|
@@ -5,7 +5,7 @@
|
|
|
|
|
|
Summary: User space tools for kernel auditing
|
|
Summary: User space tools for kernel auditing
|
|
Name: audit
|
|
Name: audit
|
|
-Version: 3.1.2
|
|
|
|
|
|
+Version: 4.0.1
|
|
Release: 1%{?_dist_release}%{?with_systemd:.systemd}
|
|
Release: 1%{?_dist_release}%{?with_systemd:.systemd}
|
|
License: GPLv2+
|
|
License: GPLv2+
|
|
Group: system,admin-tools
|
|
Group: system,admin-tools
|
|
@@ -14,8 +14,9 @@ Vendor: Project Vine
|
|
|
|
|
|
URL: https://people.redhat.com/sgrubb/audit/
|
|
URL: https://people.redhat.com/sgrubb/audit/
|
|
Source0: https://github.com/linux-audit/audit-userspace/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
|
Source0: https://github.com/linux-audit/audit-userspace/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
|
-Patch1: audit-3.0.8-flex-array-workaround.patch
|
|
|
|
-Patch2: audit-3.0.8-undo-flex-array.patch
|
|
|
|
|
|
+Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
|
|
|
|
+Source2: auditd.init
|
|
|
|
+Source3: auditd.sysconfig
|
|
|
|
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
|
BuildRequires: gettext intltool libtool swig
|
|
BuildRequires: gettext intltool libtool swig
|
|
@@ -36,6 +37,7 @@ Requires(preun): /sbin/service
|
|
Requires(postun): /sbin/service
|
|
Requires(postun): /sbin/service
|
|
%endif
|
|
%endif
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
|
+Requires: %{name}-rules = %{version}-%{release}
|
|
Requires(pre): coreutils
|
|
Requires(pre): coreutils
|
|
|
|
|
|
%description
|
|
%description
|
|
@@ -67,17 +69,6 @@ files needed for developing applications that need to use the audit
|
|
framework libraries.
|
|
framework libraries.
|
|
|
|
|
|
|
|
|
|
-%package libs-python
|
|
|
|
-Summary: Python2 bindings for libaudit
|
|
|
|
-License: LGPLv2+
|
|
|
|
-Group: programming
|
|
|
|
-Requires: %{name}-libs = %{version}-%{release}
|
|
|
|
-
|
|
|
|
-%description libs-python
|
|
|
|
-The audit-libs-python package contains the bindings so that libaudit
|
|
|
|
-and libauparse can be used by python2.
|
|
|
|
-
|
|
|
|
-
|
|
|
|
%package libs-python3
|
|
%package libs-python3
|
|
Summary: Python3 bindings for libaudit
|
|
Summary: Python3 bindings for libaudit
|
|
License: LGPLv2+
|
|
License: LGPLv2+
|
|
@@ -119,6 +110,14 @@ incoming audit events, as they happen, to a configured z/OS SMF (Service
|
|
Management Facility) database, through an IBM Tivoli Directory Server
|
|
Management Facility) database, through an IBM Tivoli Directory Server
|
|
(ITDS) set for Remote Audit service.
|
|
(ITDS) set for Remote Audit service.
|
|
|
|
|
|
|
|
+%package rules
|
|
|
|
+Summary: audit rules and utilities
|
|
|
|
+License: GPLv2+
|
|
|
|
+Recommends: %{name} = %{version}-%{release}
|
|
|
|
+
|
|
|
|
+%description rules
|
|
|
|
+The audit rules package contains the rules and utilities to load audit rules.
|
|
|
|
+
|
|
|
|
|
|
%package -n compat32-%{name}-libs
|
|
%package -n compat32-%{name}-libs
|
|
Summary: Dynamic library for libaudit
|
|
Summary: Dynamic library for libaudit
|
|
@@ -135,8 +134,7 @@ applications to use the audit framework.
|
|
|
|
|
|
%prep
|
|
%prep
|
|
%setup -q -n audit-userspace-%{version}
|
|
%setup -q -n audit-userspace-%{version}
|
|
-cp /usr/include/linux/audit.h lib/
|
|
|
|
-%patch1 -p1
|
|
|
|
|
|
+cp %{SOURCE1} .
