943e1d4
%{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
c569128
cb9ea2d
Summary: User space tools for 2.6 kernel auditing
cvsdist 2c6ba58
Name: audit
3d59325
Version: 2.5.1
d9ee9ff
Release: 2%{?dist}
7c6e7fc
License: GPLv2+
654a5c9
Group: System Environment/Daemons
c5201dc
URL: http://people.redhat.com/sgrubb/audit/
129171d
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
ff9bb33
Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
c899139
BuildRequires: openldap-devel
c899139
BuildRequires: swig
c899139
BuildRequires: python-devel
c899139
BuildRequires: python3-devel
c899139
BuildRequires: tcp_wrappers-devel krb5-devel libcap-ng-devel
c899139
BuildRequires: kernel-headers >= 2.6.29
c899139
%ifarch %{golang_arches}
a0ab087
BuildRequires: golang
a0ab087
# Temporary fix for make check in golang. Needs libaudit.so
a0ab087
BuildRequires: audit-libs-devel
a0ab087
%endif
c899139
c899139
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
f0d4c91
BuildRequires: systemd
8b5d586
Requires(post): systemd-units systemd-sysv chkconfig coreutils
8b5d586
Requires(preun): systemd-units
8b5d586
Requires(postun): systemd-units coreutils
cvsdist 2c6ba58
cvsdist 2c6ba58
%description
cvsdist 2c6ba58
The audit package contains the user space utilities for
f553a5a
storing and searching the audit records generate by
cvsdist 2c6ba58
the audit subsystem in the Linux 2.6 kernel.
cvsdist 2c6ba58
75f4803
%package libs
75f4803
Summary: Dynamic library for libaudit
7c6e7fc
License: LGPLv2+
c5201dc
Group: Development/Libraries
c5201dc
75f4803
%description libs
75f4803
The audit-libs package contains the dynamic libraries needed for 
75f4803
applications to use the audit framework.
75f4803
75f4803
%package libs-devel
36cd75f
Summary: Header files for libaudit
7c6e7fc
License: LGPLv2+
75f4803
Group: Development/Libraries
c899139
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
b9f018d
Requires: kernel-headers >= 2.6.29
75f4803
75f4803
%description libs-devel
36cd75f
The audit-libs-devel package contains the header files needed for
36cd75f
developing applications that need to use the audit framework libraries.
36cd75f
36cd75f
%package libs-static
36cd75f
Summary: Static version of libaudit library
36cd75f
License: LGPLv2+
36cd75f
Group: Development/Libraries
36cd75f
Requires: kernel-headers >= 2.6.29
36cd75f
36cd75f
%description libs-static
36cd75f
The audit-libs-static package contains the static libraries
36cd75f
needed for developing applications that need to use static audit
36cd75f
framework libraries
c5201dc
9fb9401
%package libs-python
9fb9401
Summary: Python bindings for libaudit
7c6e7fc
License: LGPLv2+
9fb9401
Group: Development/Libraries
c899139
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
9fb9401
9fb9401
%description libs-python
9fb9401
The audit-libs-python package contains the bindings so that libaudit
cfd7264
and libauparse can be used by python.
9fb9401
0798e44
%package libs-python3
0798e44
Summary: Python3 bindings for libaudit
0798e44
License: LGPLv2+
0798e44
Group: Development/Libraries
c899139
Requires: %{name}%{?_isa} = %{version}-%{release}
c899139
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
0798e44
0798e44
%description libs-python3
0798e44
The audit-libs-python3 package contains the bindings so that libaudit
0798e44
and libauparse can be used by python3.
