audit 2.5.1 released

audit 2.5.1 released

[Steve Grubb]

Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Updated and added audit rules
- Updated errno table for 4.4 kernel
- Change interpretation of exit to use errno define rather than a number
- Add distribute_network configuration option to auditd
- New aggregate only mode for auditd
- Cleanup tmp file left by augenrules --check
- Fix initial build from svn without golang support installed
- Update auparse interpretations for hook, action, macproto, chardev, and net
- Update interpretations for the 4.5 kernel
- Fix DST bug in ausearch/report time handling
- Add optional ExecStopPost to auditd.service to clear rules on service exit
- Update ausearch/report buffer size for locales with large time formats
- Add auparse_feed_age_events function to auparse library
- Use auparse_feed_age_events in zos & prelude plugins

This update includes more rules to compose into a policy. There is a new pci-
dss set of rules, for example.

Interpretations have been updated and improved.

Auditd gained a new configuration options, distribute_network, which determines 
if events read from the network should be distributed to audispd for plugin 
analysis. This would allow for whole datacenter realtime analysis. The other 
configuration option, There is also a new option in the auditd.service file, 
ExecStopPost, which clears audit rules on shutdown. This allows makes shutdown 
more quiet like the sysVinit systems.

There is a new function in auparse library to age pending events. This is 
necessary when an event has accumulated but no new events are arriving which 
would cause aging and processing of events that time out. The example plugin 
code has been updated to show its proper use.

Please let me know if you run across any problems with this release.

-Steve

RE: audit 2.5.1 released

[Warron S French]

Hello Steve,
	can you please explain the versioning you use when you make these announcements?

I am running CentOS-6.6 and that auditd release I have is at a much lower revision; auditd-2.3.7-5.el6.x86_64 for the package.

Is that JUST BECAUSE I am on CentOS, and they are that far behind or is it because they handle RPM versioning separately from RedHat?

Thank you sir, 

Warron French, MBA, SCSA


-----Original Message-----
From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Steve Grubb
Sent: Wednesday, April 13, 2016 4:02 PM
To: linux-audit@redhat.com
Subject: audit 2.5.1 released

Hello,

I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is:

- Updated and added audit rules
- Updated errno table for 4.4 kernel
- Change interpretation of exit to use errno define rather than a number
- Add distribute_network configuration option to auditd
- New aggregate only mode for auditd
- Cleanup tmp file left by augenrules --check
- Fix initial build from svn without golang support installed
- Update auparse interpretations for hook, action, macproto, chardev, and net
- Update interpretations for the 4.5 kernel
- Fix DST bug in ausearch/report time handling
- Add optional ExecStopPost to auditd.service to clear rules on service exit
- Update ausearch/report buffer size for locales with large time formats
- Add auparse_feed_age_events function to auparse library
- Use auparse_feed_age_events in zos & prelude plugins

This update includes more rules to compose into a policy. There is a new pci- dss set of rules, for example.

Interpretations have been updated and improved.

Auditd gained a new configuration options, distribute_network, which determines if events read from the network should be distributed to audispd for plugin analysis. This would allow for whole datacenter realtime analysis. The other configuration option, There is also a new option in the auditd.service file, ExecStopPost, which clears audit rules on shutdown. This allows makes shutdown more quiet like the sysVinit systems.

There is a new function in auparse library to age pending events. This is necessary when an event has accumulated but no new events are arriving which would cause aging and processing of events that time out. The example plugin code has been updated to show its proper use.

Please let me know if you run across any problems with this release.

-Steve

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: audit 2.5.1 released

[Steve Grubb]

On Wednesday, April 13, 2016 08:07:41 PM Warron S French wrote:
> 	can you please explain the versioning you use when you make these
> announcements?
> 
> I am running CentOS-6.6 and that auditd release I have is at a much lower
> revision; auditd-2.3.7-5.el6.x86_64 for the package.
> 
> Is that JUST BECAUSE I am on CentOS, and they are that far behind or is it
> because they handle RPM versioning separately from RedHat?

The version in Centos the same base source code version that is on RHEL. I 
don't know if Centos adds any additional patches or not. The enterprise 
operating systems get updated slowly in order to provide stability. RHEL 6.8 
is being updated to 2.4.5 which I believe Centos will pickup, too.