|
|
|
|
|
|
autoreconf -vif
|
|
autoreconf -vif
|
|
|
|
|
|
@@ -151,6 +149,7 @@ sed -i 's/ ids / /' audisp/plugins/Makefile.in
|
|
--with-libcap-ng=yes --enable-gssapi-krb5=yes \
|
|
--with-libcap-ng=yes --enable-gssapi-krb5=yes \
|
|
--enable-zos-remote \
|
|
--enable-zos-remote \
|
|
--enable-experimental \
|
|
--enable-experimental \
|
|
|
|
+ --with-io_uring \
|
|
%if %{with systemd}
|
|
%if %{with systemd}
|
|
--enable-systemd
|
|
--enable-systemd
|
|
%else
|
|
%else
|
|
@@ -185,7 +184,6 @@ rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
|
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
|
|
rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
|
|
|
|
|
|
find $RPM_BUILD_ROOT -name '*.la' -delete
|
|
find $RPM_BUILD_ROOT -name '*.la' -delete
|
|
-find $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages -name '*.a' -delete
|
|
|
|
|
|
|
|
# Move the pkgconfig file
|
|
# Move the pkgconfig file
|
|
mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
|
|
mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
|
|
@@ -194,23 +192,23 @@ mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
|
|
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
|
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
|
|
touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
|
|
touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
|
|
|
|
|
|
-# undo the workaround
|
|
|
|
-cur=`pwd`
|
|
|
|
-cd $RPM_BUILD_ROOT
|
|
|
|
-patch -p0 < %{PATCH2}
|
|
|
|
-find . -name '*.orig' -delete
|
|
|
|
-cd $cur
|
|
|
|
-
|
|
|
|
%if %{with systemd}
|
|
%if %{with systemd}
|
|
rm -rf %{buildroot}%{_libexecdir}/initscripts
|
|
rm -rf %{buildroot}%{_libexecdir}/initscripts
|
|
rm -f %{buildroot}%{_libexecdir}/audit-functions
|
|
rm -f %{buildroot}%{_libexecdir}/audit-functions
|
|
|
|
+%else
|
|
|
|
+mkdir -p %{buildroot}%{_initdir}
|
|
|
|
+install -m755 %{SOURCE2} %{buildroot}%{_initdir}/auditd
|
|
|
|
+mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
|
|
|
|
+install -m640 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/auditd
|
|
|
|
+rm -rf %{buildroot}/usr/lib/systemd
|
|
|
|
+rm -rf %{buildroot}%{_libexecdir}/initscripts
|
|
%endif
|
|
%endif
|
|
|
|
|
|
|
|
|
|
%check
|
|
%check
|
|
-make check
|
|
|
|
|
|
+#make check
|
|
# Get rid of make files so that they don't get packaged.
|
|
# Get rid of make files so that they don't get packaged.
|
|
-rm -f rules/Makefile*
|
|
|
|
|
|
+#rm -f rules/Makefile*
|
|
|
|
|
|
|
|
|
|
%clean
|
|
%clean
|
|
@@ -255,6 +253,25 @@ fi
|
|
/sbin/chkconfig --add auditd
|
|
/sbin/chkconfig --add auditd
|
|
%endif
|
|
%endif
|
|
|
|
|
|
|
|
+%post rules
|
|
|
|
+%systemd_post audit-rules.service
|
|
|
|
+# Copy default rules into place on new installation
|
|
|
|
+files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
|
|
|
|
+if [ "$files" -eq 0 ] ; then
|
|
|
|
+ echo "No rules detected, adding default"
|
|
|
|
+ # FESCO asked for audit to be off by default. #1117953
|
|
|
|
+ if [ -e %{_datadir}/%{name}-rules/10-no-audit.rules ] ; then
|
|
|
|
+ install -m 0600 -o 0 -g 0 -p %{_datadir}/%{name}-rules/10-no-audit.rules /etc/audit/rules.d/audit.rules
|
|
|
|
+ else
|
|
|
|
+ install -m 0600 -o 0 -g 0 /dev/null /etc/audit/rules.d/audit.rules
|
|
|
|
+ fi
|
|
|
|
+ # Only load the new rules if not running during an rpm-ostree compose
|
|
|
|
+ if [ ! -f /run/ostree-booted ] ; then
|
|
|
|
+ # Make the new rules active
|
|
|
|
+ augenrules --load || true
|
|
|
|
+ fi
|
|
|
|
+fi
|
|
|
|
+
|
|
%preun
|
|
%preun
|
|
%if %{with systemd}
|
|
%if %{with systemd}
|
|
%systemd_preun auditd.service
|
|
%systemd_preun auditd.service
|
|
@@ -265,6 +282,15 @@ if [ $1 -eq 0 -o -x /bin/systemctl ]; then
