automatic version update by autodist [release 3.0.1-1mamba;Sun Feb 14 2021]

audit-2.8.5-usrsbin.patch

@@ -1,59 +0,0 @@
-diff -ru audit-2.8.5.orig/init.d/auditd.conf audit-2.8.5/init.d/auditd.conf
---- audit-2.8.5.orig/init.d/auditd.conf	2019-03-01 21:19:13.000000000 +0100
-+++ audit-2.8.5/init.d/auditd.conf	2019-05-27 10:02:17.350769165 +0200
-@@ -13,7 +13,7 @@
- num_logs = 5
- priority_boost = 4
- disp_qos = lossy
--dispatcher = /sbin/audispd
-+dispatcher = /usr/sbin/audispd
- name_format = NONE
- ##name = mydomain
- max_log_file_action = ROTATE
-diff -ru audit-2.8.5.orig/init.d/auditd.cron audit-2.8.5/init.d/auditd.cron
---- audit-2.8.5.orig/init.d/auditd.cron	2019-02-04 15:26:52.000000000 +0100
-+++ audit-2.8.5/init.d/auditd.cron	2019-05-27 10:02:17.350769165 +0200
-@@ -5,7 +5,7 @@
- # based on a cron job.
- ##########
- 
--/sbin/service auditd rotate
-+/usr/sbin/service auditd rotate
- EXITVALUE=$?
- if [ $EXITVALUE != 0 ]; then
-     /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]"
-diff -ru audit-2.8.5.orig/init.d/auditd.service audit-2.8.5/init.d/auditd.service
---- audit-2.8.5.orig/init.d/auditd.service	2019-03-01 21:19:13.000000000 +0100
-+++ audit-2.8.5/init.d/auditd.service	2019-05-27 10:02:56.066935836 +0200
-@@ -18,15 +18,15 @@
- [Service]
- Type=forking
- PIDFile=/run/auditd.pid
--ExecStart=/sbin/auditd
-+ExecStart=/usr/sbin/auditd
- ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
- ## and comment/delete the next line and uncomment the auditctl line.
- ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
--ExecStartPost=-/sbin/augenrules --load
--#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
-+ExecStartPost=-/usr/sbin/augenrules --load
-+#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules
- # By default we don't clear the rules on exit. To enable this, uncomment
- # the next line after copying the file to /etc/systemd/system/auditd.service
--#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
-+#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules
- 
- [Install]
- WantedBy=multi-user.target
-diff -ru audit-2.8.5.orig/init.d/augenrules audit-2.8.5/init.d/augenrules
---- audit-2.8.5.orig/init.d/augenrules	2019-02-04 15:26:52.000000000 +0100
-+++ audit-2.8.5/init.d/augenrules	2019-05-27 10:02:17.354769182 +0200
-@@ -39,7 +39,7 @@
- 
- try_load() {
- 	if [ $LoadRules -eq 1 ] ; then
--		/sbin/auditctl -R ${DestinationFile}
-+		/usr/sbin/auditctl -R ${DestinationFile}
- 		RETVAL=$?
- 	fi
- }

