Aug 26 09:01:50 CEST 2006 - olh@suse.de
- do not define __KERNEL__ in userland apps
- remove unused sys/syscall.h include
-------------------------------------------------------------------
Wed Aug 16 15:42:58 CEST 2006 - cthiel@suse.de
- split audit into audit and audit-libs-python
-------------------------------------------------------------------
Fri May 5 21:05:40 CEST 2006 - sbeattie@suse.de
- disable syscall audit context creation by default #172154
-------------------------------------------------------------------
Mon Mar 20 16:18:29 CET 2006 - meissner@suse.de
- Do not print a misleading errormessage when audit
is not compiled into the kernel. #152733
-------------------------------------------------------------------
Mon Mar 6 14:21:06 CET 2006 - meissner@suse.de
- On kernels without auditing, which report ECONNREFUSED,
do not output stuff to stderr on startup. #152733
-------------------------------------------------------------------
Sat Feb 25 09:55:48 CET 2006 - kukuk@suse.de
- Fix moving of devel libraries, don't install .la file
-------------------------------------------------------------------
Wed Feb 22 15:10:44 CET 2006 - meissner@suse.de
- moved libaudit.so symlink to /usr/lib and to -devel package,
as requested by Thorsten.
-------------------------------------------------------------------
Fri Feb 17 19:56:14 CET 2006 - meissner@suse.de
- check sendto() return against -1 (error with errno set).
-------------------------------------------------------------------
Wed Jan 25 21:34:31 CET 2006 - mls@suse.de
- converted neededforbuild to BuildRequires
-------------------------------------------------------------------
Wed Jan 25 12:09:31 CET 2006 - ro@suse.de
- fix fillup call since filename != packagename
-------------------------------------------------------------------
Tue Jan 24 19:01:52 CET 2006 - ro@suse.de
- do not skip fillup in postinstall
-------------------------------------------------------------------
Mon Jan 23 08:54:33 CET 2006 - dreynolds@suse.de
- Modified inssrv macro args to enable on boot
-------------------------------------------------------------------
Wed Jan 18 21:33:21 CET 2006 - tonyj@suse.de
- Add support for AppArmor (submitted upstream for 1.1.4)
-------------------------------------------------------------------
Fri Jan 13 11:35:57 CET 2006 - meissner@suse.de
- Updated to 1.1.3.
- Moved audispd to /usr/sbin since it uses /usr/lib/libstdc++
- Updated sysconfig snippet.
-------------------------------------------------------------------
Tue Nov 8 11:32:45 CET 2005 - meissner@suse.de
- upgraded to 1.0.12.
-------------------------------------------------------------------
Fri Nov 4 12:41:35 CET 2005 - kukuk@suse.de
- Update to 1.0.9.
-------------------------------------------------------------------
Wed Oct 12 17:24:55 CEST 2005 - meissner@suse.de
- upgraded to 1.0.6. ptrdift patch now solved upstream.
-------------------------------------------------------------------
Wed Oct 5 15:17:05 CEST 2005 - meissner@suse.de
- Upgraded to 1.0.5
-------------------------------------------------------------------
Wed Oct 5 12:00:38 CEST 2005 - dmueller@suse.de
- add norootforbuild
-------------------------------------------------------------------
Mon Sep 26 11:40:27 CEST 2005 - meissner@suse.de
- Upgraded to 1.0.4.
- Make rate & backlog 32 bit unsigned int in auditctl
- In auditctl, if -F arch is given with -t option, don't require list
- Update auditd man page
- Add size check to audit_send
- Update message for audit_open failure when kernel doesn't support audit
-------------------------------------------------------------------
Tue Aug 23 14:07:44 CEST 2005 - meissner@suse.de
- Upgraded to 1.0.3 bugfix release:
- adjust file perms of newly created log file in auditd
- fix 2 memory leaks and an out of bounds access in auditd
- fix case where auditd was closing netlink descriptor too early
- fix watch rules not to take field arguments in auditctl
- fix bug where inode, devmajor, devminor, exit, and success fields in auditctl
rules were not getting the correct value stored
-------------------------------------------------------------------
Wed Aug 17 14:19:29 CEST 2005 - meissner@suse.de
- Added /var/log/audit directory and ghost audit.log #105131
-------------------------------------------------------------------
Wed Aug 10 13:37:56 CEST 2005 - meissner@suse.de
- Upgraded to 1.0.2
-------------------------------------------------------------------
Thu Aug 4 11:20:00 CEST 2005 - meissner@suse.de
- Upgraded to 1.0.1.
-------------------------------------------------------------------
Mon Jul 11 14:47:38 CEST 2005 - meissner@suse.de
- Update to version 0.9.16.
-------------------------------------------------------------------
Tue Jun 21 08:38:17 CEST 2005 - meissner@suse.de
- Update to version 0.9.10.
-------------------------------------------------------------------
Fri Jun 17 11:21:42 CEST 2005 - meissner@suse.de
- Update to version 0.9.7.
-------------------------------------------------------------------
Thu Jun 16 14:51:48 CEST 2005 - kukuk@suse.de
- Update to version 0.9.5
-------------------------------------------------------------------
Tue Jun 14 01:30:20 CEST 2005 - ro@suse.de
- make it build with current includes
-------------------------------------------------------------------
Tue May 31 14:15:30 CEST 2005 - meissner@suse.de
- Upgraded to 0.9.
-------------------------------------------------------------------
Fri May 13 13:08:41 CEST 2005 - meissner@suse.de
- upgraded to 0.6.8
-------------------------------------------------------------------
Tue Apr 19 10:39:54 CEST 2005 - meissner@suse.de
- Upgraded to 0.6.11.
-------------------------------------------------------------------
Fri Apr 15 17:52:43 CEST 2005 - pth@suse.de
- Make libaudit.h define pgoff_t by itself.
- Fix a minor warning.
-------------------------------------------------------------------
Wed Mar 30 17:58:32 CEST 2005 - meissner@suse.de
- Upgraded to 0.6.9.
-------------------------------------------------------------------
Fri Mar 4 11:23:29 CET 2005 - meissner@suse.de
- Upgraded to 0.6.5.
-------------------------------------------------------------------
Thu Mar 3 14:59:36 CET 2005 - meissner@suse.de
- initial package of auditd for new kernel auditing system.
Copy Permalink