From b2e90f4e2f9539960ad4004bf0ff62510d9b1740 Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Tue, 17 Aug 2021 14:21:30 +0800 Subject: audit: upgrade 3.0.4 -> 3.0.5 Drop backported patch. Signed-off-by: Yi Zhao Signed-off-by: Khem Raj --- ...id-caches-when-user-group-added-deleted-m.patch | 132 --------------------- meta-oe/recipes-security/audit/audit_3.0.4.bb | 110 ----------------- meta-oe/recipes-security/audit/audit_3.0.5.bb | 109 +++++++++++++++++ 3 files changed, 109 insertions(+), 242 deletions(-) delete mode 100644 meta-oe/recipes-security/audit/audit/0001-flush-uid-gid-caches-when-user-group-added-deleted-m.patch delete mode 100644 meta-oe/recipes-security/audit/audit_3.0.4.bb create mode 100644 meta-oe/recipes-security/audit/audit_3.0.5.bb diff --git a/meta-oe/recipes-security/audit/audit/0001-flush-uid-gid-caches-when-user-group-added-deleted-m.patch b/meta-oe/recipes-security/audit/audit/0001-flush-uid-gid-caches-when-user-group-added-deleted-m.patch deleted file mode 100644 index e55093d1ad..0000000000 --- a/meta-oe/recipes-security/audit/audit/0001-flush-uid-gid-caches-when-user-group-added-deleted-m.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 759318f11352d01b45bbab62c7bf0a53fb781083 Mon Sep 17 00:00:00 2001 -From: Steve Grubb -Date: Tue, 10 Aug 2021 11:27:16 -0400 -Subject: [PATCH] flush uid/gid caches when user/group added/deleted/modified - -It was reported in issue #209 that in the enriched format that auditd -is creating the wrong account associations. This is due to caching -previous lookups. The fix is to monitor for account lifecycle changes -and flush the LRUs if any are seen. - -Upstream-Status: Backport -[https://github.com/linux-audit/audit-userspace/commit/8662f61108f8b9365f96ef49ca8ca331a7880f24] - -Signed-off-by: Yi Zhao ---- - auparse/auparse-idata.h | 3 ++- - auparse/interpret.c | 12 ++++++++++++ - src/auditd-event.c | 27 +++++++++++++++++++++++++-- - 3 files changed, 39 insertions(+), 3 deletions(-) - -diff --git a/auparse/auparse-idata.h b/auparse/auparse-idata.h -index 660901a..eaca86a 100644 ---- a/auparse/auparse-idata.h -+++ b/auparse/auparse-idata.h -@@ -1,6 +1,6 @@ - /* - * idata.h - Header file for ausearch-lookup.c --* Copyright (c) 2013,2016-17 Red Hat Inc., Durham, North Carolina. -+* Copyright (c) 2013,2016-17,2021 Red Hat Inc. - * All Rights Reserved. - * - * This library is free software; you can redistribute it and/or -@@ -45,6 +45,7 @@ char *auparse_do_interpretation(int type, const idata *id, - void _auparse_load_interpretations(const char *buf); - void _auparse_free_interpretations(void); - const char *_auparse_lookup_interpretation(const char *name); -+void _auparse_flush_caches(void); - - #endif - -diff --git a/auparse/interpret.c b/auparse/interpret.c -index 046867b..eef377a 100644 ---- a/auparse/interpret.c -+++ b/auparse/interpret.c -@@ -653,6 +653,18 @@ void aulookup_destroy_gid_list(void) - gid_cache_created = 0; - } - -+void _auparse_flush_caches(void) -+{ -+ if (uid_cache_created) { -+ destroy_lru(uid_cache); -+ uid_cache_created = 0; -+ } -+ if (gid_cache_created) { -+ destroy_lru(gid_cache); -+ gid_cache_created = 0; -+ } -+} -+ - static const char *print_uid(const char *val, unsigned int base) - { - int uid; -diff --git a/src/auditd-event.c b/src/auditd-event.c -index cb29fee..3655726 100644 ---- a/src/auditd-event.c -+++ b/src/auditd-event.c -@@ -42,6 +42,7 @@ - #include "libaudit.h" - #include "private.h" - #include "auparse.h" -+#include "auparse-idata.h" - - /* This is defined in auditd.c */ - extern volatile int stop; -@@ -56,7 +57,7 @@ static void do_space_left_action(int admin); - static void do_disk_full_action(void); - static void do_disk_error_action(const char *func, int err); - static void fix_disk_permissions(void); --static void check_excess_logs(void); -+static void check_excess_logs(void); - static void rotate_logs_now(void); - static void rotate_logs(unsigned int num_logs, unsigned int keep_logs); - static void shift_logs(void); -@@ -394,7 +395,7 @@ static const char *format_enrich(const struct audit_reply *rep) - snprintf(format_buf, MAX_AUDIT_MESSAGE_LENGTH, - "type=DAEMON_ERR op=format-enriched msg=NULL res=failed"); - } else { -- int rc; -+ int rc, rtype; - size_t mlen, len; - char *message; - // Do raw format to get event started -@@ -427,6 +428,17 @@ static const char *format_enrich(const struct audit_reply *rep) - - // Loop over all fields while possible to add field - rc = auparse_first_record(au); -+ rtype = auparse_get_type(au); -+ switch (rtype) -+ { // Flush before adding to pickup new associations -+ case AUDIT_ADD_USER: -+ case AUDIT_ADD_GROUP: -+ _auparse_flush_caches(); -+ break; -+ default: -+ break; -+ } -+ - while (rc > 0 && len > MIN_SPACE_LEFT) { - // See what kind of field we have - size_t vlen; -@@ -454,6 +466,17 @@ static const char *format_enrich(const struct audit_reply *rep) - rc = auparse_next_field(au); - } - -+ switch(rtype) -+ { // Flush after modification to remove stale entries -+ case AUDIT_USER_MGMT: -+ case AUDIT_DEL_USER: -+ case AUDIT_DEL_GROUP: -+ case AUDIT_GRP_MGMT: -+ _auparse_flush_caches(); -+ break; -+ default: -+ break; -+ } - free(message); - } - return format_buf; --- -2.17.1 - diff --git a/meta-oe/recipes-security/audit/audit_3.0.4.bb b/meta-oe/recipes-security/audit/audit_3.0.4.bb deleted file mode 100644 index db550492e5..0000000000 --- a/meta-oe/recipes-security/audit/audit_3.0.4.bb +++ /dev/null @@ -1,110 +0,0 @@ -SUMMARY = "User space tools for kernel auditing" -DESCRIPTION = "The audit package contains the user space utilities for \ -storing and searching the audit records generated by the audit subsystem \ -in the Linux kernel." -HOMEPAGE = "http://people.redhat.com/sgrubb/audit/" -SECTION = "base" -LICENSE = "GPLv2+ & LGPLv2+" -LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f" - -SRC_URI = "git://github.com/linux-audit/${BPN}-userspace.git;branch=master \ - file://Fixed-swig-host-contamination-issue.patch \ - file://0001-flush-uid-gid-caches-when-user-group-added-deleted-m.patch \ - file://auditd \ - file://auditd.service \ - file://audit-volatile.conf \ -" - -S = "${WORKDIR}/git" -SRCREV = "86a975cd96c3838e56be9d27262f8a36bb822634" - -inherit autotools python3native update-rc.d systemd - -UPDATERCPN = "auditd" -INITSCRIPT_NAME = "auditd" -INITSCRIPT_PARAMS = "defaults" - -SYSTEMD_PACKAGES = "auditd" -SYSTEMD_SERVICE:auditd = "auditd.service" - -DEPENDS = "python3 tcp-wrappers libcap-ng linux-libc-headers swig-native" - -EXTRA_OECONF = " --with-libwrap \ - --enable-gssapi-krb5=no \ - --with-libcap-ng=yes \ - --with-python3=yes \ - --libdir=${base_libdir} \ - --sbindir=${base_sbindir} \ - --without-python \ - --without-golang \ - --disable-zos-remote \ - --with-arm=yes \ - --with-aarch64=yes \ - " - -EXTRA_OEMAKE = "PYLIBVER='python${PYTHON_BASEVERSION}' \ - PYINC='${STAGING_INCDIR}/$(PYLIBVER)' \ - pyexecdir=${libdir}/python${PYTHON_BASEVERSION}/site-packages \ - STDINC='${STAGING_INCDIR}' \ - pkgconfigdir=${libdir}/pkgconfig \ - " - -SUMMARY:audispd-plugins = "Plugins for the audit event dispatcher" -DESCRIPTION:audispd-plugins = "The audispd-plugins package provides plugins for the real-time \ -interface to the audit system, audispd. These plugins can do things \ -like relay events to remote machines or analyze events for suspicious \ -behavior." - -PACKAGES =+ "audispd-plugins" -PACKAGES += "auditd ${PN}-python" - -FILES:${PN} = "${sysconfdir}/libaudit.conf ${base_libdir}/libaudit.so.1* ${base_libdir}/libauparse.so.*" -FILES:auditd = "${bindir}/* ${base_sbindir}/* ${sysconfdir}/* ${datadir}/audit/*" -FILES:audispd-plugins = "${sysconfdir}/audit/audisp-remote.conf \ - ${sysconfdir}/audit/plugins.d/au-remote.conf \ - ${sysconfdir}/audit/plugins.d/syslog.conf \ - ${base_sbindir}/audisp-remote \ - ${base_sbindir}/audisp-syslog \ - ${localstatedir}/spool/audit \ - " -FILES:${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug" -FILES:${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}" - -CONFFILES:auditd = "${sysconfdir}/audit/audit.rules" -RDEPENDS:auditd = "bash" - -do_install:append() { - rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.a - rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.la - - # reuse auditd config - [ ! -e ${D}/etc/default ] && mkdir ${D}/etc/default - mv ${D}/etc/sysconfig/auditd ${D}/etc/default - rmdir ${D}/etc/sysconfig/ - - # replace init.d - install -D -m 0755 ${WORKDIR}/auditd ${D}/etc/init.d/auditd - rm -rf ${D}/etc/rc.d - - if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then - # install systemd unit files - install -d ${D}${systemd_unitdir}/system - install -m 0644 ${WORKDIR}/auditd.service ${D}${systemd_unitdir}/system - - install -d ${D}${sysconfdir}/tmpfiles.d/ - install -m 0644 ${WORKDIR}/audit-volatile.conf ${D}${sysconfdir}/tmpfiles.d/ - fi - - # audit-2.5 doesn't install any rules by default, so we do that here - mkdir -p ${D}/etc/audit ${D}/etc/audit/rules.d - cp ${S}/rules/10-base-config.rules ${D}/etc/audit/rules.d/audit.rules - - chmod 750 ${D}/etc/audit ${D}/etc/audit/rules.d - chmod 640 ${D}/etc/audit/auditd.conf ${D}/etc/audit/rules.d/audit.rules - - # Based on the audit.spec "Copy default rules into place on new installation" - cp ${D}/etc/audit/rules.d/audit.rules ${D}/etc/audit/audit.rules - - # Create /var/spool/audit directory for audisp-remote - install -m 0700 -d ${D}${localstatedir}/spool/audit -} diff --git a/meta-oe/recipes-security/audit/audit_3.0.5.bb b/meta-oe/recipes-security/audit/audit_3.0.5.bb new file mode 100644 index 0000000000..173c2cab11 --- /dev/null +++ b/meta-oe/recipes-security/audit/audit_3.0.5.bb @@ -0,0 +1,109 @@ +SUMMARY = "User space tools for kernel auditing" +DESCRIPTION = "The audit package contains the user space utilities for \ +storing and searching the audit records generated by the audit subsystem \ +in the Linux kernel." +HOMEPAGE = "http://people.redhat.com/sgrubb/audit/" +SECTION = "base" +LICENSE = "GPLv2+ & LGPLv2+" +LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f" + +SRC_URI = "git://github.com/linux-audit/${BPN}-userspace.git;branch=master \ + file://Fixed-swig-host-contamination-issue.patch \ + file://auditd \ + file://auditd.service \ + file://audit-volatile.conf \ +" + +S = "${WORKDIR}/git" +SRCREV = "c382a4925a7d0d1b332a2f4e689c71d71b0005a5" + +inherit autotools python3native update-rc.d systemd + +UPDATERCPN = "auditd" +INITSCRIPT_NAME = "auditd" +INITSCRIPT_PARAMS = "defaults" + +SYSTEMD_PACKAGES = "auditd" +SYSTEMD_SERVICE:auditd = "auditd.service" + +DEPENDS = "python3 tcp-wrappers libcap-ng linux-libc-headers swig-native" + +EXTRA_OECONF = " --with-libwrap \ + --enable-gssapi-krb5=no \ + --with-libcap-ng=yes \ + --with-python3=yes \ + --libdir=${base_libdir} \ + --sbindir=${base_sbindir} \ + --without-python \ + --without-golang \ + --disable-zos-remote \ + --with-arm=yes \ + --with-aarch64=yes \ + " + +EXTRA_OEMAKE = "PYLIBVER='python${PYTHON_BASEVERSION}' \ + PYINC='${STAGING_INCDIR}/$(PYLIBVER)' \ + pyexecdir=${libdir}/python${PYTHON_BASEVERSION}/site-packages \ + STDINC='${STAGING_INCDIR}' \ + pkgconfigdir=${libdir}/pkgconfig \ + " + +SUMMARY:audispd-plugins = "Plugins for the audit event dispatcher" +DESCRIPTION:audispd-plugins = "The audispd-plugins package provides plugins for the real-time \ +interface to the audit system, audispd. These plugins can do things \ +like relay events to remote machines or analyze events for suspicious \ +behavior." + +PACKAGES =+ "audispd-plugins" +PACKAGES += "auditd ${PN}-python" + +FILES:${PN} = "${sysconfdir}/libaudit.conf ${base_libdir}/libaudit.so.1* ${base_libdir}/libauparse.so.*" +FILES:auditd = "${bindir}/* ${base_sbindir}/* ${sysconfdir}/* ${datadir}/audit/*" +FILES:audispd-plugins = "${sysconfdir}/audit/audisp-remote.conf \ + ${sysconfdir}/audit/plugins.d/au-remote.conf \ + ${sysconfdir}/audit/plugins.d/syslog.conf \ + ${base_sbindir}/audisp-remote \ + ${base_sbindir}/audisp-syslog \ + ${localstatedir}/spool/audit \ + " +FILES:${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug" +FILES:${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}" + +CONFFILES:auditd = "${sysconfdir}/audit/audit.rules" +RDEPENDS:auditd = "bash" + +do_install:append() { + rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.a + rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.la + + # reuse auditd config + [ ! -e ${D}/etc/default ] && mkdir ${D}/etc/default + mv ${D}/etc/sysconfig/auditd ${D}/etc/default + rmdir ${D}/etc/sysconfig/ + + # replace init.d + install -D -m 0755 ${WORKDIR}/auditd ${D}/etc/init.d/auditd + rm -rf ${D}/etc/rc.d + + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + # install systemd unit files + install -d ${D}${systemd_unitdir}/system + install -m 0644 ${WORKDIR}/auditd.service ${D}${systemd_unitdir}/system + + install -d ${D}${sysconfdir}/tmpfiles.d/ + install -m 0644 ${WORKDIR}/audit-volatile.conf ${D}${sysconfdir}/tmpfiles.d/ + fi + + # audit-2.5 doesn't install any rules by default, so we do that here + mkdir -p ${D}/etc/audit ${D}/etc/audit/rules.d + cp ${S}/rules/10-base-config.rules ${D}/etc/audit/rules.d/audit.rules + + chmod 750 ${D}/etc/audit ${D}/etc/audit/rules.d + chmod 640 ${D}/etc/audit/auditd.conf ${D}/etc/audit/rules.d/audit.rules + + # Based on the audit.spec "Copy default rules into place on new installation" + cp ${D}/etc/audit/rules.d/audit.rules ${D}/etc/audit/audit.rules + + # Create /var/spool/audit directory for audisp-remote + install -m 0700 -d ${D}${localstatedir}/spool/audit +} -- cgit v1.2.3-54-g00ecf