forked from pool/audit
7e1b0e83b8
- Enable build for ARM (32-bit) - Update to version 3.0.9: * In auditd, release the async flush lock on stop * Don't allow auditd to log directly into /var/log when log_group is non-zero * Cleanup krb5 memory leaks on error paths * Update auditd.cron to use auditctl --signal * In auparse, if too many fields, realloc array bigger (Paul Wolneykien) * In auparse, special case kernel module name interpretation * If overflow_action is ignore, don't treat as an error (3.0.8) * Add gcc function attributes for access and allocation * Add some more man pages (MIZUTA Takeshi) * In auditd, change the reinitializing of the plugin queue * Fix path normalization in auparse (Sergio Correia) * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya) * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya) * Drop ProtectHome from auditd.service as it interferes with rules (3.0.7) * Add support for the OPENAT2 record type (Richard Guy Briggs) * In auditd, close the logging file descriptor when logging is suspended * Update the capabilities lookup table to match 5.16 kernel * Improve interpretation of renamat & faccessat family of syscalls * Update syscall table for the 5.16 kernel * Reduce dependency from initscripts to initscripts-service - Refresh patches (context adjusment): * audit-allow-manual-stop.patch * audit-ausearch-do-not-require-tclass.patch * audit-no-gss.patch * enable-stop-rules.patch * fix-hardened-service.patch * harden_auditd.service.patch - Remove patches (fixed by version update): * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Enable build for ARM (32-bit) - Update to version 3.0.9: * In auditd, release the async flush lock on stop * Don't allow auditd to log directly into /var/log when log_group is non-zero * Cleanup krb5 memory leaks on error paths * Update auditd.cron to use auditctl --signal * In auparse, if too many fields, realloc array bigger (Paul Wolneykien) * In auparse, special case kernel module name interpretation * If overflow_action is ignore, don't treat as an error (3.0.8) * Add gcc function attributes for access and allocation * Add some more man pages (MIZUTA Takeshi) * In auditd, change the reinitializing of the plugin queue * Fix path normalization in auparse (Sergio Correia) * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya) * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya) * Drop ProtectHome from auditd.service as it interferes with rules (3.0.7) * Add support for the OPENAT2 record type (Richard Guy Briggs) * In auditd, close the logging file descriptor when logging is suspended * Update the capabilities lookup table to match 5.16 kernel * Improve interpretation of renamat & faccessat family of syscalls * Update syscall table for the 5.16 kernel * Reduce dependency from initscripts to initscripts-service - Refresh patches (context adjusment): * audit-allow-manual-stop.patch * audit-ausearch-do-not-require-tclass.patch * audit-no-gss.patch * enable-stop-rules.patch * fix-hardened-service.patch * harden_auditd.service.patch - Remove patches (fixed by version update): * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch OBS-URL: https://build.opensuse.org/request/show/1043243 OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=141
98 lines
3.7 KiB
Diff
98 lines
3.7 KiB
Diff
Index: audit-3.0.9/init.d/augenrules.service
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ audit-3.0.9/init.d/augenrules.service
|
|
@@ -0,0 +1,29 @@
|
|
+[Unit]
|
|
+Description=auditd rules generation
|
|
+After=auditd.service
|
|
+Documentation=man:augenrules(8)
|
|
+
|
|
+[Service]
|
|
+Type=oneshot
|
|
+## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
|
|
+ExecStart=/sbin/augenrules --load
|
|
+# We need RemainAfterExit=true so augenrules is called again
|
|
+# in case auditd.service is restarted.
