audit-3.0.6-150400.4.13.1 < > , l dp9|37T_"L4 al;\c5Qy &9Ex<~:~~%3,Nn AӲդ\Yꀡ&/]W0,\)idT='KGN s K`6 W%W0#@mdJa8[ΓӴ X.O4]/Q\&Q4`ojĭXTdy*jW}hnȰz~+l Ať2Y \MPbюw@jw2]i( > L h ? X d A & 8 N `
[ [ [
[ [ 1 [
1 [ 3X [ 5 [ 6 7 [ 8 8 9 ; ( < 8 < % 9 < % : ?k % = v > ~ ? @ F G [ H [ I [ X Y \ ( [ ] [ ^ u b c d # e ( f + l - u @ [ v w [ x @ [ y K z T C audit 3.0.6 150400.4.13.1 User Space Tools for Kernel Auditing The audit package contains the user space utilities for storing and
processing the audit records generated by the audit subsystem in the
Linux kernel. ds390zp3a
ESUSE Linux Enterprise 15 SUSE LLC LGPL-2.1-or-later https://www.suse.com/ System/Monitoring https://people.redhat.com/sgrubb/audit/ linux s390x
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
for service in auditd.service ; do
sysv_service=${service%.*}
if [ ! -e /usr/lib/systemd/system/$service ] &&
[ ! -e /etc/init.d/$sysv_service ]; then
mkdir -p /run/systemd/rpm/needs-preset
touch /run/systemd/rpm/needs-preset/$service
elif [ -e /etc/init.d/$sysv_service ] &&
[ ! -e /var/lib/systemd/migrated/$sysv_service ]; then
/usr/sbin/systemd-sysv-convert --save $sysv_service || :
mkdir -p /run/systemd/rpm/needs-sysv-convert
touch /run/systemd/rpm/needs-sysv-convert/$service
fi
done
fi
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
for service in augenrules.service ; do
sysv_service=${service%.*}
if [ ! -e /usr/lib/systemd/system/$service ] &&
[ ! -e /etc/init.d/$sysv_service ]; then
mkdir -p /run/systemd/rpm/needs-preset
touch /run/systemd/rpm/needs-preset/$service
elif [ -e /etc/init.d/$sysv_service ] &&
[ ! -e /var/lib/systemd/migrated/$sysv_service ]; then
/usr/sbin/systemd-sysv-convert --save $sysv_service || :
mkdir -p /run/systemd/rpm/needs-sysv-convert
touch /run/systemd/rpm/needs-sysv-convert/$service
fi
done
fi # Save existing audit files if any (from old locations)
if [ -f /etc/auditd.conf ]; then
mv /etc/audit/auditd.conf /etc/audit/auditd.conf.new
mv /etc/auditd.conf /etc/audit/auditd.conf
fi
if [ -f /etc/audit.rules ]; then
mv /etc/audit.rules /etc/audit/audit.rules
elif [ ! -f /etc/audit/audit.rules ]; then
cp /etc/audit/rules.d/audit.rules /etc/audit/audit.rules
fi
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
if [ "$YAST_IS_RUNNING" != "instsys" ]; then
/usr/bin/systemctl daemon-reload || :
fi
for service in auditd.service ; do
sysv_service=${service%.*}
if [ -e /run/systemd/rpm/needs-preset/$service ]; then
/usr/bin/systemctl preset $service || :
rm "/run/systemd/rpm/needs-preset/$service" || :
elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then
/usr/sbin/systemd-sysv-convert --apply $sysv_service || :
rm "/run/systemd/rpm/needs-sysv-convert/$service" || :
touch /var/lib/systemd/migrated/$sysv_service || :
fi
done
fi
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
if [ "$YAST_IS_RUNNING" != "instsys" ]; then
/usr/bin/systemctl daemon-reload || :
fi
for service in augenrules.service ; do
sysv_service=${service%.*}
if [ -e /run/systemd/rpm/needs-preset/$service ]; then
/usr/bin/systemctl preset $service || :
rm "/run/systemd/rpm/needs-preset/$service" || :
elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then
/usr/sbin/systemd-sysv-convert --apply $sysv_service || :
rm "/run/systemd/rpm/needs-sysv-convert/$service" || :
touch /var/lib/systemd/migrated/$sysv_service || :
fi
done
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then