audit-3.0-usrsbin.patch

@@ -0,0 +1,83 @@
+diff -ru audit-3.0.orig/init.d/auditd.cron audit-3.0/init.d/auditd.cron
+--- audit-3.0.orig/init.d/auditd.cron	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/init.d/auditd.cron	2021-02-13 20:44:43.484919856 +0100
+@@ -5,7 +5,7 @@
+ # based on a cron job.
+ ##########
+ 
+-/sbin/service auditd rotate
++/usr/sbin/service auditd rotate
+ EXITVALUE=$?
+ if [ $EXITVALUE != 0 ]; then
+     /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]"
+diff -ru audit-3.0.orig/init.d/auditd.service audit-3.0/init.d/auditd.service
+--- audit-3.0.orig/init.d/auditd.service	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/init.d/auditd.service	2021-02-13 20:44:43.484919856 +0100
+@@ -18,15 +18,15 @@
+ [Service]
+ Type=forking
+ PIDFile=/run/auditd.pid
+-ExecStart=/sbin/auditd
++ExecStart=/usr/sbin/auditd
+ ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
+ ## and comment/delete the next line and uncomment the auditctl line.
+ ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
+-ExecStartPost=-/sbin/augenrules --load
+-#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
++ExecStartPost=-/usr/sbin/augenrules --load
++#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules
+ # By default we don't clear the rules on exit. To enable this, uncomment
+ # the next line after copying the file to /etc/systemd/system/auditd.service
+-#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
++#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules
+ 
+ ### Security Settings ###
+ MemoryDenyWriteExecute=true
+diff -ru audit-3.0.orig/init.d/augenrules audit-3.0/init.d/augenrules
+--- audit-3.0.orig/init.d/augenrules	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/init.d/augenrules	2021-02-13 20:44:43.485919874 +0100
+@@ -39,7 +39,7 @@
+ 
+ try_load() {
+ 	if [ $LoadRules -eq 1 ] ; then
+-		/sbin/auditctl -R ${DestinationFile}
++		/usr/sbin/auditctl -R ${DestinationFile}
+ 		RETVAL=$?
+ 	fi
+ }
+diff -ru audit-3.0.orig/audisp/plugins/remote/au-remote.conf audit-3.0/audisp/plugins/remote/au-remote.conf
+--- audit-3.0.orig/audisp/plugins/remote/au-remote.conf	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/audisp/plugins/remote/au-remote.conf	2021-02-13 21:27:18.038655845 +0100
+@@ -5,7 +5,7 @@
+ 
+ active = no
+ direction = out
+-path = /sbin/audisp-remote
++path = /usr/sbin/audisp-remote
+ type = always
+ #args =
+ format = string
+diff -ru audit-3.0.orig/audisp/plugins/syslog/syslog.conf audit-3.0/audisp/plugins/syslog/syslog.conf
+--- audit-3.0.orig/audisp/plugins/syslog/syslog.conf	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/audisp/plugins/syslog/syslog.conf	2021-02-13 21:27:06.886482221 +0100
+@@ -8,7 +8,7 @@
+ 
+ active = no
+ direction = out
+-path = /sbin/audisp-syslog
++path = /usr/sbin/audisp-syslog
+ type = always 
+ args = LOG_INFO
+ format = string
+diff -ru audit-3.0.orig/audisp/plugins/zos-remote/audispd-zos-remote.conf audit-3.0/audisp/plugins/zos-remote/audispd-zos-remote.conf
+--- audit-3.0.orig/audisp/plugins/zos-remote/audispd-zos-remote.conf	2020-12-16 21:44:34.000000000 +0100
++++ audit-3.0/audisp/plugins/zos-remote/audispd-zos-remote.conf	2021-02-13 21:26:36.495010422 +0100
+@@ -8,7 +8,7 @@
+ 
+ active = no
+ direction = out
+-path = /sbin/audispd-zos-remote
++path = /usr/sbin/audispd-zos-remote
+ type = always 
+ args = /etc/audisp/zos-remote.conf
+ format = string

audit.spec

@@ -1,14 +1,14 @@
 Name:          audit
-Version:       2.8.5
+Version:       3.0.1
 Release:       1mamba
 Summary:       User space tools for kernel auditing
 Group:         System/Tools
 Vendor:        openmamba
 Distribution:  openmamba
 Packager:      Silvan Calarco <silvan.calarco@mambasoft.it>
-URL:           http://people.redhat.com/sgrubb/audit
+URL:           https://people.redhat.com/sgrubb/audit
 Source:        http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
-Patch0:        audit-2.8.5-usrsbin.patch
+Patch0:        audit-3.0-usrsbin.patch
 Patch1:        audit-2.8.4-rundir.patch
 License:       GPL, LGPL
 ## AUTOBUILDREQ-BEGIN
@@ -43,7 +43,10 @@ BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
 BuildRequires: swig
+BuildRequires: libprelude-devel >= 5.2.0
 %systemd_requires
+Provides:      audit-plugins
+Obsoletes:     audit-plugins < 3.0
 BuildRoot:     %{_tmppath}/%{name}-%{version}-root
 
 %description
@@ -90,15 +93,7 @@ Requires:      lib%{name} = %{?epoch:%epoch:}%{version}-%{release}
 The python-audit package containts Python 3 bindings to %{name}.
 The libaudit-devel package contains the header files needed for developing applications that need to use the audit framework libraries.
 