0798e44
597027a
%package -n audispd-plugins
597027a
Summary: Plugins for the audit event dispatcher
597027a
License: GPLv2+
597027a
Group: System Environment/Daemons
c899139
Requires: %{name}%{?_isa} = %{version}-%{release}
c899139
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
597027a
597027a
%description -n audispd-plugins
597027a
The audispd-plugins package provides plugins for the real-time
597027a
interface to the audit system, audispd. These plugins can do things
d9ee9ff
like relay events to remote machines.
d9ee9ff
d9ee9ff
%package -n audispd-plugins-zos
d9ee9ff
Summary: ZOS plugins for the audit event dispatcher
d9ee9ff
License: GPLv2+
d9ee9ff
Group: System Environment/Daemons
d9ee9ff
Requires: %{name}%{?_isa} = %{version}-%{release}
d9ee9ff
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
d9ee9ff
Requires: openldap
d9ee9ff
d9ee9ff
%description -n audispd-plugins-zos
d9ee9ff
The audispd-plugins-zos package provides a plugin that will forward all
d9ee9ff
incoming audit events, as they happen, to a configured z/OS SMF (Service
d9ee9ff
Management Facility) database, through an IBM Tivoli Directory Server
d9ee9ff
(ITDS) set for Remote Audit service.
597027a
cvsdist 2c6ba58
%prep
2760840
%setup -q
ff9bb33
cp %{SOURCE1} .
7e06215
cvsdist 2c6ba58
%build
a0ab087
%configure --sbindir=/sbin --libdir=/%{_lib} --with-python=yes \
0798e44
           --with-python3=yes --with-libwrap --enable-gssapi-krb5=yes \
0798e44
           --with-libcap-ng=yes --with-arm --with-aarch64 \
0798e44
           --enable-zos-remote \
c899139
%ifarch %{golang_arches}
a0ab087
           --with-golang \
a0ab087
%endif
c899139
           --enable-systemd
963a8b6
c899139
make CFLAGS="%{optflags}" %{?_smp_mflags}
cvsdist 2c6ba58
cvsdist 2c6ba58
%install
57623a8
mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audispd/plugins.d,etc/audit/rules.d}
597027a
mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
57646a8
mkdir -p $RPM_BUILD_ROOT/%{_lib}
965e81b
mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
d1e22d7
mkdir -p $RPM_BUILD_ROOT/%{_var}/log/audit
f205d23
mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit
7b312bd
make DESTDIR=$RPM_BUILD_ROOT install
cvsdist 2c6ba58
c5201dc
mkdir -p $RPM_BUILD_ROOT/%{_libdir}
aad9312
# This winds up in the wrong place when libtool is involved
19531ff
mv $RPM_BUILD_ROOT/%{_lib}/libaudit.a $RPM_BUILD_ROOT%{_libdir}
7ea7611
mv $RPM_BUILD_ROOT/%{_lib}/libauparse.a $RPM_BUILD_ROOT%{_libdir}
21c8b70
curdir=`pwd`
21c8b70
cd $RPM_BUILD_ROOT/%{_libdir}
ff137c5
LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.1.*.*\``
f9356bf
ln -s ../../%{_lib}/$LIBNAME libaudit.so
ff137c5
LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.0.*.*\``
7ea7611
ln -s ../../%{_lib}/$LIBNAME libauparse.so
21c8b70
cd $curdir
64cb266
# Remove these items so they don't get picked up.
64cb266
rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
7ea7611
rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
c899139
c899139
find $RPM_BUILD_ROOT -name '*.la' -delete
c899139
find $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages -name '*.a' -delete
21c8b70
a5088d3
# Move the pkgconfig file
a5088d3
mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
a5088d3
0b8b4aa
# On platforms with 32 & 64 bit libs, we need to coordinate the timestamp
0b8b4aa
touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
028898f
touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
0b8b4aa
c899139
%ifarch %{golang_arches}
fffe22a
%check
fffe22a
make check
0a9e32d
%endif
559824b
cvsdist 2c6ba58
%clean
cvsdist 2c6ba58