# Package removal, not upgrade
/usr/bin/systemctl --no-reload disable auditd.service || :
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services
test "$DISABLE_STOP_ON_REMOVAL" = yes -o \
"$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0
/usr/bin/systemctl stop auditd.service
) || :
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then
# Package removal, not upgrade
/usr/bin/systemctl --no-reload disable augenrules.service || :
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services
test "$DISABLE_STOP_ON_REMOVAL" = yes -o \
"$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0
/usr/bin/systemctl stop augenrules.service
) || :
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ $1 -eq 0 ]; then
# Package removal
for service in auditd.service ; do
sysv_service="${service%.*}"
rm -f "/var/lib/systemd/migrated/$sysv_service" || :
done
fi
if [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl daemon-reload || :
fi
if [ "$FIRST_ARG" -ge 1 ]; then
# Package upgrade, not uninstall
if [ -x /usr/bin/systemctl ]; then
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services
test "$DISABLE_RESTART_ON_UPDATE" = yes -o \
"$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0
/usr/bin/systemctl try-restart auditd.service
) || :
fi
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ $1 -eq 0 ]; then
# Package removal
for service in augenrules.service ; do
sysv_service="${service%.*}"
rm -f "/var/lib/systemd/migrated/$sysv_service" || :
done
fi
if [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl daemon-reload || :
fi
if [ "$FIRST_ARG" -ge 1 ]; then
# Package upgrade, not uninstall
if [ -x /usr/bin/systemctl ]; then
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services
test "$DISABLE_RESTART_ON_UPDATE" = yes -o \
"$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0
/usr/bin/systemctl try-restart augenrules.service
) || :
fi
fi / f G 7 ' @ 8 X G ] M G / n : Q 2 0 C ' # F F V +` X FH t R 6
Q D A聤A聠A聠큤AA큤A큤A큤A聠A ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddaW9aW9aW9daW9dddddddddddddddd c90c9e248efa3381f9344c507450cdf21849945f775d7c59291b6ab54dad830c d9953f20b2be7c063e714b8d2a4895472733fc3d94bcf866e40529afc91b8726 b7c3e851e8901bc6b2895a6be8abe38887ea4bf8bcc9bf2699bf940c7974b567 2526e4ae01cd81c3ab2d59bfcc8bf3f6828d1e5eb3bd791d009b869f97d1f20c 6706201085e33dc29725b0bfa2c7b7d1f2e4083fda0c6b3297b70099e9fec3e9 e048751ffc3b310a8b4a83abbef65b7f0bfd1d1b609ce6d239e1e842ef1cb75d c2a67ef267a1bdd77fe2ebc6b5de9109cecd2212b3e2b4a8e2348464d095cab6 626dbcb7ef733d187a2b94ec0657966751b4e29fd5896d822fd442c49bba39d8 44114f3270c730508b9a41175f2da9d60ebd8502cfd79aac2fbc2536230791d6 51d62df5e723db2210611ee522194539437522e969ae6a22294136d28f1c0316 d097e9557c8e779146638c65fefcbd6362694e39a4ee81000e257b32450e697a d323c4b67ebff72a44e646e78994cbbb896b2dee85b3ed74ee7b78e5e70c0c8d bd724de23d938d69aebec1bd393305834fb0a4b058bdcddfc81cfbeddaa947ec 0c061d497ff443d07fdf9069baac84718ca28141644d369bc27eaf58342f6d6c 703e57e8cd6f64bdb5631b18ffdc18cce824c6e9879f82d90b4c3a001ede7756 334ae0dc05546c52594f93ab97e64dc60ad81a8a1b618a8fc22b91be5661b7b8 ca89400db44eba3dc7c70e7c55c11e53457c3b1f2ea9f5482b180436bcb7169f 016adc0e6e7898422628b171c293ccc140d469689649950cfd9cc252abdb5e29 54c2cebdaadfb928f7327cc066218e38743f0ff94d02fe162a7a415e148d23a8 6706201085e33dc29725b0bfa2c7b7d1f2e4083fda0c6b3297b70099e9fec3e9 