rpm/audit
SHA256
1
0
Fork 0
forked from pool/audit
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/audit?expand=0&rev=17

Browse Source
This commit is contained in:
OBS User unknown 2008-06-25 16:53:54 +00:00 committed by Git OBS Bridge
parent f13d9c5aa9
commit 6182511c5d
11 changed files with 245 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
audit-1.6.8.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:675f08a4e32a4ccc4581fefcac3918bb6d8af2e1e318b16d7bbe27c654c53b1f
size 594531

3
audit-1.7.4.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:aeb9652be811b7f4a695031dfd115c6d2209fe08601335772e727a183d756b06
size 626976

29
audit-bnc378725.patch
View File

@ -1,29 +0,0 @@
From: tonyj@suse.de
Subject: VUL-0: audit buffer overflow
References: BNC# 378725
Upstream: auditd 1.7.2
Bugtraq ID: 28524 Linux Audit Daemon 'audit_log_user_command()' Local Buffer
Overflow Vulnerability.
This problem was found in Fedora when sudo was modified to call
audit_log_user_command.
Fix backported from auditd v1.7.2
diff -urp audit-1.6.5.orig/lib/audit_logging.c audit-1.6.5/lib/audit_logging.c
--- audit-1.6.5.orig/lib/audit_logging.c 2008-04-01 16:33:34.000000000 -0400
+++ audit-1.6.5/lib/audit_logging.c 2008-04-01 16:34:12.000000000 -0400
@@ -652,7 +652,11 @@ int audit_log_user_command(int audit_fd,
}
p = cmd;
- strcpy(commname, cmd);
+ if (len >= PATH_MAX) {
+ cmd[PATH_MAX] = 0;
+ len = PATH_MAX-1;
+ }
+ strcpy(commname,cmd);
while (*p) {
if (*p == '"' || *p < 0x21 || (unsigned)*p > 0x7f) {
_audit_c2x(commname, cmd, len);

32
audit-no_plugins.patch
View File

@ -5,24 +5,24 @@ Upsteam: never
Non builtin plugins is build as part of phase2 by audit-secondary.spec. Non builtin plugins is build as part of phase2 by audit-secondary.spec.
Conf files for builtins are still installed Conf files for builtins are still installed
--- audit-1.6.8/docs/Makefile.am.orig 2008-03-21 00:13:00.085158000 +0100 --- audit-1.7.2/audisp/plugins/Makefile.am.orig 2008-04-22 17:20:29.022441000 +0200
+++ audit-1.6.8/docs/Makefile.am 2008-03-21 00:13:42.551650000 +0100 +++ audit-1.7.2/audisp/plugins/Makefile.am 2008-04-22 17:20:36.657804000 +0200
@@ -47,6 +47,5 @@ @@ -22,7 +22,7 @@
ausearch_add_timestamp_item.3 ausearch_add_regex.3 ausearch_clear.3 \
ausearch_next_event.3 ausearch_set_stop.3 \
autrace.8 get_auditfail_action.3 set_aumessage_mode.3 \
-audispd.8 audispd.conf.5 audispd-zos-remote.8 zos-remote.conf.5 \
-audisp-prelude.8
+audispd.8 audispd.conf.5
--- audit-1.6.8/audisp/plugins/Makefile.am.orig 2008-03-21 00:38:10.727001000 +0100
+++ audit-1.6.8/audisp/plugins/Makefile.am 2008-03-21 00:38:34.320391000 +0100
@@ -23,7 +23,7 @@
CONFIG_CLEAN_FILES = Makefile.in *.loT *.rej *.orig CONFIG_CLEAN_FILES = Makefile.in *.loT *.rej *.orig
#SUBDIRS = builtins zos-remote remote -SUBDIRS = builtins zos-remote remote
-SUBDIRS = builtins zos-remote +SUBDIRS = builtins
+SUBDIRS = builtins #SUBDIRS = builtins zos-remote
if HAVE_PRELUDE if HAVE_PRELUDE
SUBDIRS += prelude SUBDIRS += prelude
endif
--- audit-1.7.2/docs/Makefile.am.orig 2008-04-22 17:21:45.409978000 +0200
+++ audit-1.7.2/docs/Makefile.am 2008-04-22 17:21:59.923451000 +0200
@@ -49,5 +49,5 @@
ausearch_clear.3 \
ausearch_next_event.3 ausearch_set_stop.3 \
autrace.8 get_auditfail_action.3 set_aumessage_mode.3 \
-audispd.8 audispd.conf.5 audispd-zos-remote.8 zos-remote.conf.5
+audispd.8 audispd.conf.5

