forked from pool/audit
Marcus Meissner
1dfe6ebd81
- Update to version 2.2.1, see audit's changes - update to 2.2.1, upstream changelog: 2.2.1 - Add more interpretations in auparse for syscall parameters - Add some interpretations to ausearch for syscall parameters - In ausearch/report and auparse, allocate extra space for node names - Update syscall tables for the 3.3.0 kernel - Update libev to 4.0.4 - Reduce the size of some applications - In auditctl, check usage against euid rather than uid 2.2 - Correct all rules for clock_settime - Fix possible segfault in auparse library - Handle malformed socket addresses better - Improve performance in audit_log_user_message() - Improve performance in writing to the log file in auditd - Syscall update for accept4 and recvmmsg - Update autrace resource usage mode syscall list - Improved sample rules for recent syscalls - Add some debug info to audisp-remote startup and shutdown - Make compiling with Python optional - In auditd, if disk_error_action is ignore, don't syslog anything - Fix some memory leaks - If audispd is stopping, don't restart children - Add support in auditctl for shell escaped filenames (Alexander) - Add search support for virt events (Marcelo Cerri) - Update interpretation tables - Sync auparse's auditd config parser with auditd's parser OBS-URL: https://build.opensuse.org/request/show/137972 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=39
233 lines
7.8 KiB
RPMSpec
233 lines
7.8 KiB
RPMSpec
#
|
|
# spec file for package audit
|
|
#
|
|
# Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
Name: audit
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: kernel-headers >= 2.6.29
|
|
BuildRequires: libtool
|
|
BuildRequires: tcpd-devel
|
|
Summary: User Space Tools for 2.6 Kernel Auditing
|
|
License: GPL-2.0+
|
|
Group: System/Monitoring
|
|
Version: 2.2.1
|
|
Release: 0
|
|
Url: http://people.redhat.com/sgrubb/audit/
|
|
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
|
|
Source1: auditd.init
|
|
Source2: auditd.sysconfig
|
|
Source3: baselibs.conf
|
|
Source4: README-BEFORE-ADDING-PATCHES
|
|
Patch2: audit-no_plugins.patch
|
|
Patch3: audit-no-gss.patch
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
|
Requires: %{name}-libs = %{version}
|
|
PreReq: %insserv_prereq %fillup_prereq
|
|
|
|
%description
|
|
The audit package contains the user space utilities for storing and
|
|
processing the audit records generated by the audit subsystem in the
|
|
Linux 2.6 kernel.
|
|
|
|
%package -n libaudit1
|
|
Summary: Dynamic library for libaudit
|
|
License: LGPL-2.1+
|
|
Group: System/Monitoring
|
|
Obsoletes: %{name}-libs < 2.0.4
|
|
Provides: %{name}-libs = %{version}
|
|
|
|
%description -n libaudit1
|
|
The libaudit package contains the dynamic libraries needed for
|
|
applications to use the audit framework.
|
|
|
|
%package -n libauparse0
|
|
Summary: Dynamic library for libauparse
|
|
License: LGPL-2.1+
|
|
Group: System/Monitoring
|
|
|
|
%description -n libauparse0
|
|
The libauparse package contains the dynamic libraries needed to
|
|
parse audit records.
|
|
|
|
%package devel
|
|
Summary: Header files and static library for libaudit
|
|
License: LGPL-2.1+
|
|
Group: Development/Libraries/C and C++
|
|
Requires: libaudit1 = %{version}
|
|
Requires: libauparse0 = %{version}
|
|
|
|
%description devel
|
|
The audit-devel package contains the static libraries and header files
|
|
needed for developing applications that need to use the audit framework
|
|
libraries.
|
|
|
|
%prep
|
|
%setup -q
|
|
%patch2 -p1
|
|
%patch3 -p1
|
|
|
|
%build
|
|
autoreconf -fi
|
|
export CFLAGS="%{optflags} -fno-strict-aliasing"
|
|
export CXXFLAGS="$CFLAGS"
|
|
export LDFLAGS="-Wl,-z,relro,-z,now"
|
|
# no krb support (omit --enable-gssapi-krb5=yes), see audit-no-gss.patch
|
|
%configure --libexecdir=%{_prefix}/lib/%{name} \
|
|
--with-apparmor --with-libwrap --with-libcap-ng=yes \
|
|
--disable-static --with-pic --without-python
|
|
%{__make} %{?_smp_mflags}
|
|
|
|
%install
|
|
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/{sysconfig,audispd/plugins.d,init.d}}
|
|
mkdir -p $RPM_BUILD_ROOT/usr/sbin
|
|
mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
|
|
mkdir -p $RPM_BUILD_ROOT/%{_lib}/security
|
|
make DESTDIR=$RPM_BUILD_ROOT install
|
|
mkdir -p $RPM_BUILD_ROOT/%{_includedir}
|
|
mkdir -p $RPM_BUILD_ROOT/%{_libdir}
|
|
# We manually install this since Makefile doesn't
|