The 2.5 branch is unsuitable for an old OS like RHEL6. It supports features 
that are in newer kernels.

-Steve

 

> -----Original Message-----
> From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com]
> On Behalf Of Steve Grubb Sent: Wednesday, April 13, 2016 4:02 PM
> To: linux-audit@redhat.com
> Subject: audit 2.5.1 released
> 
> Hello,
> 
> I've just released a new version of the audit daemon. It can be downloaded
> from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
> soon. The ChangeLog is:
> 
> - Updated and added audit rules
> - Updated errno table for 4.4 kernel
> - Change interpretation of exit to use errno define rather than a number
> - Add distribute_network configuration option to auditd
> - New aggregate only mode for auditd
> - Cleanup tmp file left by augenrules --check
> - Fix initial build from svn without golang support installed
> - Update auparse interpretations for hook, action, macproto, chardev, and
> net - Update interpretations for the 4.5 kernel
> - Fix DST bug in ausearch/report time handling
> - Add optional ExecStopPost to auditd.service to clear rules on service exit
> - Update ausearch/report buffer size for locales with large time formats -
> Add auparse_feed_age_events function to auparse library
> - Use auparse_feed_age_events in zos & prelude plugins
> 
> This update includes more rules to compose into a policy. There is a new
> pci- dss set of rules, for example.
> 
> Interpretations have been updated and improved.
> 
> Auditd gained a new configuration options, distribute_network, which
> determines if events read from the network should be distributed to audispd
> for plugin analysis. This would allow for whole datacenter realtime
> analysis. The other configuration option, There is also a new option in the
> auditd.service file, ExecStopPost, which clears audit rules on shutdown.
> This allows makes shutdown more quiet like the sysVinit systems.
> 
> There is a new function in auparse library to age pending events. This is
> necessary when an event has accumulated but no new events are arriving
> which would cause aging and processing of events that time out. The example
> plugin code has been updated to show its proper use.
> 
> Please let me know if you run across any problems with this release.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

RE: audit 2.5.1 released

[Warron S French]

Ah, thank you for the clarification.



Warron French, MBA, SCSA
The Aerospace Corporation
CCS> TCI> System Administrator Specialist III
A101/Rm N3417
Mailstop:CH1-210
UNCLASS: 571.304.7534
CLASS:  894-7534


-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com] 
Sent: Wednesday, April 13, 2016 4:18 PM
To: linux-audit@redhat.com
Cc: Warron S French <warron.s.french@aero.org>
Subject: Re: audit 2.5.1 released

On Wednesday, April 13, 2016 08:07:41 PM Warron S French wrote:
> 	can you please explain the versioning you use when you make these 
> announcements?
> 
> I am running CentOS-6.6 and that auditd release I have is at a much 
> lower revision; auditd-2.3.7-5.el6.x86_64 for the package.
> 
> Is that JUST BECAUSE I am on CentOS, and they are that far behind or 
> is it because they handle RPM versioning separately from RedHat?

The version in Centos the same base source code version that is on RHEL. I don't know if Centos adds any additional patches or not. The enterprise operating systems get updated slowly in order to provide stability. RHEL 6.8 is being updated to 2.4.5 which I believe Centos will pickup, too.

The 2.5 branch is unsuitable for an old OS like RHEL6. It supports features that are in newer kernels.

-Steve

 