rm -rf $RPM_BUILD_ROOT
cvsdist 2c6ba58
7a408f5
%post libs -p /sbin/ldconfig
75f4803
c5201dc
%post
c377c36
# Copy default rules into place on new installation
57623a8
files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
57623a8
if [ "$files" -eq 0 ] ; then
57623a8
# FESCO asked for audit to be off by default. #1117953
ff7d766
	if [ -e /usr/share/doc/audit/rules/10-no-audit.rules ] ; then
ff7d766
	        cp /usr/share/doc/audit/rules/10-no-audit.rules /etc/audit/rules.d/audit.rules
ff7d766
	else
ff7d766
		touch /etc/audit/rules.d/audit.rules
ff7d766
	fi
c377c36
fi
963a8b6
%systemd_post auditd.service
c5201dc
c5201dc
%preun
963a8b6
%systemd_preun auditd.service
c5201dc
9893d2d
%postun libs -p /sbin/ldconfig
75f4803
c5201dc
%postun
963a8b6
if [ $1 -ge 1 ]; then
963a8b6
   /sbin/service auditd condrestart > /dev/null 2>&1 || :
c5201dc
fi
8b5d586
2d98cfa
%files libs
b9f018d
%defattr(-,root,root,-)
ff9bb33
%{!?_licensedir:%global license %%doc}
ff9bb33
%license lgpl-2.1.txt
a5088d3
/%{_lib}/libaudit.so.1*
a5088d3
/%{_lib}/libauparse.*
ca97ebc
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
05d70ed
%{_mandir}/man5/libaudit.conf.5.gz
75f4803
75f4803
%files libs-devel
b9f018d
%defattr(-,root,root,-)
862b73d
%doc contrib/skeleton.c contrib/plugin
21c8b70
%{_libdir}/libaudit.so
7ea7611
%{_libdir}/libauparse.so
c899139
%ifarch %{golang_arches}
a5088d3
%dir %{_prefix}/lib/golang/src/pkg/redhat.com/audit
a5088d3
%{_prefix}/lib/golang/src/pkg/redhat.com/audit/audit.go
a0ab087
%endif
c5201dc
%{_includedir}/libaudit.h
7ea7611
%{_includedir}/auparse.h
7ea7611
%{_includedir}/auparse-defs.h
7732381
%{_datadir}/aclocal/audit.m4
a5088d3
%{_libdir}/pkgconfig/audit.pc
0798e44
%{_libdir}/pkgconfig/auparse.pc
72b1292
%{_mandir}/man3/*
c5201dc
36cd75f
%files libs-static
36cd75f
%defattr(-,root,root,-)
ff9bb33
%{!?_licensedir:%global license %%doc}
ff9bb33
%license lgpl-2.1.txt
36cd75f
%{_libdir}/libaudit.a
36cd75f
%{_libdir}/libauparse.a
36cd75f
9fb9401
%files libs-python
b9f018d
%defattr(-,root,root,-)
943e1d4
%attr(755,root,root) %{python_sitearch}/_audit.so
943e1d4
%attr(755,root,root) %{python_sitearch}/auparse.so
943e1d4
%{python_sitearch}/audit.py*
dbe1b83
0798e44
%files libs-python3
0798e44
%defattr(-,root,root,-)
0798e44
%attr(755,root,root) %{python3_sitearch}/*
0798e44
cvsdist 2c6ba58
%files
cvsdist 2c6ba58
%defattr(-,root,root,-)
57623a8
%doc README ChangeLog rules init.d/auditd.cron
ff9bb33
%{!?_licensedir:%global license %%doc}
ff9bb33
%license COPYING
597027a
%attr(644,root,root) %{_mandir}/man8/audispd.8.gz
597027a
%attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
597027a
%attr(644,root,root) %{_mandir}/man8/auditd.8.gz
597027a
%attr(644,root,root) %{_mandir}/man8/aureport.8.gz
597027a
%attr(644,root,root) %{_mandir}/man8/ausearch.8.gz
597027a
%attr(644,root,root) %{_mandir}/man8/autrace.8.gz
26bdc06
%attr(644,root,root) %{_mandir}/man8/aulast.8.gz
61abc7b
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
0eebef6
%attr(644,root,root) %{_mandir}/man8/auvirt.8.gz
463eea1
%attr(644,root,root) %{_mandir}/man8/augenrules.8.gz
f2add7b
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
52a4831
%attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz
597027a
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
597027a
%attr(644,root,root) %{_mandir}/man5/audispd.conf.5.gz
8b5ee23
%attr(644,root,root) %{_mandir}/man5/ausearch-expression.5.gz
f1901c9
%attr(755,root,root) /sbin/auditctl
f1901c9
%attr(755,root,root) /sbin/auditd
1dbd164
%attr(755,root,root) /sbin/ausearch
1dbd164
%attr(755,root,root) /sbin/aureport