4
audit-no_python.patch
View File

@ -20,9 +20,9 @@ there you have it.
fi fi
AM_CONDITIONAL(HAVE_PRELUDE, test x$have_prelude = xyes) AM_CONDITIONAL(HAVE_PRELUDE, test x$have_prelude = xyes)
-AC_OUTPUT(Makefile lib/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile swig/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile bindings/Makefile bindings/python/Makefile tools/Makefile tools/aulastlog/Makefile) -AC_OUTPUT(Makefile lib/Makefile lib/test/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile swig/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile bindings/Makefile bindings/python/Makefile tools/Makefile tools/aulastlog/Makefile tools/ausyscall/Makefile)
+# SuSE: remove swig/Makefile + bindings/Makefile + bindings/python/Makefile +# SuSE: remove swig/Makefile + bindings/Makefile + bindings/python/Makefile
+AC_OUTPUT(Makefile lib/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile tools/Makefile tools/aulastlog/Makefile) +AC_OUTPUT(Makefile lib/Makefile lib/test/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile tools/Makefile tools/aulastlog/Makefile tools/ausyscall/Makefile)
echo . echo .
echo " echo "

2
audit-no_sca.patch
View File

@ -11,7 +11,7 @@ Disable system-config-audit. A Yast equivalent would be useful though.
AM_CONDITIONAL(HAVE_PRELUDE, test x$have_prelude = xyes) AM_CONDITIONAL(HAVE_PRELUDE, test x$have_prelude = xyes)
-AC_CONFIG_SUBDIRS([system-config-audit]) -AC_CONFIG_SUBDIRS([system-config-audit])
AC_OUTPUT(Makefile lib/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile swig/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile bindings/Makefile bindings/python/Makefile tools/Makefile tools/aulastlog/Makefile) AC_OUTPUT(Makefile lib/Makefile lib/test/Makefile auparse/Makefile auparse/test/Makefile src/Makefile src/mt/Makefile swig/Makefile docs/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/prelude/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile bindings/Makefile bindings/python/Makefile tools/Makefile tools/aulastlog/Makefile tools/ausyscall/Makefile)
echo . echo .

40
audit-plugins-path.patch Normal file
View File

@ -0,0 +1,40 @@
From: Tony Jones <tonyj@suse.de>
Subject: Adjust location of plugins built by audit-secondary
Upsteam: never
Adjust location of plugins built by audit-secondary. These should never have
been in /sbin plus some (for SuSE) require lib dependancies on /usr/lib
--- audit-1.7.2/audisp/plugins/prelude/au-prelude.conf.orig 2008-04-23 11:56:11.946681000 +0200
+++ audit-1.7.2/audisp/plugins/prelude/au-prelude.conf 2008-04-23 11:56:22.789827000 +0200
@@ -5,7 +5,7 @@
active = no
direction = out
-path = /sbin/audisp-prelude
+path = /usr/sbin/audisp-prelude
type = always
#args =
format = string
--- audit-1.7.2/audisp/plugins/remote/au-remote.conf.orig 2008-04-23 11:56:11.976660000 +0200
+++ audit-1.7.2/audisp/plugins/remote/au-remote.conf 2008-04-23 11:56:30.958657000 +0200
@@ -5,7 +5,7 @@
active = no
direction = out
-path = /sbin/audisp-remote
+path = /usr/sbin/audisp-remote
type = always
#args =
format = string
--- audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf.orig 2008-04-23 11:56:11.993637000 +0200
+++ audit-1.7.2/audisp/plugins/zos-remote/audispd-zos-remote.conf 2008-04-23 11:56:40.533070000 +0200
@@ -8,7 +8,7 @@
active = no
direction = out
-path = /sbin/audispd-zos-remote
+path = /usr/sbin/audispd-zos-remote
type = always
args = /etc/audisp/zos-remote.conf
format = string

