rpm/audit
SHA256
1
0
Fork 0
forked from pool/audit
Code Pull Requests Activity

Accepting request 1096509 from home:polslinux:branches:security

Browse Source 
- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program 
- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program

OBS-URL: https://build.opensuse.org/request/show/1096509
OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=148
This commit is contained in:
Wolfgang Frisch 2023-07-03 14:59:58 +00:00 committed by Git OBS Bridge
parent e8c281ed5c
commit d1358f4337
10 changed files with 47 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
audit-3.1.1.tar.gz (Stored with Git LFS) Normal file
View File

Binary file not shown.

3
audit-3.1.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:b5cf3cdabb2786c08b1de3599a3b1a547e55f7a9f9c1eb2078f5b44cf44e8378
size 1215931

8
audit-ausearch-do-not-require-tclass.patch
View File

@ -9,11 +9,11 @@ Signed-off-by: Tony Jones <tonyj@suse.de>
src/ausearch-parse.c | 18 ++++++++---------- src/ausearch-parse.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-) 1 file changed, 8 insertions(+), 10 deletions(-)
Index: audit-3.0.9/src/ausearch-parse.c Index: audit-3.1.1/src/ausearch-parse.c
=================================================================== ===================================================================
--- audit-3.0.9.orig/src/ausearch-parse.c --- audit-3.1.1.orig/src/ausearch-parse.c
+++ audit-3.0.9/src/ausearch-parse.c +++ audit-3.1.1/src/ausearch-parse.c
@@ -2062,17 +2062,15 @@ other_avc: @@ -2075,17 +2075,15 @@ other_avc:
// Now get the class...its at the end, so we do things different // Now get the class...its at the end, so we do things different
str = strstr(term, "tclass="); str = strstr(term, "tclass=");

10
audit-secondary.changes
View File

@ -1,3 +1,13 @@
-------------------------------------------------------------------
Mon Jul 3 08:34:22 UTC 2023 - Paolo Stivanin <info@paolostivanin.com>
- Update to 3.1.1:
* Add user friendly keywords for signals to auditctl
* In ausearch, parse up URINGOP and DM_CTRL records
* Harden auparse to better handle corrupt logs
* Fix a CFLAGS propogation problem in the common directory
* Move the audispd af_unix plugin to a standalone program
------------------------------------------------------------------- -------------------------------------------------------------------
Thu May 4 12:58:06 UTC 2023 - Frederic Crozat <fcrozat@suse.com> Thu May 4 12:58:06 UTC 2023 - Frederic Crozat <fcrozat@suse.com>

2
audit-secondary.spec
View File

@ -22,7 +22,7 @@
# The seperation is required to minimize unnecessary build cycles. # The seperation is required to minimize unnecessary build cycles.
%define _name audit %define _name audit
Name: audit-secondary Name: audit-secondary
Version: 3.1 Version: 3.1.1
Release: 0 Release: 0
Summary: Linux kernel audit subsystem utilities Summary: Linux kernel audit subsystem utilities
License: GPL-2.0-or-later License: GPL-2.0-or-later

10
audit.changes
View File

@ -1,3 +1,13 @@
-------------------------------------------------------------------
Mon Jul 3 08:33:52 UTC 2023 - Paolo Stivanin <info@paolostivanin.com>
- Update to 3.1.1:
* Add user friendly keywords for signals to auditctl
* In ausearch, parse up URINGOP and DM_CTRL records
* Harden auparse to better handle corrupt logs
* Fix a CFLAGS propogation problem in the common directory
* Move the audispd af_unix plugin to a standalone program
------------------------------------------------------------------- -------------------------------------------------------------------
Thu May 4 12:58:06 UTC 2023 - Frederic Crozat <fcrozat@suse.com> Thu May 4 12:58:06 UTC 2023 - Frederic Crozat <fcrozat@suse.com>

2
audit.spec
View File

@ -23,7 +23,7 @@
%endif %endif
Name: audit Name: audit
Version: 3.1 Version: 3.1.1
Release: 0 Release: 0
Summary: Linux kernel audit subsystem utilities Summary: Linux kernel audit subsystem utilities
License: GPL-2.0-or-later License: GPL-2.0-or-later

