Skip to content

Commit 853cee6

Browse files
tpetazzoniaparcar
tpetazzoni
authored and
aparcar
committed
audit: new package
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [strip library after adding it to openwrt repository] Signed-off-by: W. Michael Petullo <mike@flyn.org>
1 parent 10c29f7 commit 853cee6

4 files changed

Lines changed: 319 additions & 0 deletions

File tree

‎utils/audit/Makefile‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
#
2+
# This is free software, licensed under the GNU General Public License v2.
3+
# See /LICENSE for more information.
4+
#
5+
6+
include $(TOPDIR)/rules.mk
7+
8+
PKG_NAME:=audit
9+
PKG_VERSION:=2.8.5
10+
PKG_RELEASE:=1
11+
12+
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
13+
PKG_SOURCE_URL:=http://people.redhat.com/sgrubb/audit
14+
PKG_HASH:=0e5d4103646e00f8d1981e1cd2faea7a2ae28e854c31a803e907a383c5e2ecb7
15+
16+
PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
17+
PKG_LICENSE:=GPL-2.0-or-later
18+
PKG_LICENSE_FILES:=COPYING
19+
PKG_CPE_ID:=cpe:/a:linux_audit_project:linux_audit
20+
21+
PKG_FIXUP:=autoreconf
22+
23+
PKG_USE_MIPS16:=0
24+
25+
include $(INCLUDE_DIR)/package.mk
26+
include $(INCLUDE_DIR)/host-build.mk
27+
28+
define Package/audit/Default
29+
TITLE:=Audit Daemon
30+
URL:=http://people.redhat.com/sgrubb/audit/
31+
endef
32+
33+
define Package/audit/Default/description
34+
The audit package contains the user space utilities for
35+
storing and searching the audit records generated by
36+
the audit subsystem in the Linux 2.6 kernel
37+
endef
38+
39+
define Package/libauparse
40+
$(call Package/audit/Default)
41+
SECTION:=libs
42+
CATEGORY:=Libraries
43+
TITLE+= (parsing shared library)
44+
DEPENDS:= +libaudit
45+
endef
46+
47+
define Package/libauparse/description
48+
$(call Package/audit/Default/description)
49+
This package contains the audit parsing shared library.
50+
endef
51+
52+
define Package/audit-utils
53+
$(call Package/audit/Default)
54+
SECTION:=utils
55+
CATEGORY:=Utilities
56+
TITLE+= (utilities)
57+
DEPENDS:= +libaudit +libauparse
58+
endef
59+
60+
define Package/audit-utils/description
61+
$(call Package/audit/Default/description)
62+
This package contains the audit utilities.
63+
endef
64+
65+
define Package/audit
66+
$(call Package/audit/Default)
67+
SECTION:=utils
68+
CATEGORY:=Utilities
69+
TITLE+= (daemon)
70+
DEPENDS:= +libaudit +libauparse +audit-utils
71+
endef
72+
73+
define Package/audit/description
74+
$(call Package/audit/Default/description)
75+
This package contains the audit daemon.
76+
endef
77+
78+
CONFIGURE_VARS += \
79+
LDFLAGS_FOR_BUILD="$(HOST_LDFLAGS)" \
80+
CPPFLAGS_FOR_BUILD="$(HOST_CPPFLAGS)" \
81+
CFLAGS_FOR_BUILD="$(HOST_CFLAGS)" \
82+
CC_FOR_BUILD="$(HOSTCC)"
83+
84+
CONFIGURE_ARGS += \
85+
--without-libcap-ng \
86+
--disable-systemd \
87+
--without-python \
88+
--without-python3 \
89+
--disable-zos-remote
90+
91+
ifeq ($(ARCH),aarch64)
92+
CONFIGURE_ARGS += --with-aarch64
93+
else ifeq ($(ARCH),arm)
94+
CONFIGURE_ARGS += --with-arm
95+
endif
96+
97+
# We can't use the default, as the default passes $(MAKE_ARGS), which
98+
# overrides CC, CFLAGS, etc. and defeats the *_FOR_BUILD definitions
99+
# passed in CONFIGURE_VARS
100+
define Build/Compile
101+
$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/$(MAKE_PATH)
102+
endef
103+
104+
define Build/Install
105+
$(call Build/Install/Default,install)
106+
$(SED) 's%^dispatcher *=.*%dispatcher = /usr/sbin/audispd%' $(PKG_INSTALL_DIR)/etc/audit/auditd.conf
107+
endef
108+
109+
define Build/InstallDev
110+
$(INSTALL_DIR) $(1)/usr/include
111+
$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
112+
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
113+
$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/*.pc $(1)/usr/lib/pkgconfig/
114+
$(INSTALL_DIR) $(1)/usr/lib
115+
$(CP) $(PKG_INSTALL_DIR)/usr/lib/* $(1)/usr/lib/
116+
endef
117+
118+
define Package/libauparse/install
119+
$(INSTALL_DIR) $(1)/usr/lib
120+
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libauparse.so.* $(1)/usr/lib/
121+
endef
122+
123+
define Package/audit-utils/install
124+
$(INSTALL_DIR) $(1)/usr/bin
125+
$(CP) $(PKG_INSTALL_DIR)/usr/bin/* $(1)/usr/bin/
126+
$(INSTALL_DIR) $(1)/usr/sbin
127+
$(CP) \
128+
$(PKG_INSTALL_DIR)/usr/sbin/{augenrules,audispd,audisp-remote,auditctl,autrace,aureport,ausearch} \
129+
$(1)/usr/sbin/
130+
endef
131+
132+
define Package/audit/install
133+
$(INSTALL_DIR) $(1)/etc/audit
134+
$(CP) $(PKG_INSTALL_DIR)/etc/audit/* $(1)/etc/audit/
135+
$(INSTALL_DIR) $(1)/etc/init.d
136+
$(INSTALL_BIN) ./files/audit.init $(1)/etc/init.d/audit
137+
$(INSTALL_DIR) $(1)/usr/sbin
138+
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/auditd $(1)/usr/sbin/
139+
endef
140+
141+
$(eval $(call HostBuild))
142+
$(eval $(call BuildPackage,libauparse))
143+
$(eval $(call BuildPackage,audit-utils))
144+
$(eval $(call BuildPackage,audit))

