rpm/audit
SHA256
1
0
Fork 0
forked from pool/audit
Code Pull Requests Activity

Accepting request 867563 from home:ematsumiya:branches:security

Browse Source 
- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec

OBS-URL: https://build.opensuse.org/request/show/867563
OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=116
This commit is contained in:
Marcus Meissner 2021-01-30 08:05:50 +00:00 committed by Git OBS Bridge
parent da2300c646
commit d19eedf2c5
5 changed files with 60 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
audit-secondary.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Thu Jan 28 17:59:43 UTC 2021 - Enzo Matsumiya <ematsumiya@suse.com>
- Create new "audit" group for read access to logs (bsc#1178154)
* add change-default-log_group.patch
* update audit-secondary.spec
-------------------------------------------------------------------
Wed Dec 2 11:49:28 UTC 2020 - Alexander Bergmann <abergmann@suse.com>

30
audit-secondary.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package audit-secondary
#
# Copyright (c) 2020 SUSE LLC
# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -29,12 +29,14 @@ License: GPL-2.0-or-later
Group: System/Monitoring
URL: http://people.redhat.com/sgrubb/audit/
Source0: http://people.redhat.com/sgrubb/audit/%{_name}-%{version}.tar.gz
Source1: system-group-audit.conf
Patch1: audit-plugins-path.patch
Patch2: audit-no-gss.patch
Patch3: audit-allow-manual-stop.patch
Patch4: audit-ausearch-do-not-require-tclass.patch
Patch5: audit-python3.patch
Patch6: audit-fno-common.patch
Patch7: change-default-log_group.patch
BuildRequires: audit-devel = %{version}
BuildRequires: autoconf >= 2.12
BuildRequires: gcc-c++
@ -50,6 +52,7 @@ BuildRequires: python3-devel
%endif
BuildRequires: swig
BuildRequires: systemd-rpm-macros
BuildRequires: sysuser-tools
BuildRequires: tcpd-devel
BuildRequires: pkgconfig(libcap-ng)
@ -64,6 +67,7 @@ License: LGPL-2.1-or-later
Group: System/Monitoring
Requires: %{_name}-libs = %{version}
Requires: coreutils
Requires: group(audit)
%{?systemd_ordering}
%description -n audit
@ -71,6 +75,16 @@ The audit package contains the user space utilities for storing and
processing the audit records generated by the audit subsystem in the
Linux kernel.
%package -n system-group-audit
Summary: System group 'audit'
License: LGPL-2.1-or-later
Group: System/Fhs
Provides: group(audit)
%sysusers_requires
%description -n system-group-audit
This package contains the system group 'audit' for read access to logs.
%package -n python2-audit
Summary: Python Bindings for libaudit
License: LGPL-2.1-or-later
@ -114,6 +128,7 @@ rm -rf audisp/plugins/prelude
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%if %{without python2} && %{with python3}
# Fix python env call in tests if we only have Python3.
@ -141,12 +156,16 @@ export LDFLAGS="-Wl,-z,relro,-z,now"
--disable-static
make %{?_smp_mflags}
%sysusers_generate_pre %{SOURCE1} audit
%install
%make_install
mkdir -p %{buildroot}%{_localstatedir}/log/audit/
touch %{buildroot}%{_localstatedir}/log/audit/audit.log
mkdir -p %{buildroot}%{_localstatedir}/spool/audit/
mkdir -p %{buildroot}%{_sysusersdir}
install -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/
# For ghost below, so that old location files will still be there when
# post copy runs
mkdir -p %{buildroot}%{_sysconfdir}/%{_name}/
@ -207,6 +226,8 @@ fi
%pre -n audit
%service_add_pre auditd.service
%pre -n system-group-audit -f audit.pre
%preun -n audit
%service_del_preun auditd.service
@ -263,12 +284,15 @@ fi
%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/rules.d/audit.rules
%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audispd.conf
%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audit-stop.rules
%dir %attr(700,root,root) %{_localstatedir}/log/audit
%ghost %config(noreplace) %{_localstatedir}/log/audit/audit.log
%dir %attr(750,root,audit) %{_localstatedir}/log/audit
%ghost %config(noreplace) %attr(640,root,audit) %{_localstatedir}/log/audit/audit.log
%dir %attr(700,root,root) %{_localstatedir}/spool/audit
%{_unitdir}/auditd.service
%{_sbindir}/rcauditd
%files -n system-group-audit
%{_sysusersdir}/system-group-audit.conf
%if %{with python2}
%files -n python2-audit
%attr(755,root,root) %{python2_sitearch}/_audit.so

4
audit.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package audit
#
# Copyright (c) 2020 SUSE LLC
# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -26,6 +26,7 @@ URL: http://people.redhat.com/sgrubb/audit/
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
Source1: baselibs.conf
Source2: README-BEFORE-ADDING-PATCHES
Patch0: change-default-log_group.patch
BuildRequires: autoconf >= 2.12
BuildRequires: gcc-c++
BuildRequires: kernel-headers >= 2.6.30
@ -74,6 +75,7 @@ libraries.
%prep
%setup -q
%patch0 -p1
%build
autoreconf -fi

21
change-default-log_group.patch Normal file
View File

@ -0,0 +1,21 @@
From: Enzo Matsumiya <ematsumiya@suse.de>
Date: Thu Jan 28 18:11:39 UTC 2021
References: bsc#1178154
Patch-mainline: Not yet, under review
Subject: change default log_group to "audit"
Change the default log_group to newly added "audit" group.
Signed-Off-by: Enzo Matsumiya <ematsumiya@suse.de>
--- a/init.d/auditd.conf
+++ b/init.d/auditd.conf
@@ -5,7 +5,7 @@
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
-log_group = root
+log_group = audit
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50

2
system-group-audit.conf Normal file
View File

@ -0,0 +1,2 @@
# Type Name ID GECOS [HOME]
g audit -