18
create-augenrules-service.patch
View File

@ -1,7 +1,7 @@
Index: audit-3.0.9/init.d/augenrules.service Index: audit-3.1.1/init.d/augenrules.service
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ audit-3.0.9/init.d/augenrules.service +++ audit-3.1.1/init.d/augenrules.service
@@ -0,0 +1,29 @@ @@ -0,0 +1,29 @@
+[Unit] +[Unit]
+Description=auditd rules generation +Description=auditd rules generation
@ -32,10 +32,10 @@ Index: audit-3.0.9/init.d/augenrules.service
+ProtectKernelTunables=true +ProtectKernelTunables=true
+ProtectKernelLogs=true +ProtectKernelLogs=true
+ReadWritePaths=/etc/audit +ReadWritePaths=/etc/audit
Index: audit-3.0.9/init.d/auditd.service Index: audit-3.1.1/init.d/auditd.service
=================================================================== ===================================================================
--- audit-3.0.9.orig/init.d/auditd.service --- audit-3.1.1.orig/init.d/auditd.service
+++ audit-3.0.9/init.d/auditd.service +++ audit-3.1.1/init.d/auditd.service
@@ -15,15 +15,16 @@ ConditionKernelCommandLine=!audit=0 @@ -15,15 +15,16 @@ ConditionKernelCommandLine=!audit=0
ConditionKernelCommandLine=!audit=off ConditionKernelCommandLine=!audit=off
@ -57,7 +57,7 @@ Index: audit-3.0.9/init.d/auditd.service
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules #ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
# By default we clear the rules on exit. To disable this, comment # By default we clear the rules on exit. To disable this, comment
# the next line after copying the file to /etc/systemd/system/auditd.service # the next line after copying the file to /etc/systemd/system/auditd.service
@@ -46,7 +47,6 @@ ProtectClock=true @@ -47,7 +48,6 @@ ProtectClock=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectKernelLogs=true ProtectKernelLogs=true
# end of automatic additions # end of automatic additions
@ -65,10 +65,10 @@ Index: audit-3.0.9/init.d/auditd.service
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
Index: audit-3.0.9/init.d/Makefile.am Index: audit-3.1.1/init.d/Makefile.am
=================================================================== ===================================================================
--- audit-3.0.9.orig/init.d/Makefile.am --- audit-3.1.1.orig/init.d/Makefile.am
+++ audit-3.0.9/init.d/Makefile.am +++ audit-3.1.1/init.d/Makefile.am
@@ -26,7 +26,8 @@ EXTRA_DIST = auditd.init auditd.service @@ -26,7 +26,8 @@ EXTRA_DIST = auditd.init auditd.service
auditd.cron libaudit.conf auditd.condrestart \ auditd.cron libaudit.conf auditd.condrestart \
auditd.reload auditd.restart auditd.resume \ auditd.reload auditd.restart auditd.resume \

8
fix-hardened-service.patch
View File

@ -12,11 +12,11 @@ Also remove PrivateDevices=true so /dev/* are exposed to auditd.
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de> Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Index: audit-3.0.9/init.d/auditd.service Index: audit-3.1.1/init.d/auditd.service
=================================================================== ===================================================================
--- audit-3.0.9.orig/init.d/auditd.service --- audit-3.1.1.orig/init.d/auditd.service
+++ audit-3.0.9/init.d/auditd.service +++ audit-3.1.1/init.d/auditd.service
@@ -41,12 +41,12 @@ RestrictRealtime=true @@ -42,12 +42,12 @@ RestrictRealtime=true
# added automatically, for details please see # added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort # https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full ProtectSystem=full

10
harden_auditd.service.patch
View File

@ -1,9 +1,9 @@
Index: audit-3.0.9/init.d/auditd.service Index: audit-3.1.1/init.d/auditd.service
=================================================================== ===================================================================
--- audit-3.0.9.orig/init.d/auditd.service --- audit-3.1.1.orig/init.d/auditd.service
+++ audit-3.0.9/init.d/auditd.service +++ audit-3.1.1/init.d/auditd.service
@@ -38,6 +38,15 @@ LockPersonality=true @@ -39,6 +39,15 @@ LockPersonality=true
ProtectControlGroups=true #ProtectControlGroups=true
ProtectKernelModules=true ProtectKernelModules=true
RestrictRealtime=true RestrictRealtime=true
+# added automatically, for details please see +# added automatically, for details please see