‎utils/audit/files/audit.init‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/sh /etc/rc.common
2+
# Copyright (c) 2014 OpenWrt.org
3+
4+
START=11
5+
6+
USE_PROCD=1
7+
PROG=/usr/sbin/auditd
8+
9+
start_service() {
10+
mkdir -p /var/log/audit
11+
procd_open_instance
12+
procd_set_param command "$PROG" -n
13+
procd_set_param respawn
14+
procd_close_instance
15+
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules
16+
}

‎utils/audit/patches/0001-Add-substitue-functions-for-strndupa-rawmemchr.patch‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
From c39a071e7c021f6ff3554aca2758e97b47a9777c Mon Sep 17 00:00:00 2001
2+
From: Steve Grubb <sgrubb@redhat.com>
3+
Date: Tue, 26 Feb 2019 18:33:33 -0500
4+
Subject: [PATCH] Add substitue functions for strndupa & rawmemchr
5+
6+
(cherry picked from commit d579a08bb1cde71f939c13ac6b2261052ae9f77e)
7+
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
8+
---
9+
auparse/auparse.c | 12 +++++++++++-
10+
auparse/interpret.c | 9 ++++++++-
11+
configure.ac | 14 +++++++++++++-
12+
src/ausearch-lol.c | 12 +++++++++++-
13+
4 files changed, 43 insertions(+), 4 deletions(-)
14+
15+
diff --git a/auparse/auparse.c b/auparse/auparse.c
16+
index 650db02..2e1c737 100644
17+
--- a/auparse/auparse.c
18+
+++ b/auparse/auparse.c
19+
@@ -1,5 +1,5 @@
20+
/* auparse.c --
21+
- * Copyright 2006-08,2012-17 Red Hat Inc., Durham, North Carolina.
22+
+ * Copyright 2006-08,2012-19 Red Hat Inc., Durham, North Carolina.
23+
* All Rights Reserved.
24+
*
25+
* This library is free software; you can redistribute it and/or
26+
@@ -1118,6 +1118,16 @@ static int str2event(char *s, au_event_t *e)
27+
return 0;
28+
}
29+
30+
+#ifndef HAVE_STRNDUPA
31+
+static inline char *strndupa(const char *old, size_t n)
32+
+{
33+
+ size_t len = strnlen(old, n);
34+
+ char *tmp = alloca(len + 1);
35+
+ tmp[len] = 0;
36+
+ return memcpy(tmp, old, len);
37+
+}
38+
+#endif
39+
+
40+
/* Returns 0 on success and 1 on error */
41+
static int extract_timestamp(const char *b, au_event_t *e)
42+
{
43+
diff --git a/auparse/interpret.c b/auparse/interpret.c
44+
index 51c4a5e..67b7b77 100644
45+
--- a/auparse/interpret.c
46+
+++ b/auparse/interpret.c
47+
@@ -853,6 +853,13 @@ err_out:
48+
return print_escaped(id->val);
49+
}
50+
51+
+// rawmemchr is faster. Let's use it if we have it.
52+
+#ifdef HAVE_RAWMEMCHR
53+
+#define STRCHR rawmemchr
54+
+#else
55+
+#define STRCHR strchr
56+
+#endif
57+
+
58+
static const char *print_proctitle(const char *val)
59+
{
60+
char *out = (char *)print_escaped(val);
61+
@@ -863,7 +870,7 @@ static const char *print_proctitle(const char *val)
62+
// Proctitle has arguments separated by NUL bytes
63+
// We need to write over the NUL bytes with a space
64+
// so that we can see the arguments
65+
- while ((ptr = rawmemchr(ptr, '\0'))) {
66+
+ while ((ptr = STRCHR(ptr, '\0'))) {
67+
if (ptr >= end)
68+
break;
69+
*ptr = ' ';
70+
diff --git a/configure.ac b/configure.ac
71+
index 6e345f1..6f3007e 100644
72+
--- a/configure.ac
73+
+++ b/configure.ac
74+
@@ -1,7 +1,7 @@
75+
dnl
76+
define([AC_INIT_NOTICE],
77+
