From b2c6299c3b73fa363285f43d8a20f628759e771b Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Tue, 10 Jun 2025 11:32:27 +0800 Subject: audit: upgrade 4.0.4 -> 4.0.5 0001-Fixed-swig-host-contamination-issue.patch refreshed for 4.0.5 Changelog: ============ - Rework audisp queue to be lockless - Fix missing delete command in auditctl - Allow plus addresses (rfc5233) to auditd email. - Reduce memory churn in auditd event dispatching - Add configurable recurring state report in auditd - Switch audisp-statsd to stop sending signals - Add glibc memory stats to audisp-statsd Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj --- .../0001-Fixed-swig-host-contamination-issue.patch | 13 +-- meta-oe/recipes-security/audit/audit_4.0.4.bb | 108 --------------------- meta-oe/recipes-security/audit/audit_4.0.5.bb | 108 +++++++++++++++++++++ 3 files changed, 113 insertions(+), 116 deletions(-) delete mode 100644 meta-oe/recipes-security/audit/audit_4.0.4.bb create mode 100644 meta-oe/recipes-security/audit/audit_4.0.5.bb (limited to 'meta-oe') diff --git a/meta-oe/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch b/meta-oe/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch index f2755d5c08..f37fbf63a7 100644 --- a/meta-oe/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch +++ b/meta-oe/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch @@ -1,4 +1,4 @@ -From 5cdc667aeb7a014cdc1f8c7df8f8080408773dbe Mon Sep 17 00:00:00 2001 +From 4f78fcb8728cd4bf31175b3fa610a5c003e915d1 Mon Sep 17 00:00:00 2001 From: Li xin Date: Sun, 19 Jul 2015 02:42:58 +0900 Subject: [PATCH] Fixed swig host contamination issue @@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bindings/swig/python3/Makefile.am b/bindings/swig/python3/Makefile.am -index c2c6def4..bcc2836c 100644 +index 428e40fa..f4dd45bc 100644 --- a/bindings/swig/python3/Makefile.am +++ b/bindings/swig/python3/Makefile.am @@ -23,6 +23,7 @@ @@ -30,7 +30,7 @@ index c2c6def4..bcc2836c 100644 LIBS = $(top_builddir)/lib/libaudit.la SWIG_FLAGS = -python SWIG_INCLUDES = -I. -I$(top_builddir) -I${top_srcdir}/lib $(PYTHON3_INCLUDES) -@@ -37,7 +38,7 @@ _audit_la_DEPENDENCIES =${top_srcdir}/lib/audit_logging.h ${top_builddir}/lib/li +@@ -35,7 +36,7 @@ _audit_la_DEPENDENCIES =${top_srcdir}/lib/audit_logging.h ${top_builddir}/lib/li _audit_la_LIBADD = ${top_builddir}/lib/libaudit.la nodist__audit_la_SOURCES = audit_wrap.c audit.py audit_wrap.c: ${srcdir}/../src/auditswig.i @@ -40,10 +40,10 @@ index c2c6def4..bcc2836c 100644 CLEANFILES = audit.py* audit_wrap.c *~ diff --git a/bindings/swig/src/auditswig.i b/bindings/swig/src/auditswig.i -index 6b267844..5a4e442f 100644 +index 2760e516..5d0ea8b6 100644 --- a/bindings/swig/src/auditswig.i +++ b/bindings/swig/src/auditswig.i -@@ -50,7 +50,7 @@ typedef unsigned uid_t; +@@ -52,7 +52,7 @@ typedef unsigned uid_t; */ %ignore audit_rule_data::buf; @@ -52,6 +52,3 @@ index 6b267844..5a4e442f 100644 #define __extension__ /*nothing*/ %include %include "../lib/audit-records.h" --- -2.25.1 - diff --git a/meta-oe/recipes-security/audit/audit_4.0.4.bb b/meta-oe/recipes-security/audit/audit_4.0.4.bb deleted file mode 100644 index 952a362698..0000000000 --- a/meta-oe/recipes-security/audit/audit_4.0.4.bb +++ /dev/null @@ -1,108 +0,0 @@ -SUMMARY = "User space tools for kernel auditing" -DESCRIPTION = "The audit package contains the user space utilities for \ -storing and searching the audit records generated by the audit subsystem \ -in the Linux kernel." -HOMEPAGE = "http://people.redhat.com/sgrubb/audit/" -SECTION = "base" -LICENSE = "GPL-2.0-or-later & LGPL-2.0-or-later" -LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f" - -SRC_URI = "git://github.com/linux-audit/${BPN}-userspace.git;branch=master;protocol=https \ - file://0001-Fixed-swig-host-contamination-issue.patch \ - file://auditd \ - " - -S = "${WORKDIR}/git" -SRCREV = "81dcded2ed9e407dd1357eda0bdc0855f06085e6" - -inherit autotools python3targetconfig update-rc.d systemd - -UPDATERCPN = "auditd" -INITSCRIPT_NAME = "auditd" -INITSCRIPT_PARAMS = "defaults" - -SYSTEMD_PACKAGES = "auditd" -SYSTEMD_SERVICE:auditd = "auditd.service audit-rules.service" - -DEPENDS = "python3 tcp-wrappers libcap-ng linux-libc-headers swig-native python3-setuptools-native coreutils-native" - -EXTRA_OECONF = " \ - --with-libwrap \ - --with-libcap-ng \ - --with-python3 \ - --with-arm \ - --with-aarch64 \ - --with-riscv \ - --without-golang \ - --disable-gssapi-krb5 \ - --disable-zos-remote \ - --sbindir=${base_sbindir} \ - --runstatedir=/run \ - " - -EXTRA_OEMAKE = " \ - PYTHON=python3 \ - pythondir=${PYTHON_SITEPACKAGES_DIR} \ - pyexecdir=${PYTHON_SITEPACKAGES_DIR} \ - STDINC='${STAGING_INCDIR}' \ - " - -SUMMARY:audispd-plugins = "Plugins for the audit event dispatcher" -DESCRIPTION:audispd-plugins = "The audispd-plugins package provides plugins for the real-time \ -interface to the audit system, audispd. These plugins can do things \ -like relay events to remote machines or analyze events for suspicious \ -behavior." - -PACKAGES =+ "audispd-plugins" -PACKAGES += "auditd ${PN}-python" - -FILES:${PN} = "${sysconfdir}/libaudit.conf ${libdir}/libau*.so.*" -FILES:auditd = "${bindir}/* ${base_sbindir}/* ${sysconfdir}/* \ - ${datadir}/audit-rules/* ${libexecdir}/* \ - ${nonarch_libdir}/tmpfiles.d/*.conf" -FILES:audispd-plugins = "${sysconfdir}/audit/audisp-remote.conf \ - ${sysconfdir}/audit/plugins.d/au-remote.conf \ - ${sysconfdir}/audit/plugins.d/syslog.conf \ - ${base_sbindir}/audisp-remote \ - ${base_sbindir}/audisp-syslog \ - ${localstatedir}/spool/audit \ - " -FILES:${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug" -FILES:${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}" - -CONFFILES:auditd = "${sysconfdir}/audit/audit.rules" - -do_configure:prepend() { - sed -e 's|buf\[];|buf[0];|g' ${STAGING_INCDIR}/linux/audit.h > ${S}/lib/audit.h - sed -i -e 's|#include |#include "audit.h"|g' ${S}/lib/libaudit.h -} - -do_install:append() { - sed -i -e 's|#include "audit.h"|#include |g' ${D}${includedir}/libaudit.h - - # Install default rules - install -d -m 750 ${D}/etc/audit - install -d -m 750 ${D}/etc/audit/rules.d - - install -m 0640 ${S}/rules/10-base-config.rules ${D}/etc/audit/rules.d/audit.rules - - # Based on the audit.spec "Copy default rules into place on new installation" - install -m 0640 ${D}/etc/audit/rules.d/audit.rules ${D}/etc/audit/audit.rules - - if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then - install -D -m 0755 ${UNPACKDIR}/auditd ${D}/etc/init.d/auditd - fi - - if ! ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then - rm -rf ${D}${nonarch_libdir}/systemd - rm -rf ${D}${nonarch_libdir}/tmpfiles.d - - # Remove empty directory when enable multilib - rmdir --ignore-fail-on-non-empty ${D}${nonarch_libdir} - fi - - # Create /var/spool/audit directory for audisp-remote - install -d -m 0700 ${D}${localstatedir}/spool/audit -} - -CVE_PRODUCT = "linux:audit" diff --git a/meta-oe/recipes-security/audit/audit_4.0.5.bb b/meta-oe/recipes-security/audit/audit_4.0.5.bb new file mode 100644 index 0000000000..6fa025abd4 --- /dev/null +++ b/meta-oe/recipes-security/audit/audit_4.0.5.bb @@ -0,0 +1,108 @@ +SUMMARY = "User space tools for kernel auditing" +DESCRIPTION = "The