5aba151df1a4026ac2bdb4da8652d47c083b63fc5db96ecbbeaf98223ea7db2f 5fe258398c4e2a79a1a4a996c262df303c497c444fc29b630028c6bcff8a0680 206f8340e59187c1a75b161796d6a5711bb9fcc72784b33dfd9c035a9d127b5a da083a4565d649a86f0fa56d1ed0b686ba78da80a24b290924b9da9ff30743d4 d8a12f8a49f111b7aac15f6cac6bc38926d7dc9611691cc290ad23c7b877f341 0aca9a37a27583d8bb49d99b6a30f28e04958ac656d35f9b217a4ffaf7c48042 d51b846cfb48c1f6eabc2969db872dccfef2a942beafdab7fcb5e79e35b67781 95d76e614f68398ad13b48a0f523306aa0bb38aaea285b88d4225fdf69069cf6 7bc05cbcfde0664abc759bad2fa8577681007d1db77b0bf5a562b1d52f8b0c79 c97448ae2dcdbedb4c50464bfcec2a56886314d1ba8ee002f6bf63ec093b1b6b dc6f182ce7a0195e63f1ce60e0812c601e38de022fb8baf03ad6560e78fd73ca caeb9a7f4bb77ab89027f11789e02eb6e9b4f2fc4346eeaea25efe1730d83fe6 7883a1f395d181e5da850ff77b3a6c69eec5ab68d24e71da1b8f5b5212954599 d8267adb81be2e6fffb0b86341297ef0806261113fc59e29a7bf87a4e5dea0d8 1eb6a682e840cb04f611ab5f768b65d1f41c898e11ad3c6d0545d03562c03ad0 2c4e9dbd58405bc275e7e187d6ec2eb9436aa54073f557b83ef6e4a06a55fc53 ddd91b8bb35bb9559163c6402ebcd3b06e7ecf84a1bb6d5aed89a3f94f4109cd 3cf174b6005bfe0fa6cc3aa256bc96a7d335bb9cd554dbc8dda3c916a8f497de 1d6a69c3d93637b3bc427c10717d2fc9a6a786b97f33b718c4ce34c2ebe61cb5 7eb41a6aaf6737c2571b6424fae7fa53af4b41a9115b6c5732a5778ccd9900ad c57e70e8785c8465bd22d1cf832c6c1d2c29c67afdb10ec2e338de556e18da83 a6d974558dae7b6d24edf083a0d72bb8d15ac463da0717fcd854235168390033 c8e5cc97e0b04dce3524a534a85f7005066a284a2d38a104a2f87072d83e3830 f36c7a49f882792bb7a15d2d9d388117d14fe09cfc25712972930db6663fe894 76b309408dd3ca1876baaecb0117fec0f76b6fd8bcc968e2cc616d95dacbcba2 b932715f5989044c0e238fb88ccb5caa39f9554f992bc38cc8ddba55c622c3f3 0b7754e8ee41c0f579e828502b9d19cceac1db18ef740a80589e59cd35dfc1a5 34bf22df5c3e2121b431913a3afe6397e30b24453a7ecb7844b17799984895eb 88fe75a3bcb807fad74cd020e6e04347f7dbd3ef16de314c0c6a976cdde0dda0 93222d0d49483ff9c6a3dc9879992e7f61404efb65373eaab12a4b87ef3da02a 0761b60c49e34bb46ce344d84d120d62f27d593774d34ef1eddbc85b7a8b15ea 5fc54d4981a480e15bc6e1f7e703eeca446cc5b95cc424459c24c40013020d1d 52e95855b574e7230ae69fa1ae088a9d582ba7bb493b473d5f10e67f658ae772 00e0926039f166a9f8d5b0b825e33358c7f2c1ccc6f86067ba2f684c26d13f95 c06136de99e9a6628e4c5a2b007c4f028fcfcef23830a5e58557a7520d8c7a27 154100806c1128a8d0456c95bb70f934dc9ceab2e9b6ecb92f764eb8d4924b12 8655d58e59eb7420d5182aa76017daf40452ebabc1a5131de0a7320aeeee2368 32b1062f7da84967e7019d01ab805935caa7ab7321a7ced0e30ebe75e5df1670 902053bbf311b19370f1dcdecd18e5e887882cfe3a2c1fd862926035349efea3 9ea670026166dd6f362ed954032f06afead4b8e6f121feaf5933be59fe64c570 27ac54ae2bf30b7909e61f161154dc2baa0ef43b84b429fc65d028acc32d2974 11babfd1ab764971df44a1c75b56fb7ee14fca48bc73fe566c3bd88dd52ec595 a3debc88bdd2339fde1ae1aa838c437e2af73d9a2f43d0505fb0b1af92c26995 e37139d148e3c0e0a3d29e60969dfd591b9e4b1c03a9a6ef1579bce90f56aafb ea420ca865e0439c4e9bfb9e9d1d64044f0d93327d7aca25e069916ace890969 25317334b644bc5376842459b8050569caf3b203ca48e9c52acb5277d20fe28a 10d6c6a953211c26260362afddd07d16b3d246c75893e11af3c245fa1c6fd2a5 fa2c911501e9a26d563edf62bb9a5158113e94134bcbe7489fbc5cdbf0518c91 ed5560e3ed3b584df4356527afee3116c1f3b8cb12f43d5e0c69e124e4e31230 bf0850732938dbe685495d0da757e691198d7533d76273495136adad413f2c53 0b366481917bf01b313e0c5ba2a3450e517f4b4cd9400a1db6b1a13498ca0330 /usr/sbin/audisp-syslog /usr/sbin/auditctl /usr/sbin/auditd /usr/sbin/augenrules /usr/sbin/aureport /usr/sbin/ausearch /usr/sbin/autrace service @ @ Q root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root audit audit root audit-secondary-3.0.6-150400.4.13.1.src.rpm audit audit(s390-64) config(audit) @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