9
audit-secondary.changes
View File

@ -1,3 +1,12 @@
-------------------------------------------------------------------
Wed Jun 25 01:50:54 CEST 2008 - tonyj@suse.de
- Update from 1.7.2 to 1.7.4 (see audit.changes for upstream change
history)
- Update from 1.6.8 to 1.7.2 (see audit.changes for upstream change
history)
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Jun 3 21:49:41 CEST 2008 - coolo@suse.de Tue Jun 3 21:49:41 CEST 2008 - coolo@suse.de

25
audit-secondary.spec
View File

@ -1,5 +1,5 @@
# #
# spec file for package audit-secondary (Version 1.6.8) # spec file for package audit-secondary (Version 1.7.4)
# #
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. # Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine # This file and all modifications and additions to the pristine
@ -17,11 +17,12 @@ BuildRequires: audit audit-devel gcc-c++ openldap2-devel pkg-config python-deve
Summary: Python Bindings for libaudit Summary: Python Bindings for libaudit
License: GPL v2 or later License: GPL v2 or later
Group: System/Monitoring Group: System/Monitoring
Version: 1.6.8 Version: 1.7.4
Release: 6 Release: 1
Url: http://people.redhat.com/sgrubb/audit/ Url: http://people.redhat.com/sgrubb/audit/
Source0: audit-%{version}.tar.bz2 Source0: audit-%{version}.tar.bz2
Patch0: audit-no_sca.patch Patch0: audit-no_sca.patch
Patch1: audit-plugins-path.patch
Requires: audit = %{version}-%{release} Requires: audit = %{version}-%{release}
Requires: audit-libs = %{version}-%{release} Requires: audit-libs = %{version}-%{release}
BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRoot: %{_tmppath}/%{name}-%{version}-build
@ -76,6 +77,7 @@ rm -rf audisp/plugins/zos-remote/policy
rm -rf audisp/plugins/prelude rm -rf audisp/plugins/prelude
%setup -q -n audit-%{version} %setup -q -n audit-%{version}
%patch0 -p1 %patch0 -p1
%patch1 -p1
%build %build
autoreconf -fi autoreconf -fi
@ -101,7 +103,8 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/python%{py_ver}/site-packages/_audit.la
rm -f $RPM_BUILD_ROOT/%{_libdir}/python%{py_ver}/site-packages/auparse-1.0-py%{py_ver}.egg-info rm -f $RPM_BUILD_ROOT/%{_libdir}/python%{py_ver}/site-packages/auparse-1.0-py%{py_ver}.egg-info
# Cleanup plugins # Cleanup plugins
# audispd-zos-remote uses ldap which is in /usr/lib so move to /usr/sbin # audispd-zos-remote uses ldap which is in /usr/lib so move to /usr/sbin
mv $RPM_BUILD_ROOT/sbin/audispd-zos-remote $RPM_BUILD_ROOT/usr/sbin/audispd-zos-remote # audisp-remote shouldn't be in /sbin either, it's not 'essential'
mv $RPM_BUILD_ROOT/sbin/{audispd-zos-remote,audisp-remote} $RPM_BUILD_ROOT/usr/sbin
# af_unix/syslog (builtin) is packaged by main spec file # af_unix/syslog (builtin) is packaged by main spec file
rm -f $RPM_BUILD_ROOT/etc/audisp/plugins.d/{af_unix,syslog}.conf rm -f $RPM_BUILD_ROOT/etc/audisp/plugins.d/{af_unix,syslog}.conf
# Just need selecteed man pages # Just need selecteed man pages
@ -114,8 +117,8 @@ rm -rf $RPM_BUILD_ROOT
%files -n audit-libs-python %files -n audit-libs-python
%defattr(-,root,root,-) %defattr(-,root,root,-)
%{_libdir}/python%{py_ver}/site-packages/_audit.so %attr(755,root,root) %{_libdir}/python%{py_ver}/site-packages/_audit.so
%{_libdir}/python%{py_ver}/site-packages/auparse.so %attr(755,root,root) %{_libdir}/python%{py_ver}/site-packages/auparse.so
%{_libdir}/python%{py_ver}/site-packages/audit.py* %{_libdir}/python%{py_ver}/site-packages/audit.py*
%files -n audit-audispd-plugins %files -n audit-audispd-plugins
@ -125,8 +128,18 @@ rm -rf $RPM_BUILD_ROOT
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/audispd-zos-remote.conf %config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/audispd-zos-remote.conf
%config(noreplace) %attr(640,root,root) /etc/audisp/zos-remote.conf %config(noreplace) %attr(640,root,root) /etc/audisp/zos-remote.conf
%attr(750,root,root) /usr/sbin/audispd-zos-remote %attr(750,root,root) /usr/sbin/audispd-zos-remote
%config(noreplace) %attr(640,root,root) /etc/audisp/audisp-remote.conf
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/au-remote.conf
%attr(750,root,root) /usr/sbin/audisp-remote
%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
%changelog %changelog
* Wed Jun 25 2008 tonyj@suse.de
- Update from 1.7.2 to 1.7.4 (see audit.changes for upstream change
history)
- Update from 1.6.8 to 1.7.2 (see audit.changes for upstream change
history)
* Tue Jun 03 2008 coolo@suse.de * Tue Jun 03 2008 coolo@suse.de
- avoid packaging a directory with different permissions (creating - avoid packaging a directory with different permissions (creating
rpm -V output) rpm -V output)