7a408f5
%attr(750,root,root) /sbin/autrace
551486a
%attr(750,root,root) /sbin/audispd
463eea1
%attr(750,root,root) /sbin/augenrules
52a4831
%attr(755,root,root) %{_bindir}/aulast
52a4831
%attr(755,root,root) %{_bindir}/aulastlog
f2add7b
%attr(755,root,root) %{_bindir}/ausyscall
0eebef6
%attr(755,root,root) %{_bindir}/auvirt
57623a8
%attr(644,root,root) %{_unitdir}/auditd.service
463eea1
%attr(750,root,root) %dir %{_libexecdir}/initscripts/legacy-actions/auditd
463eea1
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/resume
463eea1
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/rotate
ab42282
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/stop
17ff0f9
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/restart
17ff0f9
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/condrestart
f205d23
%attr(750,root,root) %dir %{_var}/log/audit
835c196
%attr(750,root,root) %dir /etc/audit
463eea1
%attr(750,root,root) %dir /etc/audit/rules.d
d3e971a
%attr(750,root,root) %dir /etc/audisp
d3e971a
%attr(750,root,root) %dir /etc/audisp/plugins.d
ca188de
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
57623a8
%ghost %config(noreplace) %attr(640,root,root) /etc/audit/rules.d/audit.rules
223f9ff
%ghost %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules
7c6e7fc
%config(noreplace) %attr(640,root,root) /etc/audisp/audispd.conf
9893d2d
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/af_unix.conf
46e327b
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/syslog.conf
597027a
597027a
%files -n audispd-plugins
597027a
%defattr(-,root,root,-)
8efb1f0
%config(noreplace) %attr(640,root,root) /etc/audisp/audisp-remote.conf
8efb1f0
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/au-remote.conf
8efb1f0
%attr(750,root,root) /sbin/audisp-remote
f205d23
%attr(700,root,root) %dir %{_var}/spool/audit
8efb1f0
%attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
8efb1f0
%attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
cvsdist 2c6ba58
d9ee9ff
%files -n audispd-plugins-zos
d9ee9ff
%defattr(-,root,root,-)
d9ee9ff
%attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
d9ee9ff
%attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz
d9ee9ff
%config(noreplace) %attr(640,root,root) /etc/audisp/plugins.d/audispd-zos-remote.conf
d9ee9ff
%config(noreplace) %attr(640,root,root) /etc/audisp/zos-remote.conf
d9ee9ff
%attr(750,root,root) /sbin/audispd-zos-remote
d9ee9ff
cvsdist 2c6ba58
%changelog
d9ee9ff
* Thu Apr 28 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-2
d9ee9ff
- Refactor plugins to split out zos-remote to lower dependencies
d9ee9ff
3d59325
* Wed Apr 13 2016 Steve Grubb <sgrubb@redhat.com> 2.5.1-1
3d59325
- New upstream release
3d59325
ead3cf3
* Fri Mar 18 2016 Steve Grubb <sgrubb@redhat.com> 2.5-4
ff7d766
- Fixes #1313152 - post script fails on dnf --setopt=tsflags=nodocs install
ff7d766
80968c0
* Mon Feb 22 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.5-3
80968c0
- https://fedoraproject.org/wiki/Changes/golang1.6
80968c0
8eef73e
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-2
8eef73e
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
8eef73e
ead3cf3
* Mon Jan 11 2016 Steve Grubb <sgrubb@redhat.com> 2.5-1
57623a8
- New upstream release
57623a8
- Fixes #1241565 - still logs way too much
57623a8
- Fixes #1238051 - audit.rules should be generated from by augenrules
57623a8
7732381
* Fri Dec 18 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
7732381
- New upstream bugfix release
7732381
Robert Kuska 8f61021
* Wed Nov 04 2015 Robert Kuska <rkuska@redhat.com> - 2.4.4-3