/bin/sh /bin/sh /bin/sh /bin/sh /bin/sh audit-libs config(audit) coreutils group(audit) libaudit.so.1()(64bit) libauparse.so.0()(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.15)(64bit) libc.so.6(GLIBC_2.17)(64bit) libc.so.6(GLIBC_2.2)(64bit) libc.so.6(GLIBC_2.3)(64bit) libc.so.6(GLIBC_2.3.2)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libc.so.6(GLIBC_2.7)(64bit) libc.so.6(GLIBC_2.8)(64bit) libc.so.6(GLIBC_2.9)(64bit) libcap-ng.so.0()(64bit) libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2)(64bit) libpthread.so.0(GLIBC_2.3.2)(64bit) libwrap.so.0()(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.6 3.0.6-150400.4.13.1 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 dhdhdq@bT@b? @b=b; aaaim@af@aHwaC1aS@a`D`@`@_ǁ_@^ [\|[.6@[&M@ZlZZZz@ZyZ_:ZC@YYYu@Ym@VbUematsumiya@suse.de ematsumiya@suse.de ematsumiya@suse.de jengelh@inai.de coolo@suse.com ematsumiya@suse.com dmueller@suse.com fvogt@suse.com gmbr3@opensuse.org gmbr3@opensuse.org ematsumiya@suse.com ematsumiya@suse.com ematsumiya@suse.com meissner@suse.com ematsumiya@suse.com ematsumiya@suse.com dimstar@opensuse.org ematsumiya@suse.com abergmann@suse.com lnussel@suse.de tonyj@suse.com jengelh@inai.de antoine.belvire@opensuse.org antoine.belvire@opensuse.org kukuk@suse.de tonyj@suse.com meissner@suse.com tchvatal@suse.com normand@linux.vnet.ibm.com tchvatal@suse.com mpluskal@suse.com aavindraa@gmail.com dimstar@opensuse.org jengelh@inai.de tonyj@suse.com tchvatal@suse.com tonyj@suse.com - Update audit-secondary.spec: create symbolic link from
/sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Check for AF_UNIX unnamed sockets (bsc#1210004)
* add check-for-AF_UNIX-unnamed-sockets.patch - Drop buildrequire on C++ compiler.
- Modernize specfile constructs. - Fix buildrequire for openldap2-devel - audit doesn't require the
(outdated) C++ binding, but the C headers that happen to be pulled
in by buildrequiring the C++ devel package - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
* add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
* add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - add audit-userspace-517-compat.patch - Use %autosetup
- Don't include sample rules as %doc, they're already installed
as normal files
- Fix create-augenrules-service.patch:
* auditd.service needs to require augenrules.service,
not the other way around
- Fix documentation for enable-stop-rules.patch - Update to version 3.0.6:
* fixes a segfault on some SELINUX_ERR records
* makes IPX packet interpretation dependent on the ipx header
file existing
* adds b32/b64 support to ausyscall
* adds support for armv8l
* fixes auditctl list of syscalls on PPC
* auditd.service now restarts auditd under some conditions - Add CONFIG parameter to %sysusers_generate_pre - Create separate service for augenrules (bsc#1191614, bsc#1181400)
* add create-augenrules-service.patch
Remove ReadWritePaths=/etc/audit from auditd.service, also removes
augenrules call from ExecStartPost.
Create augenrules.service with the ReadWritePaths directive above.