77
audit.changes
View File

@ -1,3 +1,80 @@
-------------------------------------------------------------------
Wed Jun 25 01:50:54 CEST 2008 - tonyj@suse.de
- Update from 1.7.2 to 1.7.4
- Redhat changelog for 1.7.3 - 1.7.4 follows:
* Mon May 19 2008 Steve Grubb <sgrubb@redhat.com> 1.7.4-1
- Fix interpreting of keys in syscall records
- Interpret audit rule config change list fields
- Don't error on name=(null) PATH records in ausearch/report
- Add key report to aureport
- Fix --end today to be now
- Added python bindings for auparse_goto_record_num
- Update system-config-audit to 0.4.7 (Miloslav Trmac)
- Add support for the filetype field option in auditctl
- In audispd boost priority after starting children
* Fri May 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.3-1
- Fix path processing in AVC records.
- auparse_find_field_next() wasn't resetting field ptr going to next record.
- auparse_find_field() wasn't checking current field before iterating
- cleanup some string handling in audisp-prelude plugin
- Update auditctl man page
- Fix output of keys in ausearch interpretted mode
- Fix ausearch/report --start now to not be reset to midnight
- Added auparse_goto_record_num function
- Prelude plugin now uses auparse_goto_record_num to avoid skipping a record
- audispd now has a priority boost config option
- Look for laddr in avcs reported via prelude
- Detect page 0 mmaps and alert via prelude
- Update from 1.6.8 to 1.7.2
- Complete fix for BNC# 378725
- Redhat changelog for 1.6.9-1.7.2 follows:
* Wed Apr 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-1
- gen_table.c now includes IPC defines to avoid glibc-headers wild goose chase
- ausyscall program added for cross referencing syscall name and number info
- Add login session ID search capability to ausearch
* Tue Apr 08 2008 Steve Grubb <sgrubb@redhat.com> 1.7.1-1
- Remove LSB headers info for init scripts
- Fix buffer overflow in audit_log_user_command, again (#438840)
- Fix memory leak in EOE code in auditd (#440075)
- In auditctl, don't use new operators in legacy rule format
- Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
- Add example STIG rules file
- Add string table lookup performance improvement patch (Miloslav Trmac)
- auparse_find_field_next performance improvement
* Sun Mar 30 2008 Steve Grubb <sgrubb@redhat.com> 1.7-1
- Improve input error handling in audispd
- Improve end of event detection in auparse library
- Improve handling of abstract namespaces
- Add test mode for prelude plugin
- Handle user space avcs in prelude plugin
- Audit event serial number now recorded in idmef alert
- Add --just-one option to ausearch
- Fix watched account login detection for some failed login attempts
- Couple fixups in audit logging functions (Miloslav Trmac)
- Add support in auditctl for virtual keys
- Added new type for user space MAC policy load events
- auparse_find_field_next was not iterating correctly, fixed it
- Add idmef alerts for access or execution of watched file
- Fix buffer overflow in audit_log_user_command
- Add basic remote logging plugin - only sends & no flow control
- Update ausearch with interpret fixes from auparse
* Sun Mar 09 2008 Steve Grubb <sgrubb@redhat.com> 1.6.9-1
- Apply hidden attribute cleanup patch (Miloslav Trmac)
- Apply auparse expression interface patch (Miloslav Trmac)
- Fix potential memleak in audit event dispatcher
- Change default audispd queue depth to 80
- Update system-config-audit to version 0.4.6 (Miloslav Trmac)
- audisp-prelude alerts now controlled by config file
- Updated syscall table for 2.6.25 kernel
- Apply patch correcting acct field being misencoded (Miloslav Trmac)
- Added watched account login detection for prelude plugin
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Apr 23 14:17:17 CEST 2008 - tonyj@suse.de Wed Apr 23 14:17:17 CEST 2008 - tonyj@suse.de