> -----Original Message-----
> From: linux-audit-bounces@redhat.com 
> [mailto:linux-audit-bounces@redhat.com]
> On Behalf Of Steve Grubb Sent: Wednesday, April 13, 2016 4:02 PM
> To: linux-audit@redhat.com
> Subject: audit 2.5.1 released
> 
> Hello,
> 
> I've just released a new version of the audit daemon. It can be 
> downloaded from http://people.redhat.com/sgrubb/audit. It will also be 
> in rawhide soon. The ChangeLog is:
> 
> - Updated and added audit rules
> - Updated errno table for 4.4 kernel
> - Change interpretation of exit to use errno define rather than a 
> number
> - Add distribute_network configuration option to auditd
> - New aggregate only mode for auditd
> - Cleanup tmp file left by augenrules --check
> - Fix initial build from svn without golang support installed
> - Update auparse interpretations for hook, action, macproto, chardev, 
> and net - Update interpretations for the 4.5 kernel
> - Fix DST bug in ausearch/report time handling
> - Add optional ExecStopPost to auditd.service to clear rules on 
> service exit
> - Update ausearch/report buffer size for locales with large time 
> formats - Add auparse_feed_age_events function to auparse library
> - Use auparse_feed_age_events in zos & prelude plugins
> 
> This update includes more rules to compose into a policy. There is a 
> new
> pci- dss set of rules, for example.
> 
> Interpretations have been updated and improved.
> 
> Auditd gained a new configuration options, distribute_network, which 
> determines if events read from the network should be distributed to 
> audispd for plugin analysis. This would allow for whole datacenter 
> realtime analysis. The other configuration option, There is also a new 
> option in the auditd.service file, ExecStopPost, which clears audit rules on shutdown.
> This allows makes shutdown more quiet like the sysVinit systems.
> 
> There is a new function in auparse library to age pending events. This 
> is necessary when an event has accumulated but no new events are 
> arriving which would cause aging and processing of events that time 
> out. The example plugin code has been updated to show its proper use.
> 
> Please let me know if you run across any problems with this release.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

RE: audit 2.5.1 released

[Manuel Scunthorpe]

[-- Attachment #1.1: Type: text/plain, Size: 1307 bytes --]

The build fails in Arch Linux openrc when configure has the option     --enable-systemd=no 
It seems to work and build the package but fails at the end, I think it is a makefile error. I wanted to build the package with static libs rather than use the precompiled Arch version.I tried the standard 2.4.4 version in ABS then modified it slightly to build the latest 2.5.1 version, they both gave the same result.For 2.5.1 I used this command as the checksums were different to 2.4.4 and the modified PKGBUILD which I attached to this message along with the log files, although they stop just before the sed error.
$ makepkg -L --skipinteg
The end of the build finishes like this:make[2]: Nothing to be done for 'install-exec-am'.
make[2]: Nothing to be done for 'install-data-am'.
make[2]: Leaving directory '/home/steve/build/a3udit/src/audit-2.5.1'
make[1]: Leaving directory '/home/steve/build/a3udit/src/audit-2.5.1'
sed: can't read usr/lib/systemd/system/auditd.service: No such file or directory
==> ERROR: A failure occurred in package().
    Aborting...

I did build the 2.4.4 version successfully earlier by setting --enable-systemd=yes but I don't know if that would break anything or simply create an unused .service file.There is a problem with this build config option though.

[-- Attachment #1.2: Type: text/html, Size: 2477 bytes --]

[-- Attachment #2: auditfiles.tar.xz --]
[-- Type: application/octet-stream, Size: 14076 bytes --]

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: audit 2.5.1 released

[Steve Grubb]

On Thursday, April 28, 2016 02:45:55 AM Manuel Scunthorpe wrote:
> The build fails in Arch Linux openrc when configure has the option    
> --enable-systemd=no It seems to work and build the package but fails at the
> end, I think it is a makefile error. I wanted to build the package with
> static libs rather than use the precompiled Arch version.I tried the
> standard 2.4.4 version in ABS then modified it slightly to build the latest
> 2.5.1 version, they both gave the same result.For 2.5.1 I used this command
> as the checksums were different to 2.4.4 and the modified PKGBUILD which I
> attached to this message along with the log files, although they stop just
> before the sed error. $ makepkg -L --skipinteg
> The end of the build finishes like this:make[2]: Nothing to be done for
> 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'.
> make[2]: Leaving directory '/home/steve/build/a3udit/src/audit-2.5.1'
> make[1]: Leaving directory '/home/steve/build/a3udit/src/audit-2.5.1'
> sed: can't read usr/lib/systemd/system/auditd.service: No such file or
> directory ==> ERROR: A failure occurred in package().
>     Aborting...

