forked from pool/audit
Accepting request 209349 from home:jones_tony:branches:security
OBS-URL: https://build.opensuse.org/request/show/209349 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=57
This commit is contained in:
Tony Jones
Git OBS Bridge
parent
369b484525
commit
ca9983ce34
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:2fc8f97020121593f516dc011ef61f39043c4cea9b2cb9ab3849bf9e41dedf02
|
||||
size 910762
|
||||
3
audit-2.3.2.tar.gz
Normal file
3
audit-2.3.2.tar.gz
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:8872e0b5392888789061db8034164305ef0e1b34543e1e7004d275f039081d29
|
||||
size 947897
|
||||
23
audit-allow-manual-stop.patch
Normal file
23
audit-allow-manual-stop.patch
Normal file
@ -0,0 +1,23 @@
|
||||
From: Tony Jones <tonyj@suse.de>
|
||||
Subject: allow service stop
|
||||
References: https://lists.fedoraproject.org/pipermail/devel/2012-June/169411.html
|
||||
References: https://www.redhat.com/archives/linux-audit/2013-July/msg00048.html
|
||||
---
|
||||
|
||||
legacy-actions is Fedora specific, so blocking manual stop won't work for
|
||||
SuSE since we lack the ability to use a custom stop/restart
|
||||
|
||||
|
||||
init.d/auditd.service | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
--- a/init.d/auditd.service
|
||||
+++ b/init.d/auditd.service
|
||||
@@ -4,7 +4,6 @@ DefaultDependencies=no
|
||||
After=local-fs.target
|
||||
Conflicts=shutdown.target
|
||||
Before=sysinit.target shutdown.target
|
||||
-RefuseManualStop=yes
|
||||
|
||||
[Service]
|
||||
ExecStart=/sbin/auditd -n
|
||||
@ -1,3 +1,14 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Nov 26 18:28:58 UTC 2013 - tonyj@suse.com
|
||||
|
||||
- Update to version 2.3.2. See audit.spec (libaudit1) for upstream
|
||||
changelog
|
||||
- Drop patch 'audit-fix-implicit-defn.patch' (upstream)
|
||||
- Add patch 'audit-allow-manual-stop.patch' to reinstate service
|
||||
stop/restart.
|
||||
- /etc/sysconfig/audit still existed but was no longer referenced
|
||||
by systemd, so remove
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Oct 2 12:48:50 UTC 2013 - opensuse@cboltz.de
|
||||
|
||||
|
||||
@ -30,17 +30,15 @@ BuildRequires: swig
|
||||
Summary: Secondary packages for audit
|
||||
License: GPL-2.0+
|
||||
Group: System/Monitoring
|
||||
Version: 2.2.3
|
||||
Version: 2.3.2
|
||||
Release: 0
|
||||
Url: http://people.redhat.com/sgrubb/audit/
|
||||
Source0: http://people.redhat.com/sgrubb/audit/%{_name}-%{version}.tar.gz
|
||||
Source2: auditd.sysconfig
|
||||
Patch1: audit-plugins-path.patch
|
||||
Patch2: audit-no-gss.patch
|
||||
Patch3: audit-no_m4_dir.patch
|
||||
Patch4: audit-fix-implicit-defn.patch
|
||||
Patch4: audit-allow-manual-stop.patch
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
PreReq: %insserv_prereq %fillup_prereq
|
||||
BuildRequires: audit-devel = %{version}
|
||||
BuildRequires: autoconf >= 2.12
|
||||
BuildRequires: gcc-c++
|
||||
@ -108,19 +106,17 @@ export LDFLAGS="-Wl,-z,relro,-z,now"
|
||||
%{__make} %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/{sysconfig,audispd/plugins.d,init.d}}
|
||||
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/{audispd/plugins.d,init.d}}
|
||||
mkdir -p $RPM_BUILD_ROOT/usr/sbin
|
||||
mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
|
||||
make DESTDIR=$RPM_BUILD_ROOT install
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/var/adm/fillup-templates
|
||||
cp %{SOURCE2} $RPM_BUILD_ROOT/var/adm/fillup-templates/sysconfig.auditd
|
||||
mkdir -p $RPM_BUILD_ROOT/var/log/audit/
|
||||
touch $RPM_BUILD_ROOT/var/log/audit/audit.log
|
||||
mkdir -p $RPM_BUILD_ROOT/var/spool/audit/
|
||||
# For ghost below, so that old location files will still be there when
|
||||
# post copy runs
|
||||