-%package plugins
-Group:        System/Tools
-Summary:      Plugins for the audit event dispatcher
-Requires:     %{name} = %{?epoch:%epoch:}%{version}-%{release}
-Requires:     libaudit = %{?epoch:%epoch:}%{version}-%{release}
-#Requires:     openldap
-
-%description plugins
-The audispd-plugins package provides plugins for the real-time interface to the audit system, audispd. These plugins can do things like relay events to remote machines or analyze events for suspicious behavior.
+%debug_package
 
 %prep
 %setup -q
@@ -113,8 +108,15 @@ The audispd-plugins package provides plugins for the real-time interface to the
   --enable-gssapi-krb5=yes \
   --with-libcap-ng=yes \
   --with-python=yes \
-  --enable-systemd=yes
-  
+  --enable-systemd=yes \
+  CFLAGS="%{optflags} -fcommon" \
+%ifarch arm
+  --with-arm \
+%endif   
+%ifarch aarch64
+  --with-aarch64 \
+%endif   
+
 %make
 
 %install
@@ -140,6 +142,10 @@ make check
 [ "%{buildroot}" != / ] && rm -rf "%{buildroot}"
 
 %post
+if [ $1 -gt 1 ]; then
+   # fix /sbin -> /usr/sbin paths on upgrade
+   sed -i "s|path = /sbin/|path = /usr/sbin/|" %{_sysconfdir}/audit/plugins.d/*.conf
+fi
 %systemd_post auditd
 if [ $1 -eq 1 -o -e /etc/rc5.d/S11auditd ]; then
    systemctl -q daemon-reload
@@ -165,21 +171,26 @@ find /etc/rc[0-6].d/ -type l -xtype l -exec rm -f {} \;
 
 %files
 %defattr(-,root,root)
-%attr(750,root,root) %dir %{_sysconfdir}/audisp
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audispd.conf
-%attr(750,root,root) %dir %{_sysconfdir}/audisp/plugins.d
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/af_unix.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/syslog.conf
 %attr(750,root,root) %dir %{_sysconfdir}/audit
+%config(noreplace) %{_sysconfdir}/audit/audisp-remote.conf
+%{_sysconfdir}/audit/plugins.d/af_unix.conf
+%{_sysconfdir}/audit/plugins.d/au-remote.conf
+%{_sysconfdir}/audit/plugins.d/audispd-zos-remote.conf
+%{_sysconfdir}/audit/plugins.d/syslog.conf
+%{_sysconfdir}/audit/zos-remote.conf
 %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/audit-stop.rules
 %dir %{_sysconfdir}/audit/rules.d
-#%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/rules.d/audit.rules
 %config(noreplace) %attr(640,root,root) %{_sysconfdir}/audit/auditd.conf
+%dir %{_datadir}/audit/sample-rules
+%{_datadir}/audit/sample-rules/*.rules
+%{_datadir}/audit/sample-rules/README-rules
 %attr(644,root,root) %{_unitdir}/auditd.service
 %dir %{_libexecdir}/initscripts/legacy-actions/auditd
 %{_libexecdir}/initscripts/legacy-actions/auditd/*
 %attr(750,root,root) %dir %{_localstatedir}/log/audit
-%attr(750,root,root) %{_sbindir}/audispd
+%attr(750,root,root) %{_sbindir}/audispd-zos-remote
+%attr(750,root,root) %{_sbindir}/audisp-remote
+%attr(750,root,root) %{_sbindir}/audisp-syslog
 %attr(750,root,root) %{_sbindir}/auditctl
 %attr(750,root,root) %{_sbindir}/auditd
 %attr(750,root,root) %{_sbindir}/augenrules
@@ -190,12 +201,18 @@ find /etc/rc[0-6].d/ -type l -xtype l -exec rm -f {} \;
 %attr(755,root,root) %{_bindir}/aulastlog
 %attr(755,root,root) %{_bindir}/ausyscall
 %attr(750,root,root) %{_bindir}/auvirt
+%ifnarch arm aarch64
 %dir %{_prefix}/lib/golang/src/pkg/redhat.com/audit
-%{_mandir}/man5/audispd.conf.5*
+%endif
 %{_mandir}/man5/auditd.conf.5*
 %{_mandir}/man5/ausearch-expression.5*
+%{_mandir}/man5/auditd-plugins.5*
+%{_mandir}/man5/zos-remote.conf.5*
 %{_mandir}/man7/*.7*
-%{_mandir}/man8/audispd.8*
+%{_mandir}/man5/audisp-remote.conf.5*
+%{_mandir}/man8/audispd-zos-remote.8*
+%{_mandir}/man8/audisp-remote.8*
+%{_mandir}/man8/audisp-syslog.8*
 %{_mandir}/man8/auditctl.8*
 %{_mandir}/man8/auditd.8*
 %{_mandir}/man8/augenrules.8*
@@ -213,7 +230,7 @@ find /etc/rc[0-6].d/ -type l -xtype l -exec rm -f {} \;
 %{_libdir}/libaudit.so.*
 %{_libdir}/libauparse.so.*
 %{_mandir}/man5/libaudit.conf.5*
-#%doc AUTHORS COPYING
+%doc AUTHORS COPYING
 