[### Generated automatically using autoconf version] AC_ACVERSION [
78+
-### Copyright 2005-18 Steve Grubb <sgrubb@redhat.com>
79+
+### Copyright 2005-19 Steve Grubb <sgrubb@redhat.com>
80+
###
81+
### Permission is hereby granted, free of charge, to any person obtaining a
82+
### copy of this software and associated documentation files (the "Software"),
83+
@@ -72,6 +72,18 @@ dnl; posix_fallocate is used in audisp-remote
84+
AC_CHECK_FUNCS([posix_fallocate])
85+
dnl; signalfd is needed for libev
86+
AC_CHECK_FUNC([signalfd], [], [ AC_MSG_ERROR([The signalfd system call is necessary for auditd]) ])
87+
+dnl; check if rawmemchr is available
88+
+AC_CHECK_FUNCS([rawmemchr])
89+
+dnl; check if strndupa is available
90+
+AC_LINK_IFELSE(
91+
+ [AC_LANG_SOURCE(
92+
+ [[
93+
+ #define _GNU_SOURCE
94+
+ #include <string.h>
95+
+ int main() { (void) strndupa("test", 10); return 0; }]])],
96+
+ [AC_DEFINE(HAVE_STRNDUPA, 1, [Let us know if we have it or not])],
97+
+ []
98+
+)
99+
100+
ALLWARNS=""
101+
ALLDEBUG="-g"
102+
diff --git a/src/ausearch-lol.c b/src/ausearch-lol.c
103+
index 5d17a72..758c33e 100644
104+
--- a/src/ausearch-lol.c
105+
+++ b/src/ausearch-lol.c
106+
@@ -1,6 +1,6 @@
107+
/*
108+
* ausearch-lol.c - linked list of linked lists library
109+
-* Copyright (c) 2008,2010,2014,2016 Red Hat Inc., Durham, North Carolina.
110+
+* Copyright (c) 2008,2010,2014,2016,2019 Red Hat Inc., Durham, North Carolina.
111+
* All Rights Reserved.
112+
*
113+
* This software may be freely redistributed and/or modified under the
114+
@@ -152,6 +152,16 @@ static int compare_event_time(event *e1, event *e2)
115+
return 0;
116+
}
117+
118+
+#ifndef HAVE_STRNDUPA
119+
+static inline char *strndupa(const char *old, size_t n)
120+
+{
121+
+ size_t len = strnlen(old, n);
122+
+ char *tmp = alloca(len + 1);
123+
+ tmp[len] = 0;
124+
+ return memcpy(tmp, old, len);
125+
+}
126+
+#endif
127+
+
128+
/*
129+
* This function will look at the line and pick out pieces of it.
130+
*/
131+
--
132+
2.21.0
133+

‎utils/audit/patches/0002-fix-gcc-10.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 017e6c6ab95df55f34e339d2139def83e5dada1f Mon Sep 17 00:00:00 2001
2+
From: Steve Grubb <sgrubb@redhat.com>
3+
Date: Fri, 10 Jan 2020 21:13:50 -0500
4+
Subject: [PATCH 01/30] Header definitions need to be external when building
5+
with -fno-common (which is default in GCC 10) - Tony Jones
6+
7+
---
8+
src/ausearch-common.h | 2 +-
9+
1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+
diff --git a/src/ausearch-common.h b/src/ausearch-common.h
12+
index 6669203..3040547 100644
13+
--- a/src/ausearch-common.h
14+
+++ b/src/ausearch-common.h
15+
@@ -50,7 +50,7 @@ extern pid_t event_pid;
16+
extern int event_exact_match;
17+
extern uid_t event_uid, event_euid, event_loginuid;
18+
extern const char *event_tuid, *event_teuid, *event_tauid;
19+
-slist *event_node_list;
20+
+extern slist *event_node_list;
21+
extern const char *event_comm;
22+
extern const char *event_filename;
23+
extern const char *event_hostname;
24+
--
25+
2.26.2
26+

0 commit comments

Comments
 (0)