touch $RPM_BUILD_ROOT/etc/{auditd.conf,audit.rules}
|
||||
touch $RPM_BUILD_ROOT/etc/{auditd.conf,audit.rules} $RPM_BUILD_ROOT/etc/audit/auditd.conf
|
||||
# On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
|
||||
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
||||
|
||||
@ -128,6 +124,9 @@ touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
||||
rm -rf $RPM_BUILD_ROOT/etc/sysconfig/auditd
|
||||
rm -rf $RPM_BUILD_ROOT/etc/init.d/auditd
|
||||
rm -rf $RPM_BUILD_ROOT/etc/rc.d/init.d
|
||||
# delete redhat systemd legacy scripts, our systemd doesn't support the feature
|
||||
# https://lists.fedoraproject.org/pipermail/devel/2012-June/169411.html
|
||||
rm -rf $RPM_BUILD_ROOT/usr/lib/audit
|
||||
# Clean up some unneeded library files
|
||||
rm -f $RPM_BUILD_ROOT/%{_libdir}/python%{py_ver}/site-packages/_audit.a
|
||||
rm -f $RPM_BUILD_ROOT/%{_libdir}/python%{py_ver}/site-packages/_audit.la
|
||||
@ -147,7 +146,7 @@ rm -rf $RPM_BUILD_ROOT/%{_mandir}/man3
|
||||
# audisp-remote shouldn't be in /sbin either, it's not 'essential'
|
||||
mv $RPM_BUILD_ROOT/sbin/{audispd-zos-remote,audisp-remote} $RPM_BUILD_ROOT/usr/sbin
|
||||
#USR-MERGE
|
||||
for prog in auditctl auditd ausearch autrace audispd aureport; do
|
||||
for prog in auditctl auditd ausearch autrace audispd aureport augenrules; do
|
||||
[ \! -f %{buildroot}/sbin/$prog ] || mv %{buildroot}/sbin/$prog %{buildroot}/usr/sbin/$prog
|
||||
ln -s %{_prefix}/sbin/$prog %{buildroot}/sbin/$prog
|
||||
done
|
||||
@ -159,15 +158,15 @@ done
|
||||
make check
|
||||
|
||||
%post -n audit
|
||||
%{fillup_only -n auditd}
|
||||
# Save existing audit files if any (from old location)
|
||||
# Save existing audit files if any (from old locations)
|
||||
if [ -f /etc/auditd.conf ]; then
|
||||
mv /etc/audit/auditd.conf /etc/audit/auditd.conf.new
|
||||
mv /etc/auditd.conf /etc/audit/auditd.conf
|
||||
fi
|
||||
if [ -f /etc/audit.rules ]; then
|
||||
mv /etc/audit/audit.rules /etc/audit/audit.rules.new
|
||||
mv /etc/audit.rules /etc/audit/audit.rules
|
||||
elif [ ! -f /etc/audit/auditd.conf ]; then
|
||||
cp /etc/audit/rules.d/audit.rules /etc/audit/audit.rules
|
||||
fi
|
||||
%service_add_post auditd.service
|
||||
|
||||
@ -197,20 +196,23 @@ fi
|
||||
%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz
|
||||
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
|
||||
%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
|
||||
%attr(750,root,root) /sbin/auditctl
|
||||
%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
|
||||
/sbin/auditctl
|
||||
%attr(750,root,root) /usr/sbin/auditctl
|
||||
%attr(750,root,root) /sbin/auditd
|
||||
/sbin/auditd
|
||||
%attr(750,root,root) /usr/sbin/auditd
|
||||
%attr(755,root,root) /sbin/ausearch
|
||||
/sbin/ausearch
|
||||
%attr(755,root,root) /usr/sbin/ausearch
|
||||
%attr(750,root,root) /sbin/autrace
|
||||
/sbin/autrace
|
||||
%attr(750,root,root) /usr/sbin/autrace
|
||||
%attr(750,root,root) /sbin/audispd
|
||||
/sbin/audispd
|
||||
%attr(750,root,root) /usr/sbin/augenrules
|
||||
/sbin/augenrules
|
||||
%attr(750,root,root) /usr/sbin/audispd
|
||||
%attr(755,root,root) /usr/bin/aulast
|
||||
%attr(755,root,root) /usr/bin/aulastlog
|
||||
%attr(755,root,root) /usr/bin/ausyscall
|
||||
%attr(755,root,root) /sbin/aureport
|
||||
/sbin/aureport
|
||||
%attr(755,root,root) /usr/sbin/aureport
|
||||
%attr(755,root,root) /usr/bin/auvirt
|
||||
%dir %attr(750,root,root) /etc/audit
|
||||
@ -220,10 +222,10 @@ fi
|
||||
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/syslog.conf
|
||||
%ghost /etc/auditd.conf
|
||||
%ghost /etc/audit.rules
|
||||
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
|
||||
%config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
|
||||
%dir %attr(750,root,root) /etc/audit/rules.d