This makes /etc/audit only accessible by augenrules.service and
let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file. - Fix hardened auditd.service (bsc#1181400)
* add fix-hardened-service.patch
Make /etc/audit read-write from the service.
Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
* add enable-stop-rules.patch - Change default log_format from ENRICHED to RAW (bsc#1190500):
* add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
* In auditd, flush uid/gid caches when user/group added/deleted/modified
* Fixed various issues when dealing with corrupted logs
* In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
* Apply performance speedups to auparse library
* Optimize rule loading in auditctl
* Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
* Update syscall table to the 5.14 kernel
* Fixed various issues when dealing with corrupted logs - harden_auditd.service.patch: automatic hardening applied to systemd
services - Update to version 3.0.3:
* Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
* Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
* Change auparse_feed_has_data in auparse to include incomplete events
* Auditd, stop linking against -lrt
* Add ProtectHome and RestrictRealtime to auditd.service
* In auditd, read up to 3 netlink packets in a row
* In auditd, do not validate path to plugin unless active
* In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls - Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
* add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush & reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomáš Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid & success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa & rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha & IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream - Do not explicitly provide group(audit) in system-users-audit:
this is automatically handled by rpm/providers. - Create new "audit" group for read access to logs (bsc#1178154)
* add change-default-log_group.patch
* update audit-secondary.spec - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - prepare usrmerge (boo#1029961) - Update to version 2.8.5:
* Fix segfault on shutdown
* Fix hang on startup (#1587995)
* Add sleep to script to dump state so file is ready when needed
* Add auparse_normalizer support for SOFTWARE_UPDATE event
* Mark netlabel events as simple events so that get processed quicker
* When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
* Add 30-ospp-v42.rules to meet new Common Criteria requirements
* Update lookup tables for the 4.18 kernel
* In aureport, fix segfault in file report
* Add auparse_normalizer support for labeled networking events
* Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
* Event aging is off by a second
* In ausearch/auparse, correct event ordering to process oldest first
* auparse_reset was not clearing everything it should
* Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
* In ausearch/report, lightly parse selinux portion of USER_AVC events
* In ausearch/report, limit record size when malformed
* In auditd, fix extract_type function for network originating events
* In auditd, calculate right size and location for network originating events
* Treat all network originating events as VER2 so dispatcher doesn't format it
* In audisp-remote do an initial connection attempt (#1625156)
* In auditd, allow expression of space left as a percentage (#1650670)
* On PPC64LE systems, only allow 64 bit rules (#1462178)
* Make some parts of auditd state report optional based on config
* Fix ausearch when checkpointing a single file (Burn Alting)
* Fix scripting in 31-privileged.rules wrt filecap (#1662516)
* In ausearch, do not checkpt if stdin is input source
* In libev, remove __cold__ attribute for functions to allow proper hardening
* Add tests to configure.ac for openldap support
* Make systemd support files use /run rather than /var/run (Christian Hesse)
* Fix minor memory leak in auditd kerberos credentials code
* Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
* In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch - Reduce scriptlets' hard dependency on systemd. - Update to version 2.8.4:
* Generate checkpoint file even when not results are returned
(Burn Alting).
* Fix log file creation when file logging is disabled entirely
(Vlad Glagolev).
* Use SIGCONT to dump auditd internal state (rh#1504251).
* Fix parsing of virtual timestamp fields in ausearch_expression
(rh#1515903).
* Fix parsing of uid & success for ausearch.
* Hide lru symbols in auparse.
* Fix aureport summary time range reporting.
* Allow unlimited retries on startup for remote logging.
* Add queue_depth to remote logging stats and increase default
queue_depth size. - Update to version 2.8.3:
* Correct msg function name in lru debug code.
* Fix a segfault in auditd when dns resolution isn't available.
* Make a reload legacy service for auditd.
* In auparse python bindings, expose some new types that were
missing.
* In normalizer, pickup subject kind for user_login events.
* Fix interpretation of unknown ioctcmds (rh#1540507).
* Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, &
RESP_ORIGIN_BLOCK_TIMED events.
* In auparse_normalize for USER_LOGIN events, map acct for
subj_kind.
* Fix logging of IPv6 addresses in DAEMON_ACCEPT events
(rh#1534748).