|
install -m 0644 lib/libaudit.h $RPM_BUILD_ROOT/%{_includedir}
|
|
|
|
for libname in libaudit libauparse;do
|
|
%{__rm} -v %{buildroot}/%{_libdir}/$libname.la
|
|
done
|
|
|
|
# USR-MERGE
|
|
for prog in auditctl auditd ausearch autrace audispd aureport; do
|
|
ln -s %{_prefix}/sbin/$prog %{buildroot}/sbin/$prog
|
|
done
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/var/adm/fillup-templates
|
|
cp %{SOURCE2} $RPM_BUILD_ROOT/var/adm/fillup-templates/sysconfig.auditd
|
|
# delete redhat script, use ours
|
|
rm -rf $RPM_BUILD_ROOT/etc/sysconfig/auditd
|
|
rm -rf $RPM_BUILD_ROOT/etc/init.d/auditd
|
|
rm -rf $RPM_BUILD_ROOT/etc/rc.d/init.d
|
|
install -c -m 755 %{SOURCE1} $RPM_BUILD_ROOT/etc/init.d/auditd
|
|
ln -s /etc/init.d/auditd $RPM_BUILD_ROOT/usr/sbin/rcauditd
|
|
mkdir -p $RPM_BUILD_ROOT/var/log/audit/
|
|
touch $RPM_BUILD_ROOT/var/log/audit/audit.log
|
|
mkdir -p $RPM_BUILD_ROOT/var/spool/audit/
|
|
# For ghost below, so that old location files will still be there when
|
|
# post copy runs
|
|
touch $RPM_BUILD_ROOT/etc/{auditd.conf,audit.rules}
|
|
# On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
|
|
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
|
|
|
%check
|
|
make check
|
|
|
|
%post -n libaudit1 -p /sbin/ldconfig
|
|
|
|
%post -n libauparse0 -p /sbin/ldconfig
|
|
|
|
%postun -n libaudit1 -p /sbin/ldconfig
|
|
|
|
%postun -n libauparse0 -p /sbin/ldconfig
|
|
|
|
%post
|
|
%{fillup_and_insserv -yn auditd auditd}
|
|
# Save existing audit files if any (from old location)
|
|
if [ -f /etc/auditd.conf ]; then
|
|
mv /etc/audit/auditd.conf /etc/audit/auditd.conf.new
|
|
mv /etc/auditd.conf /etc/audit/auditd.conf
|
|
fi
|
|
if [ -f /etc/audit.rules ]; then
|
|
mv /etc/audit/audit.rules /etc/audit/audit.rules.new
|
|
mv /etc/audit.rules /etc/audit/audit.rules
|
|
fi
|
|
|
|
%preun
|
|
%stop_on_removal auditd
|
|
|
|
%postun
|
|
%restart_on_update auditd
|
|
%{insserv_cleanup}
|
|
|
|
%files -n libaudit1
|
|
%defattr(-,root,root)
|
|
%{_libdir}/libaudit.so.*
|
|
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
|
|
%{_mandir}/man5/libaudit.conf.5*
|
|
|
|
%files -n libauparse0
|
|
%defattr(-,root,root)
|
|
%{_libdir}/libauparse.so.*
|
|
|
|
%files devel
|
|
%defattr(-,root,root)
|
|
%doc contrib/skeleton.c contrib/plugin
|
|
%{_libdir}/libaudit.so
|
|
%{_libdir}/libauparse.so
|
|
%{_includedir}/libaudit.h
|
|
%{_includedir}/auparse.h
|
|
%{_includedir}/auparse-defs.h
|
|
%{_mandir}/man3/*
|
|
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
%doc README COPYING ChangeLog contrib/capp.rules contrib/nispom.rules contrib/lspp.rules contrib/stig.rules init.d/auditd.cron
|
|
%attr(644,root,root) %{_mandir}/man8/audispd.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/autrace.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
|
|
%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
|
|
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
|
|
%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
|
|
%attr(750,root,root) /sbin/auditctl
|
|
%attr(750,root,root) /usr/sbin/auditctl
|
|
%attr(750,root,root) /sbin/auditd
|
|
%attr(750,root,root) /usr/sbin/auditd
|
|
%attr(755,root,root) /sbin/ausearch
|
|
%attr(755,root,root) /usr/sbin/ausearch
|
|
%attr(750,root,root) /usr/sbin/rcauditd
|
|
%attr(750,root,root) /sbin/autrace
|
|
%attr(750,root,root) /usr/sbin/autrace
|
|
%attr(750,root,root) /sbin/audispd
|
|
%attr(750,root,root) /usr/sbin/audispd
|
|
%attr(755,root,root) /usr/bin/aulast
|
|
%attr(755,root,root) /usr/bin/aulastlog
|
|
%attr(755,root,root) /usr/bin/ausyscall
|
|
%attr(755,root,root) /sbin/aureport
|
|
%attr(755,root,root) /usr/sbin/aureport
|
|
%attr(755,root,root) /usr/bin/auvirt
|
|
/etc/init.d/auditd
|
|
%dir %attr(750,root,root) /etc/audit
|
|
%attr(750,root,root) %dir /etc/audisp
|
|
%attr(750,root,root) %dir /etc/audisp/plugins.d
|
|
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/af_unix.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/syslog.conf
|
|
%ghost /etc/auditd.conf
|
|
%ghost /etc/audit.rules
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
|
|
%config(noreplace) %attr(640,root,root) /etc/audisp/audispd.conf
|
|
/var/adm/fillup-templates/sysconfig.auditd
|
|
%dir %attr(700,root,root) /var/log/audit
|
|
%ghost %config(noreplace) /var/log/audit/audit.log
|
|
%dir %attr(700,root,root) /var/spool/audit
|
|
%attr(755,root,root) /usr/bin/ausyscall
|
|
|
|
%changelog
|