 %files -n lib%{name}-devel
 %defattr(-,root,root)
@@ -226,7 +243,9 @@ find /etc/rc[0-6].d/ -type l -xtype l -exec rm -f {} \;
 %{_libdir}/libauparse.la
 %{_libdir}/pkgconfig/auparse.pc
 %{_libdir}/pkgconfig/audit.pc
+%ifnarch arm aarch64
 %{_prefix}/lib/golang/src/pkg/redhat.com/audit/audit.go
+%endif
 %{_datadir}/aclocal/audit.m4
 %{_mandir}/man3/*.3.gz
 #%doc contrib/skeleton.c contrib/plugin
@@ -247,29 +266,22 @@ find /etc/rc[0-6].d/ -type l -xtype l -exec rm -f {} \;
 %defattr(-,root,root)
 %{python3_sitearch}/_audit.*
 %{python3_sitearch}/audit.py
-%{python3_sitearch}/__pycache__/audit.cpython-33.pyc
-%{python3_sitearch}/__pycache__/audit.cpython-33.pyo
+%{python3_sitearch}/__pycache__/audit.cpython-*.pyc
 %{python3_sitearch}/auparse.*
 
-%files plugins
-%defattr(-,root,root)
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/audispd-zos-remote.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/zos-remote.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audisp-prelude.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/au-prelude.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/audisp-remote.conf
-%config(noreplace) %attr(640,root,root) %{_sysconfdir}/audisp/plugins.d/au-remote.conf
-%attr(750,root,root) %{_sbindir}/audispd-zos-remote
-%attr(750,root,root) %{_sbindir}/audisp-prelude
-%attr(750,root,root) %{_sbindir}/audisp-remote
-%{_mandir}/man5/zos-remote.conf.5*
-%{_mandir}/man8/audispd-zos-remote.8*
-%{_mandir}/man5/audisp-prelude.conf.5*
-%{_mandir}/man8/audisp-prelude.8*
-%{_mandir}/man5/audisp-remote.conf.5*
-%{_mandir}/man8/audisp-remote.8*
-
 %changelog
+* Sun Feb 14 2021 Automatic Build System <autodist@mambasoft.it> 3.0.1-1mamba
+- automatic version update by autodist
+
+* Sat Feb 13 2021 Silvan Calarco <silvan.calarco@mambasoft.it> 3.0-2mamba
+- reapply /usr/sbin patch
+
+* Tue Feb 09 2021 Automatic Build System <autodist@mambasoft.it> 3.0-1mamba
+- automatic version update by autodist
+
+* Sun Dec 20 2020 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.5-2mamba
+- rebuilt with debug package and libprelude 5.2.0
+
 * Mon May 27 2019 Automatic Build System <autodist@mambasoft.it> 2.8.5-1mamba
 - automatic version update by autodist