* Do not rotate auditd logs when num_logs < 2 (brozs). - Use %license instead of %doc [bsc#1082318] - Change openldap dependency to client only (bsc#1085003)
- Resolve issue with previous change if both Python2 and Python3 are
present, tests were failing as python2 bindings are preferred in this
case. - reverted -j1 force ppc specific only - Add patch to fix test run without python2 interpreter:
* audit-python3.patch
- Update to 2.8.2 release:
* Update tables for 4.14 kernel
* Fixup ipv6 server side binding
* AVC report from aureport was missing result column header (#1511606)
* Add SOFTWARE_UPDATE event
* In ausearch/report pickup any path and new-disk fields as a file
* Fix value returned by auditctl --reset-lost (Richard Guy Briggs)
* In auparse, fix expr_create_timestamp_comparison_ex to be numeric field
* Fix building on old systems without linux/fanotify.h
* Fix shell portability issues reported by shellcheck
* Auditd validate_email should not use gethostbyname - force -j1 for PowerPC make check to avoid build failure
(lookup_test.o: file not recognized: File truncated) - Add conditions around python plugins to allow us to conditionalize
them in enviroment without python2 - Rename python binding packages to match current python packaging
standards
- Update python build dependencies to resolve future split of
python2/3 - Update to version 2.8.1. See audit.spec (libaudit1) for upstream
changelog
- Remove audit-implicit-writev.patch (fixed upstream across 2
commits)
* 3b30db20ad983274989ce9a522120c3c225436b3
* 07132c22314e9abbe64d1031fd8734243285bb3f
- Cleanup with spec-cleaner - Add audit-implicit-writev.patch: include sys/uio.h to ensure
readv and writev are declared. - Rectify RPM groups, diversify descriptions.
- Remove mentions of static libraries because they are not built. - Update to version 2.7.7. See audit.spec (libaudit1) for upstream
changelog
Since commit 6cf57d27 (2.7.4) audit is now started as an non-forking
service (bsc#1042781).
Add config: audit-stop.rules
Refresh patch: audit-allow-manual-stop.patch
Refresh patch: audit-no-gss.patch - Version update to 2.5. See audit.spec (libaudit1) for upstream
changelog
- Cleanup with spec-cleaner
- Sort out bit /sbin /usr/sbin/ installation
- Install the rules as documentation
- Remove needless %py_requires from python subpkgs - Update to version 2.4.4. See audit.spec (libaudit1) for upstream
changelog
- Add python3 bindings for libaudit and libauparse
- Remove patch 'audit-no_m4_dir.patch'
(added Fri Apr 26 11:14:39 UTC 2013 by mmeister@suse.com)
No idea what earlier 'automake' build error this was trying to fix but
it broke the handling of "--without-libcap-ng". Anyways, no build error
occurs now and m4 path is also needed in v2.4.4 to find ax_prog_cc_for_build /bin/sh /bin/sh /bin/sh /bin/sh s390zp3a 1692262884
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ 3.0.6-150400.4.13.1 3.0.6-150400.4.13.1 3.0.6-150400.4.13.1
audit audit.rules audit-stop.rules auditd.conf plugins.d af_unix.conf syslog.conf rules.d audit.rules auditd.conf audisp-syslog auditctl auditd augenrules aureport ausearch autrace aulast aulastlog ausyscall auvirt auditd.service augenrules.service audisp-syslog auditctl auditd augenrules aureport ausearch autrace rcauditd audit sample-rules 10-base-config.rules 10-no-audit.rules 11-loginuid.rules 12-cont-fail.rules 12-ignore-error.rules 20-dont-audit.rules 21-no32bit.rules 22-ignore-chrony.rules 23-ignore-filesystems.rules 30-nispom.rules 30-ospp-v42-1-create-failed.rules 30-ospp-v42-1-create-success.rules 30-ospp-v42-2-modify-failed.rules 30-ospp-v42-2-modify-success.rules 30-ospp-v42-3-access-failed.rules 30-ospp-v42-3-access-success.rules 30-ospp-v42-4-delete-failed.rules 30-ospp-v42-4-delete-success.rules 