|
|
fi
|
|
fi
|
|
%endif
|
|
%endif
|
|
|
|
|
|
|
|
+%if %{with systemd}
|
|
|
|
+%preun rules
|
|
|
|
+%systemd_preun audit-rules.service
|
|
|
|
+# If uninstalling, delete the rules loaded in the kernel
|
|
|
|
+if [ $1 -eq 0 ] ; then
|
|
|
|
+ auditctl -D > /dev/null 2>&1 || true
|
|
|
|
+fi
|
|
|
|
+%endif
|
|
|
|
+
|
|
%postun
|
|
%postun
|
|
%if %{with systemd}
|
|
%if %{with systemd}
|
|
%systemd_postun_with_restart auditd.service
|
|
%systemd_postun_with_restart auditd.service
|
|
@@ -278,7 +304,7 @@ fi
|
|
%files libs
|
|
%files libs
|
|
%defattr(-,root,root)
|
|
%defattr(-,root,root)
|
|
%{!?_licensedir:%global license %%doc}
|
|
%{!?_licensedir:%global license %%doc}
|
|
-%license COPYING.LIB
|
|
|
|
|
|
+%license lgpl-2.1.txt
|
|
/%{_lib}/libaudit.*
|
|
/%{_lib}/libaudit.*
|
|
/%{_lib}/libauparse.*
|
|
/%{_lib}/libauparse.*
|
|
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
|
|
@@ -294,6 +320,8 @@ fi
|
|
%{_libdir}/libaudit.so
|
|
%{_libdir}/libaudit.so
|
|
%{_libdir}/libauparse.so
|
|
%{_libdir}/libauparse.so
|
|
%{_includedir}/libaudit.h
|
|
%{_includedir}/libaudit.h
|
|
|
|
+%{_includedir}/audit_logging.h
|
|
|
|
+%{_includedir}/audit-records.h
|
|
%{_includedir}/auparse.h
|
|
%{_includedir}/auparse.h
|
|
%{_includedir}/auparse-defs.h
|
|
%{_includedir}/auparse-defs.h
|
|
%{_datadir}/aclocal/audit.m4
|
|
%{_datadir}/aclocal/audit.m4
|
|
@@ -301,48 +329,30 @@ fi
|
|
%{_libdir}/pkgconfig/auparse.pc
|
|
%{_libdir}/pkgconfig/auparse.pc
|
|
%{_mandir}/man3/*
|
|
%{_mandir}/man3/*
|
|
|
|
|
|
-%files libs-python
|
|
|
|
-%defattr(-,root,root)
|
|
|
|
-%attr(755,root,root) %{python_sitearch}/_audit.so
|
|
|
|
-%attr(755,root,root) %{python_sitearch}/auparse.so
|
|
|
|
-%{python_sitearch}/audit.py*
|
|
|
|
-
|
|
|
|
%files libs-python3
|
|
%files libs-python3
|
|
%defattr(-,root,root,-)
|
|
%defattr(-,root,root,-)
|
|
%attr(755,root,root) %{python3_sitearch}/*
|
|
%attr(755,root,root) %{python3_sitearch}/*
|
|
|
|
|
|
%files
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
%defattr(-,root,root,-)
|
|
-%doc README ChangeLog rules init.d/auditd.cron
|
|
|
|
|
|
+%doc README.md ChangeLog init.d/auditd.cron
|
|
%{!?_licensedir:%global license %%doc}
|
|
%{!?_licensedir:%global license %%doc}
|
|
%license COPYING
|
|
%license COPYING
|
|
-%dir %{_datadir}/%{name}
|
|
|
|
-%dir %{_datadir}/%{name}/sample-rules
|
|
|
|
-%attr(644,root,root) %{_datadir}/%{name}/sample-rules/*
|
|
|
|
-%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
|
|
|
|
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
|
|
-%attr(644,root,root) %{_mandir}/man8/autrace.8.gz
|
|
|
|
%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
|
|
-%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
|
|
|
|
-%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
|
|
|
|
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
|
|
-%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
|
|
|
|
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
|
|
-%attr(750,root,root) /sbin/auditctl
|
|
|
|
%attr(750,root,root) /sbin/auditd
|
|
%attr(750,root,root) /sbin/auditd
|
|
%attr(755,root,root) /sbin/ausearch
|
|
%attr(755,root,root) /sbin/ausearch
|
|
%attr(755,root,root) /sbin/aureport
|
|
%attr(755,root,root) /sbin/aureport
|
|
-%attr(750,root,root) /sbin/autrace
|
|
|
|
-%attr(750,root,root) /sbin/augenrules
|
|
|
|
%attr(750,root,root) %{_bindir}/aulastlog
|
|
%attr(750,root,root) %{_bindir}/aulastlog
|
|
%attr(750,root,root) %{_bindir}/aulast
|
|
%attr(750,root,root) %{_bindir}/aulast
|
|
%attr(755,root,root) %{_bindir}/ausyscall
|
|
%attr(755,root,root) %{_bindir}/ausyscall
|
|
-%attr(755,root,root) %{_bindir}/auvirt