|
|
+RemainAfterExit=true
|
|
+
|
|
+### Security Settings ###
|
|
+MemoryDenyWriteExecute=true
|
|
+LockPersonality=true
|
|
+ProtectControlGroups=true
|
|
+ProtectKernelModules=true
|
|
+ProtectHome=true
|
|
+RestrictRealtime=true
|
|
+# for details please see
|
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
|
+ProtectSystem=full
|
|
+PrivateDevices=true
|
|
+ProtectHostname=true
|
|
+ProtectClock=true
|
|
+ProtectKernelTunables=true
|
|
+ProtectKernelLogs=true
|
|
+ReadWritePaths=/etc/audit
|
|
Index: audit-3.0.9/init.d/auditd.service
|
|
===================================================================
|
|
--- audit-3.0.9.orig/init.d/auditd.service
|
|
+++ audit-3.0.9/init.d/auditd.service
|
|
@@ -15,15 +15,16 @@ ConditionKernelCommandLine=!audit=0
|
|
ConditionKernelCommandLine=!audit=off
|
|
|
|
Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation
|
|
+Requires=augenrules.service
|
|
+# This unit clears rules on stop, so make sure that augenrules runs again
|
|
+PropagatesStopTo=augenrules.service
|
|
|
|
[Service]
|
|
Type=forking
|
|
PIDFile=/run/auditd.pid
|
|
ExecStart=/sbin/auditd
|
|
-## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
|
|
-## and comment/delete the next line and uncomment the auditctl line.
|
|
-## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
|
|
-ExecStartPost=-/sbin/augenrules --load
|
|
+## To not use augenrules: copy this file to /etc/systemd/system/auditd.service,
|
|
+## uncomment the next line, and comment the Requires=augenrules.service above.
|
|
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
|
|
# By default we clear the rules on exit. To disable this, comment
|
|
# the next line after copying the file to /etc/systemd/system/auditd.service
|
|
@@ -46,7 +47,6 @@ ProtectClock=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelLogs=true
|
|
# end of automatic additions
|
|
-ReadWritePaths=/etc/audit
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Index: audit-3.0.9/init.d/Makefile.am
|
|
===================================================================
|
|
--- audit-3.0.9.orig/init.d/Makefile.am
|
|
+++ audit-3.0.9/init.d/Makefile.am
|
|
@@ -26,7 +26,8 @@ EXTRA_DIST = auditd.init auditd.service
|
|
auditd.cron libaudit.conf auditd.condrestart \
|
|
auditd.reload auditd.restart auditd.resume \
|
|
auditd.rotate auditd.state auditd.stop \
|
|
- audit-stop.rules augenrules audit-functions
|
|
+ audit-stop.rules augenrules audit-functions \
|
|
+ augenrules.service
|
|
libconfig = libaudit.conf
|
|
if ENABLE_SYSTEMD
|
|
initdir = /usr/lib/systemd/system
|
|
@@ -54,6 +55,7 @@ if ENABLE_SYSTEMD
|
|
mkdir -p ${DESTDIR}${legacydir}
|
|
mkdir -p ${DESTDIR}${libexecdir}
|
|
$(INSTALL_SCRIPT) -D -m 644 ${srcdir}/auditd.service ${DESTDIR}${initdir}
|
|
+ $(INSTALL_SCRIPT) -D -m 644 ${srcdir}/augenrules.service ${DESTDIR}${initdir}
|
|
$(INSTALL_SCRIPT) -D -m 750 ${srcdir}/auditd.rotate ${DESTDIR}${legacydir}/rotate
|
|
$(INSTALL_SCRIPT) -D -m 750 ${srcdir}/auditd.resume ${DESTDIR}${legacydir}/resume
|
|
$(INSTALL_SCRIPT) -D -m 750 ${srcdir}/auditd.reload ${DESTDIR}${legacydir}/reload
|
|
@@ -72,6 +74,7 @@ uninstall-hook:
|
|
rm ${DESTDIR}${sysconfdir}/${libconfig}
|
|
if ENABLE_SYSTEMD
|
|
rm ${DESTDIR}${initdir}/auditd.service
|
|
+ rm ${DESTDIR}${initdir}/augenrules.service
|
|
rm ${DESTDIR}${legacydir}/rotate
|
|
rm ${DESTDIR}${legacydir}/resume
|
|
rm ${DESTDIR}${legacydir}/reload
|