30-ospp-v42-5-perm-change-failed.rules 30-ospp-v42-5-perm-change-success.rules 30-ospp-v42-6-owner-change-failed.rules 30-ospp-v42-6-owner-change-success.rules 30-ospp-v42.rules 30-pci-dss-v31.rules 30-stig.rules 31-privileged.rules 32-power-abuse.rules 40-local.rules 41-containers.rules 42-injection.rules 43-module-load.rules 44-installers.rules 70-einval.rules 71-networking.rules 99-finalize.rules README-rules audit ChangeLog README auditd.cron audit COPYING auditd.conf.5.gz ausearch-expression.5.gz audit.rules.7.gz auditctl.8.gz auditd.8.gz augenrules.8.gz aulast.8.gz aulastlog.8.gz aureport.8.gz ausearch.8.gz ausyscall.8.gz autrace.8.gz auvirt.8.gz audit audit.log audit /etc/ /etc/audit/ /etc/audit/plugins.d/ /etc/audit/rules.d/ /sbin/ /usr/bin/ /usr/lib/systemd/system/ /usr/sbin/ /usr/share/ /usr/share/audit/ /usr/share/audit/sample-rules/ /usr/share/doc/packages/ /usr/share/doc/packages/audit/ /usr/share/licenses/ /usr/share/licenses/audit/ /usr/share/man/man5/ /usr/share/man/man7/ /usr/share/man/man8/ /var/log/ /var/log/audit/ /var/spool/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:30277/SUSE_SLE-15-SP4_Update/b33244660a91624af00862daaaccee6a-audit-secondary.SUSE_SLE-15-SP4_Update drpm xz 5 s390x-suse-linux
directory empty ASCII text ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=421c605fe6fc32470654a3b026cd864f61393ea8, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=0eed5aec26e0dc2f91da682898b91b9c5e00194b, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=06cf4863b5df5e12d18c1146710f02304cbf6fec, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=7500f208f24519237802630660f09dce909fc230, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=e48b1b17718feebcdde18f70f331761808f3293e, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=da100cd19ac9d661b6a01e08383c765acea96ccc, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=c2910f46688ea6550a674cef051a62125bd43fe3, for GNU/Linux 3.2.0, stripped POSIX shell script, ASCII text executable ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=48a6328734699710b06601da2933d12767c2af14, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=599797ce966b5119ec11d8e8f5f4ff5c03c0c812, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=9cd081cde40ef7fb34c31597d5de6f2017f08cd9, for GNU/Linux 3.2.0, stripped UTF-8 Unicode text troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)
" 3 4 = F R R R
R R R R
R R R R R R R R R R R
R R R R R
R R R R R R R R R R
R R R R R R R R R
R R R R R R R
R R R R R R R R R R R
R R R R R R R R R
R R R R R R t" woEh7( systemd systemd utf-8 ac373477131a0ea6f919029b4af2e9f35c1c2fa3405ab94dcc1e73710ab17bb0 ? @ 7zXZ
! t/5J ] "k%fs)q
tNZa̅#D7\MdH(DRP
nȐRj>F0הT~ͣiaW "ffQ+2/~uE /]D^j# iϒI) rt }iαrlkf1"98)eCX0|; RoڅU~_ 0iw`ูWBPH6v<܃E?7C{Yg%_ SP?<;C
u8 ;`?8h_#p ڗ[Pj
;:t[0fH ']˜j? kѯNw8VghBpZg~E G7UٟG+X:+o~
RbzG N-@,]Dv|Ub#a#xQ<{I"k2Gzw{P0N|(7 x]?{b~&lh85l8gr e?0Z 3ߩ#YB[jfQ ,齤~.9ڎLgdXù <iG mὐSm&WG} K'o'\4^ƦS7'5őq-Q.LD UE9+ .A *R%cO:cD=x 2o\l}A4hp v\ʴ9H%ӋdƖ/[ b5S)ެSX)dN(7)FJm$8=Q9Lu8Ty%DүHK7A*ĴY S
.&s" vy_1VGD
0kpDJQC.G\o+O2 F4ZԼ]^'ܰ\}mpN,ХSʢlq +f<%/ôg0s/b*fWF
Y
O[7z`+9അ{R@.<8/
;
5^@) jd*2DNJǜoJlT0i Ƹm!T'{T & T1 u
9lLi Zo5
-;<4 k ^g4- n>*X8] [)7%,y 8TJyYk~H5F܇_Ss7j:Gr qԙ*Q ]k:Ю-tᢑȱƐ=0Qެav}'1ޓΛM$+ڨ~2YAkRN x߹Ǔy? =L[q5us>;Ahŕʠt߇9k <4F;\3WuUe)D%Fz̚%$_C7K- iŌ%7簍w*|RGޡ_E$Ymأ
f%f홌}^2
Ӛ1t?t1`HQIB
`ρ p>,dey)k ӆlچ~*U J 7MzvFlaOi㓐M \yK]t-VQUYA'oa8תPaocI,
kѲS_ /Iww[?S541/S|5_P9'
O މK_rBn] ܺAvУH{kb-jx4
|PfѸw[BGq{ѿݖX4$
0s.>t 7^z*t?[_L)Zt]̍r%$lf@B#ݬq\r
Qc @lcX~:tAΕGD(XG]Fty.`gwf -EsH!>jM 2sua |EUhh [F ]+QakXs3^:2q LDfʡ0WI ]μ1c Hl>2. q\%M1_5nƖ2@.)E4σGױI֑C(kµu~,3gUhZ[[PesKJ썌Bh CD3nxE'$8\3YmmmzPb
HL ~Wvy>ˣs
j kT;OVKx6ݢW%g>alM 8]m[uI G*d5@uM_7ls*B0=sVIBg΄ #8P cg
T9h]zFL&L=)%X((%QSZ| Οr(
R9K۲<)5NPWi,1ZJL.hsd?