85
audit.spec
View File

@ -1,5 +1,5 @@
# #
# spec file for package audit (Version 1.6.8) # spec file for package audit (Version 1.7.4)
# #
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. # Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine # This file and all modifications and additions to the pristine
@ -14,8 +14,8 @@
Name: audit Name: audit
BuildRequires: gcc-c++ BuildRequires: gcc-c++
Summary: User Space Tools for 2.6 Kernel Auditing Summary: User Space Tools for 2.6 Kernel Auditing
Version: 1.6.8 Version: 1.7.4
Release: 20 Release: 1
License: GPL v2 or later License: GPL v2 or later
Group: System/Monitoring Group: System/Monitoring
Url: http://people.redhat.com/sgrubb/audit/ Url: http://people.redhat.com/sgrubb/audit/
@ -25,7 +25,6 @@ Source2: auditd.sysconfig
Patch0: audit-no_sca.patch Patch0: audit-no_sca.patch
Patch1: audit-no_python.patch Patch1: audit-no_python.patch
Patch2: audit-no_plugins.patch Patch2: audit-no_plugins.patch
Patch3: audit-bnc378725.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRoot: %{_tmppath}/%{name}-%{version}-build
Requires: %{name}-libs = %{version}-%{release} Requires: %{name}-libs = %{version}-%{release}
PreReq: %insserv_prereq %fillup_prereq PreReq: %insserv_prereq %fillup_prereq
@ -78,7 +77,6 @@ Authors:
%patch0 -p1 %patch0 -p1
%patch1 -p1 %patch1 -p1
%patch2 -p1 %patch2 -p1
%patch3 -p1
%build %build
autoreconf -fi autoreconf -fi
@ -163,10 +161,11 @@ fi
%{_includedir}/auparse.h %{_includedir}/auparse.h
%{_includedir}/auparse-defs.h %{_includedir}/auparse-defs.h
%{_mandir}/man3/* %{_mandir}/man3/*
%{_mandir}/man5/ausearch-expression.5.gz
%files %files
%defattr(-,root,root,-) %defattr(-,root,root,-)
%doc README COPYING ChangeLog contrib/capp.rules contrib/nispom.rules contrib/lspp.rules init.d/auditd.cron %doc README COPYING ChangeLog contrib/capp.rules contrib/nispom.rules contrib/lspp.rules contrib/stig.rules init.d/auditd.cron
%attr(644,root,root) %{_mandir}/man8/audispd.8.gz %attr(644,root,root) %{_mandir}/man8/audispd.8.gz
%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz %attr(644,root,root) %{_mandir}/man8/auditd.8.gz
@ -174,6 +173,7 @@ fi
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz %attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
%attr(644,root,root) %{_mandir}/man8/autrace.8.gz %attr(644,root,root) %{_mandir}/man8/autrace.8.gz
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz %attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz
%attr(750,root,root) /sbin/auditctl %attr(750,root,root) /sbin/auditctl
@ -182,7 +182,8 @@ fi
%attr(750,root,root) /sbin/rcauditd %attr(750,root,root) /sbin/rcauditd
%attr(750,root,root) /sbin/autrace %attr(750,root,root) /sbin/autrace
%attr(750,root,root) /sbin/audispd %attr(750,root,root) /sbin/audispd
%attr(750,root,root) /sbin/aulastlog %attr(750,root,root) /usr/bin/aulastlog
%attr(755,root,root) /usr/bin/ausyscall
%attr(755,root,root) /sbin/aureport %attr(755,root,root) /sbin/aureport
/etc/init.d/auditd /etc/init.d/auditd
%dir %attr(750,root,root) /etc/audit %dir %attr(750,root,root) /etc/audit
@ -198,8 +199,78 @@ fi
/var/adm/fillup-templates/sysconfig.auditd /var/adm/fillup-templates/sysconfig.auditd
%dir %attr(700,root,root) /var/log/audit %dir %attr(700,root,root) /var/log/audit
%ghost %config(noreplace) /var/log/audit/audit.log %ghost %config(noreplace) /var/log/audit/audit.log
%attr(755,root,root) /usr/bin/ausyscall
%changelog %changelog
* Wed Jun 25 2008 tonyj@suse.de
- Update from 1.7.2 to 1.7.4
- Redhat changelog for 1.7.3 - 1.7.4 follows:
* Mon May 19 2008 Steve Grubb <sgrubb@redhat.com> 1.7.4-1
- Fix interpreting of keys in syscall records