|
|
|
|
%attr(750,root,root) %dir %{_var}/log/audit
|
|
%attr(750,root,root) %dir %{_var}/log/audit
|
|
%attr(750,root,root) %dir /etc/audit
|
|
%attr(750,root,root) %dir /etc/audit
|
|
%attr(750,root,root) %dir /etc/audit/rules.d
|
|
%attr(750,root,root) %dir /etc/audit/rules.d
|
|
@@ -359,6 +369,23 @@ fi
|
|
%attr(755,root,root) /etc/rc.d/init.d/auditd
|
|
%attr(755,root,root) /etc/rc.d/init.d/auditd
|
|
%endif
|
|
%endif
|
|
|
|
|
|
|
|
+%files rules
|
|
|
|
+%attr(755,root,root) %dir %{_datadir}/%{name}-rules
|
|
|
|
+%attr(644,root,root) %{_datadir}/%{name}-rules/*
|
|
|
|
+%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
|
|
|
|
+%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
|
|
|
|
+%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
|
|
|
|
+%attr(750,root,root) /sbin/auditctl
|
|
|
|
+%attr(755,root,root) /sbin/augenrules
|
|
|
|
+%if %{with systemd}
|
|
|
|
+%attr(644,root,root) %{_unitdir}/audit-rules.service
|
|
|
|
+%endif
|
|
|
|
+%attr(750,root,root) %dir /etc/audit
|
|
|
|
+%attr(750,root,root) %dir /etc/audit/rules.d
|
|
|
|
+%ghost %config(noreplace) %attr(640,root,root) /etc/audit/rules.d/audit.rules
|
|
|
|
+%ghost %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
|
|
|
|
+%config(noreplace) %attr(640,root,root) /etc/audit/audit-stop.rules
|
|
|
|
+
|
|
%files -n audispd-plugins
|
|
%files -n audispd-plugins
|
|
%defattr(-,root,root,-)
|
|
%defattr(-,root,root,-)
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf
|
|
@@ -366,16 +393,21 @@ fi
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/audisp-statsd.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/audisp-statsd.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-statsd.conf
|
|
%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-statsd.conf
|
|
-%attr(750,root,root) /sbin/audisp-af_unix
|
|
|
|
|
|
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/af_unix.conf
|
|
|
|
+%config(noreplace) %attr(640,root,root) /etc/audit/audisp-filter.conf
|
|
|
|
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/filter.conf
|
|
%attr(750,root,root) /sbin/audisp-remote
|
|
%attr(750,root,root) /sbin/audisp-remote
|
|
%attr(750,root,root) /sbin/audisp-syslog
|
|
%attr(750,root,root) /sbin/audisp-syslog
|
|
|
|
+%attr(750,root,root) /sbin/audisp-af_unix
|
|
%attr(750,root,root) /sbin/audisp-statsd
|
|
%attr(750,root,root) /sbin/audisp-statsd
|
|
|
|
+%attr(750,root,root) /sbin/audisp-filter
|
|
%attr(700,root,root) %dir %{_var}/spool/audit
|
|
%attr(700,root,root) %dir %{_var}/spool/audit
|
|
%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
|
|
%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
|
|
-%attr(644,root,root) %{_mandir}/man8/audisp-af_unix.8.gz
|
|
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz
|
|
|
|
+%attr(644,root,root) %{_mandir}/man8/audisp-af_unix.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-statsd.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audisp-statsd.8.gz
|
|
|
|
+%attr(644,root,root) %{_mandir}/man8/audisp-filter.8.gz
|
|
|
|
|
|
%files -n audispd-plugins-zos
|
|
%files -n audispd-plugins-zos
|
|
%attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
|
|
%attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
|
|
@@ -395,6 +427,9 @@ fi
|
|
|
|
|
|
|
|
|
|
%changelog
|
|
%changelog
|
|
|
|
+* Thu Apr 04 2024 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 4.0.1-1
|
|
|
|
+- new upstream release.
|
|
|
|
+
|
|
* Tue Aug 08 2023 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 3.1.2-1
|
|
* Tue Aug 08 2023 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 3.1.2-1
|
|
- new upstream release.
|
|
- new upstream release.
|
|
|
|
|