audit package contains the user space utilities for \ +storing and searching the audit records generated by the audit subsystem \ +in the Linux kernel." +HOMEPAGE = "http://people.redhat.com/sgrubb/audit/" +SECTION = "base" +LICENSE = "GPL-2.0-or-later & LGPL-2.0-or-later" +LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f" + +SRC_URI = "git://github.com/linux-audit/${BPN}-userspace.git;branch=master;protocol=https \ + file://0001-Fixed-swig-host-contamination-issue.patch \ + file://auditd \ + " + +S = "${WORKDIR}/git" +SRCREV = "97c4ec3d68b5b199f2796d1e126c2144506bd228" + +inherit autotools python3targetconfig update-rc.d systemd + +UPDATERCPN = "auditd" +INITSCRIPT_NAME = "auditd" +INITSCRIPT_PARAMS = "defaults" + +SYSTEMD_PACKAGES = "auditd" +SYSTEMD_SERVICE:auditd = "auditd.service audit-rules.service" + +DEPENDS = "python3 tcp-wrappers libcap-ng linux-libc-headers swig-native python3-setuptools-native coreutils-native" + +EXTRA_OECONF = " \ + --with-libwrap \ + --with-libcap-ng \ + --with-python3 \ + --with-arm \ + --with-aarch64 \ + --with-riscv \ + --without-golang \ + --disable-gssapi-krb5 \ + --disable-zos-remote \ + --sbindir=${base_sbindir} \ + --runstatedir=/run \ + " + +EXTRA_OEMAKE = " \ + PYTHON=python3 \ + pythondir=${PYTHON_SITEPACKAGES_DIR} \ + pyexecdir=${PYTHON_SITEPACKAGES_DIR} \ + STDINC='${STAGING_INCDIR}' \ + " + +SUMMARY:audispd-plugins = "Plugins for the audit event dispatcher" +DESCRIPTION:audispd-plugins = "The audispd-plugins package provides plugins for the real-time \ +interface to the audit system, audispd. These plugins can do things \ +like relay events to remote machines or analyze events for suspicious \ +behavior." + +PACKAGES =+ "audispd-plugins" +PACKAGES += "auditd ${PN}-python" + +FILES:${PN} = "${sysconfdir}/libaudit.conf ${libdir}/libau*.so.*" +FILES:auditd = "${bindir}/* ${base_sbindir}/* ${sysconfdir}/* \ + ${datadir}/audit-rules/* ${libexecdir}/* \ + ${nonarch_libdir}/tmpfiles.d/*.conf" +FILES:audispd-plugins = "${sysconfdir}/audit/audisp-remote.conf \ + ${sysconfdir}/audit/plugins.d/au-remote.conf \ + ${sysconfdir}/audit/plugins.d/syslog.conf \ + ${base_sbindir}/audisp-remote \ + ${base_sbindir}/audisp-syslog \ + ${localstatedir}/spool/audit \ + " +FILES:${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug" +FILES:${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}" + +CONFFILES:auditd = "${sysconfdir}/audit/audit.rules" + +do_configure:prepend() { + sed -e 's|buf\[];|buf[0];|g' ${STAGING_INCDIR}/linux/audit.h > ${S}/lib/audit.h + sed -i -e 's|#include |#include "audit.h"|g' ${S}/lib/libaudit.h +} + +do_install:append() { + sed -i -e 's|#include "audit.h"|#include |g' ${D}${includedir}/libaudit.h + + # Install default rules + install -d -m 750 ${D}/etc/audit + install -d -m 750 ${D}/etc/audit/rules.d + + install -m 0640 ${S}/rules/10-base-config.rules ${D}/etc/audit/rules.d/audit.rules + + # Based on the audit.spec "Copy default rules into place on new installation" + install -m 0640 ${D}/etc/audit/rules.d/audit.rules ${D}/etc/audit/audit.rules + + if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then + install -D -m 0755 ${UNPACKDIR}/auditd ${D}/etc/init.d/auditd + fi + + if ! ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + rm -rf ${D}${nonarch_libdir}/systemd + rm -rf ${D}${nonarch_libdir}/tmpfiles.d + + # Remove empty directory when enable multilib + rmdir --ignore-fail-on-non-empty ${D}${nonarch_libdir} + fi + + # Create /var/spool/audit directory for audisp-remote + install -d -m 0700 ${D}${localstatedir}/spool/audit +} + +CVE_PRODUCT = "linux:audit" -- cgit v1.2.3-54-g00ecf