- Interpret audit rule config change list fields
- Don't error on name=(null) PATH records in ausearch/report
- Add key report to aureport
- Fix --end today to be now
- Added python bindings for auparse_goto_record_num
- Update system-config-audit to 0.4.7 (Miloslav Trmac)
- Add support for the filetype field option in auditctl
- In audispd boost priority after starting children
* Fri May 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.3-1
- Fix path processing in AVC records.
- auparse_find_field_next() wasn't resetting field ptr going to next record.
- auparse_find_field() wasn't checking current field before iterating
- cleanup some string handling in audisp-prelude plugin
- Update auditctl man page
- Fix output of keys in ausearch interpretted mode
- Fix ausearch/report --start now to not be reset to midnight
- Added auparse_goto_record_num function
- Prelude plugin now uses auparse_goto_record_num to avoid skipping a record
- audispd now has a priority boost config option
- Look for laddr in avcs reported via prelude
- Detect page 0 mmaps and alert via prelude
- Update from 1.6.8 to 1.7.2
- Complete fix for BNC# 378725
- Redhat changelog for 1.6.9-1.7.2 follows:
* Wed Apr 09 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-1
- gen_table.c now includes IPC defines to avoid glibc-headers wild goose chase
- ausyscall program added for cross referencing syscall name and number info
- Add login session ID search capability to ausearch
* Tue Apr 08 2008 Steve Grubb <sgrubb@redhat.com> 1.7.1-1
- Remove LSB headers info for init scripts
- Fix buffer overflow in audit_log_user_command, again (#438840)
- Fix memory leak in EOE code in auditd (#440075)
- In auditctl, don't use new operators in legacy rule format
- Made a couple corrections in alpha & x86_64 syscall tables (Miloslav Trmac)
- Add example STIG rules file
- Add string table lookup performance improvement patch (Miloslav Trmac)
- auparse_find_field_next performance improvement
* Sun Mar 30 2008 Steve Grubb <sgrubb@redhat.com> 1.7-1
- Improve input error handling in audispd
- Improve end of event detection in auparse library
- Improve handling of abstract namespaces
- Add test mode for prelude plugin
- Handle user space avcs in prelude plugin
- Audit event serial number now recorded in idmef alert
- Add --just-one option to ausearch
- Fix watched account login detection for some failed login attempts
- Couple fixups in audit logging functions (Miloslav Trmac)
- Add support in auditctl for virtual keys
- Added new type for user space MAC policy load events
- auparse_find_field_next was not iterating correctly, fixed it
- Add idmef alerts for access or execution of watched file
- Fix buffer overflow in audit_log_user_command
- Add basic remote logging plugin - only sends & no flow control
- Update ausearch with interpret fixes from auparse
* Sun Mar 09 2008 Steve Grubb <sgrubb@redhat.com> 1.6.9-1
- Apply hidden attribute cleanup patch (Miloslav Trmac)
- Apply auparse expression interface patch (Miloslav Trmac)
- Fix potential memleak in audit event dispatcher
- Change default audispd queue depth to 80
- Update system-config-audit to version 0.4.6 (Miloslav Trmac)
- audisp-prelude alerts now controlled by config file
- Updated syscall table for 2.6.25 kernel
- Apply patch correcting acct field being misencoded (Miloslav Trmac)
- Added watched account login detection for prelude plugin
* Wed Apr 23 2008 tonyj@suse.de * Wed Apr 23 2008 tonyj@suse.de
- Fix for bnc#378725 VUL-0: audit buffer overflow - Fix for bnc#378725 VUL-0: audit buffer overflow
* Thu Apr 10 2008 ro@suse.de * Thu Apr 10 2008 ro@suse.de