|
||||
%config %attr(640,root,root) /etc/audit/rules.d/audit.rules
|
||||
%ghost /etc/audit/auditd.conf
|
||||
%config(noreplace) %attr(640,root,root) /etc/audisp/audispd.conf
|
||||
/var/adm/fillup-templates/sysconfig.auditd
|
||||
%dir %attr(700,root,root) /var/log/audit
|
||||
%ghost %config(noreplace) /var/log/audit/audit.log
|
||||
%dir %attr(700,root,root) /var/spool/audit
|
||||
|
||||
@ -1,3 +1,56 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Nov 26 18:26:57 UTC 2013 - tonyj@suse.com
|
||||
|
||||
- Update to version 2.3.2
|
||||
|
||||
Changelog 2.3.2
|
||||
- Put RefuseManualStop in the right systemd section (#969345)
|
||||
- Add legacy restart scripts for systemd support
|
||||
- Add more syscall argument interpretations
|
||||
- Add 'unset' keyword for uid & gid values in auditctl
|
||||
- In ausearch, parse obj in IPC records
|
||||
- In ausearch, parse subj in DAEMON_ROTATE records
|
||||
- Fix interpretation of MQ_OPEN and MQ_NOTIFY events
|
||||
- In auditd, restart dispatcher on SIGHUP if it had previously exited
|
||||
- In audispd, exit when no active plugins are detected on reconfigure
|
||||
- In audispd, clear signal mask set by libev so that SIGHUP works again
|
||||
- In audispd, track binary plugins and restart if binary was updated
|
||||
- In audispd, make sure we send signals to the correct process
|
||||
- In auditd, clear signal mask when spawning any child process
|
||||
- In audispd, make builtin plugins respond to SIGHUP
|
||||
- In auparse, interpret mode flags of open syscall if O_CREAT is passed
|
||||
- In audisp-remote, don't make address lookup always a permanent failure
|
||||
- In audisp-remote, remove EOE events more efficiently
|
||||
- In auditd, log the reason when email account is not valid
|
||||
- In audisp-remote, change default remote_ending action to reconnect
|
||||
- Add support for Aarch64 processors
|
||||
|
||||
Changelog 2.3.1
|
||||
- Rearrange auditd setting enabled and pid to avoid a race (#910568)
|
||||
- Interpret the ocomm field from OBJ_PID records
|
||||
- Fix missing 'then' statement in sysvinit script
|
||||
- Switch ausearch to use libauparse for interpretting fields
|
||||
- In libauparse, interpret prctl arg0, sched_setscheduler arg1
|
||||
- In auparse, check source_list isn't NULL when opening next file (Liequan Che)
|
||||
- In libauparse, interpret send* flags argument
|
||||
- In libauparse, interpret level and name options for set/getsockopt
|
||||
- In ausearch/report, don't flush events until last file (Burn Alting)
|
||||
- Don't use systemctl to stop the audit daemon
|
||||
|
||||
Changelog 2.3
|
||||
- The clone(2) man page is really clone(3), fix interpretation of clone syscall
|
||||
- Add systemd support for reload (#901533)
|
||||
- Allow -F msgtype on the user filter
|
||||
- Add legacy support for resuming logging under systemd (#830780)
|
||||
- Add legacy support for rotating logs under systemd (#916611)
|
||||
- In auditd, collect SIGUSR2 info for DAEMON_RESUME events
|
||||
- Updated man pages
|
||||
- Update libev to 4.15
|
||||
- Update syscall tables for 3.9 kernel
|
||||
- Interpret MQ_OPEN events
|
||||
- Add augenrules support (Burn Alting)
|
||||
- Consume less stack sending audit events
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 28 09:30:54 UTC 2013 - coolo@suse.com
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ Name: audit
|
||||
Summary: First part of auditing package
|
||||
License: GPL-2.0+
|
||||
Group: System/Monitoring
|
||||
Version: 2.2.3
|
||||
Version: 2.3.2
|
||||
Release: 0
|
||||
Url: http://people.redhat.com/sgrubb/audit/
|
||||
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
|
||||
|
||||
Loading…
Reference in New Issue
Block a user