D8E u1Ԋcw Dec&f*G=՝B9:
0dLtia|8/[("Nl1Պ9Ph(i\^/VCX@^;^/.ɛ.AO@45lH h>ݹ1t\Uu<_Бټ{ zw{NѤ(?ZV8){s令M gS>W8ZΧgn$`MS@L rE7AE3~8dtHb,n%Ijի eyoJ@x]mѸl.RT=Բ3TKP)2 ?v
`㏗|$T0rr>\ O%5=B$j/Nc ( NAAh=L{{RѨ1 ##T b r%i:DLS~q`d #rRfCNcխ̈́i7F5/WiQ:VXLŲZ
1ʒpaW0t帝+,m!Ɠ>8y3D wӭќGT5d\C}|` |2 dzz>%=;~kU#rC9?wHV 4`*N,ĬgZPK3L\ <4i=ՇS_q'ٞ#~ r[}崙s8 ?Q I_H (ܻٺ%=@VX;:<G9 qa;&)߲*m?
,. uxn` &8zp)(F MD&C MMZ#{"A UvBC-e=)IsQdeg*6/eqhJ_ih>4#7P(h\CK4`c/qgӛ S|Qw@ i
D)${vk(;ݴv~vw 2C1ܹfoMWgKY8d2Fۀn{x_N]T,[ Mg/ c,KL Z%0#U?W*;*q?jh{nggWLl:]IKHZ-{TCjV_ĵ`iJxDC"g j F<[X 'A"w+u&x{ la3t/ [t JR o -)]Ɂ#|檤?_6go+DB +shKa.P_Bގ'/9VzG;wV Iz7_xT:jk!*[#e&F~ Mʾ= ,H=g 3>7
(8DH[XZԆVVsoo[7 8.) K<פY hg!gg..8+۲(y# N `Cljsþs '_W0Ң[x QDvK-|FnW
g|OU2_3^ӸixЄMGٜ|q7%Bz]+U6:|-7oN'ZҬ6:Cr+= B iujf״ZGMG ʊFr*=,cR
ҽ
#kƩTXF<w T{%߿e ~2JT ?(zgA: >Ҥ(ߩ6f'P6\QN@{*E/(p>| t G4p0XZ' ЄæaP'c9 kw-eu *jYc+t[ڥS<]B)-x}
lWz >|K>9 ^۩IB2Vf8L#7~lL#?RU$;aDeyX; zģ vwyO vb#kJ䷊&/=z+GP GF g ,nZ՜$AA$OPxº}>PWthtz08.a>6a#@;5Z3bХ 1 b9ee}4@[V_0Uc<HR8 C/^iuͼ / U{+j>\.O)F^d14 P\b Jy
A~>s$Cp]ٞc\ռlM `IXBAN$8 |T$Pn< w|V[wX(\$0` 2R*P<-+ɍUHXZԤ~#婠@v.7I}]thqx~8
h
:a!O7F 0M6Fҙ|I<1J PdoSe]%L+uO*F51DdGV5#tpǪj||}yA90cv FP5eΛvNǨ5_jG;=%A^ul \+}
?4nzL ;D{@}J_hD*@aH,ȩݐ
{F4*Ca^k}~R,hXr!&T~䳴 P/ iz$nR9D[s@Y^mYv8 šYKy.1`6-UsqJ5Ana_s ħ! q[E9Ӵ!4 x3"u01wop#/"
/5tIaϋC^Yf9Z8)\VXK_)雱.X
[ HL&Z }K4ƗM
x@DbQXlli#