Robert Kuska 8f61021
- Rebuilt for Python3.5 rebuild
Robert Kuska 8f61021
c899139
* Wed Sep 16 2015 Peter Robinson <pbrobinson@fedoraproject.org> 2.4.4-2
c899139
- Fix FTBFS with hardened flags by using the distro CFLAGS
c899139
- Tighten deps with the _isa macro
c899139
- Use goarches macro to define supported GO architectures
c899139
- Minor cleanups
c899139
dadb96b
* Thu Aug 13 2015 Steve Grubb <sgrubb@redhat.com> 2.4.4-1
dadb96b
- New upstream bugfix release
dadb96b
- Fixes CVE-2015-5186 Audit: log terminal emulator escape sequences handling
dadb96b
0798e44
* Thu Jul 16 2015 Steve Grubb <sgrubb@redhat.com> 2.4.3-1
0798e44
- New upstream bugfix release
0798e44
- Adds python3 support
0798e44
908daf1
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.2-2
908daf1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
908daf1
9b47352
* Tue Apr 28 2015 Steve Grubb <sgrubb@redhat.com> 2.4.2-1
9b47352
- New upstream bugfix release
9b47352
e562add
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.4.1-2
e562add
- Rebuilt for Fedora 23 Change
e562add
  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
e562add
0e13f64
* Tue Oct 28 2014 Steve Grubb <sgrubb@redhat.com> 2.4.1-1
0e13f64
- New upstream feature and bugfix release
0e13f64
e76e540
* Mon Oct 06 2014 Karsten Hopp <karsten@redhat.com> 2.4-2
e76e540
- bump release and rebuild for upgradepath
e76e540
2760840
* Sun Aug 24 2014 Steve Grubb <sgrubb@redhat.com> 2.4-1
2760840
- New upstream feature and bugfix release
2760840
c28ae1b
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.8-0.3.svn20140803
c28ae1b
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
c28ae1b
a0ab087
* Mon Aug  4 2014 Peter Robinson <pbrobinson@fedoraproject.org> 2.3.8-0.2.svn20140803
a0ab087
- aarch64/PPC/s390 don't have golang
a0ab087
e957ecf
* Sat Aug 02 2014 Steve Grubb <sgrubb@redhat.com> 2.3.8-0.1.svn20140803
a5088d3
- New upstream svn snapshot
a5088d3
fd34aca
* Tue Jul 22 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-4
97cac88
- Bug 1117953 - Per fesco#1311, please disable syscall auditing by default
97cac88
ff9bb33
* Fri Jul 11 2014 Tom Callaway <spot@fedoraproject.org> - 2.3.7-3
ff9bb33
- mark license files properly
ff9bb33
a2d02bf
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.7-2
a2d02bf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
a2d02bf
829f6c1
* Tue Jun 03 2014 Steve Grubb <sgrubb@redhat.com> 2.3.7-1
829f6c1
- New upstream bugfix release
829f6c1
b20e8a1
* Fri Apr 11 2014 Steve Grubb <sgrubb@redhat.com> 2.3.6-1
b20e8a1
- New upstream bugfix/enhancement release
b20e8a1
bdb6570
* Mon Mar 17 2014 Steve Grubb <sgrubb@redhat.com> 2.3.5-1
bdb6570
- New upstream bugfix/enhancement release
bdb6570
bd93463
* Thu Feb 27 2014 Steve Grubb <sgrubb@redhat.com> 2.3.4-1
bd93463
- New upstream bugfix/enhancement release
bd93463
3a011d8
* Thu Jan 16 2014 Steve Grubb <sgrubb@redhat.com> 2.3.3-1
3a011d8
- New upstream bugfix/enhancement release
3a011d8
87e424c
* Mon Jul 29 2013 Steve Grubb <sgrubb@redhat.com> 2.3.2-1
87e424c
- New upstream bugfix/enhancement release
87e424c
2daa5c8
* Fri Jun 21 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-3
2daa5c8
- Drop prelude support
2daa5c8
17ff0f9
* Fri May 31 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-2
17ff0f9
- Fix unknown lvalue in auditd.service (#969345)
17ff0f9
b672a0e
* Thu May 30 2013 Steve Grubb <sgrubb@redhat.com> 2.3.1-1
ab42282
- New upstream bugfix/enhancement release
ab42282
c377c36
* Fri May 03 2013 Steve Grubb <sgrubb@redhat.com> 2.3-2
c377c36
- If no rules exist, copy shipped rules into place
c377c36