The PKGBUILD script can't make up its mind on systemd. In the configure it says 
no, but then it tries to sed a systemd file. :-)


make[1]: Leaving directory '/home/steve/build/a3udit/src/audit-2.5.1'
sed: can't read usr/lib/systemd/system/auditd.service: No such file or 
directory
^[[1m^[[31m==> ERROR:^[(B^[[m^[[1m A failure occurred in package().^[(B^[[m
^[[1m    Aborting...^[(B^[[m

If you don't want systemd, then remove the 
usr/lib/systemd/system/auditd.service file from the sed command as well as the 
chmod of that file. Instead, you probably need to do something with 
etc/rc.d/init.d/audit.service.

Also, if you do not need to send audit events to a zos server, then you can 
also add --disable-zos-remote which removes a dependency on openldap-devel 
which seems unaccounted for in your dependencies but is in your buildroot. 
That will also require deleting lines with zos-remote in the PKGBUILD.

-Steve

Re: audit 2.5.1 released

[Manuel Scunthorpe]

[-- Attachment #1.1: Type: text/plain, Size: 3471 bytes --]

Dear Steve,thanks for your helpful observations. I was able to modify the PKGBUILD and successfully build the package, and then build e4rat-lite which was my ultimate aim. Sadly it didn't seem to work in Arch Linux due to the kernel config options, e4rat-lite-collect didn't collect anything, complained about being unable to log anything due to a bad file descriptor and there was a message at boot saying Cannot open audit socket, which was similar to what auditctl said in the terminal. Of course it might work and I've got something else wrong, it doesn't look encouraging though without CONFIG_AUDIT enabled. But I was just looking at my Void Linux kernel options:CONFIG_AUDIT=y
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
CONFIG_AUDITSYSCALL=y
CONFIG_AUDIT_WATCH=y
CONFIG_AUDIT_TREE=y
This looks more promising so I will have to try it here instead sometime, although what I will have to build to fulfill the various builddeps I don't yet know. Would it be OK if I tried to make an 'audit' package for Void Linux if they want one? There isn't one in the repo at present, so if I get a working build then I might as well share it. It could take a while to get to that point though, and that's assuming I can get everything to work in Void and don't end up using some other readahead utility altogether or accidentally corrupting my filesystem. But I can be happy I'm building audit correctly now.I will try and pass on your comments about zos servers and openldap-devel to the Arch packagers as I can only take credit for the confusion over the systemd support option in my earlier PKGBUILD.

Here's my successful modified PKGBUILD with the correct checksum for 2.5.1, which downloads and builds cleanly:# Edit /etc/makepkg.conf: staticlibs not !staticlibs or they are deleted by makepkg.

# $Id: PKGBUILD 146469 2015-11-10 05:04:55Z thestinger $
# Maintainer: Daniel Micay <danielmicay@gmail.com>
# Contributor: <kang@insecure.ws>
# Contributor: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
# Contributor: Connor Behan <connor.behan@gmail.com>
# Contributor: henning mueller <henning@orgizm.net>

pkgname=audit
pkgver=2.5.1
pkgrel=1
pkgdesc='Userspace components of the audit framework'
url='https://people.redhat.com/sgrubb/audit'
arch=(i686 x86_64)
depends=(krb5 libcap-ng)
makedepends=(libldap swig linux-headers python)
license=(GPL)
options=(emptydirs)
groups=('modified')
backup=(
  etc/libaudit.conf
  etc/audit/auditd.conf
  etc/audisp/audispd.conf
  etc/audisp/audisp-remote.conf
  etc/audisp/plugins.d/af_unix.conf
  etc/audisp/plugins.d/au-remote.conf
  etc/audisp/plugins.d/syslog.conf
)
source=("$url/$pkgname-$pkgver.tar.gz")
sha256sums=('3c6ec72d8c16d1e85cc2b9c260cc6440319eb294cb54ca41a7bbe9283cc9f421')
install=$pkgname.install

build() {
  cd $pkgname-$pkgver
  export PYTHON=/usr/bin/python3
  ./configure \
    --prefix=/usr \
    --sbindir=/usr/bin \
    --sysconfdir=/etc \
    --libexecdir=/usr/lib/audit \
    --with-python=yes \
    --enable-gssapi-krb5=yes \
    --enable-systemd=no \
    --with-libcap-ng=yes \
    --disable-zos-remote \
    --enable-static=yes
  make
}

package() {
  cd $pkgname-$pkgver
  make DESTDIR="$pkgdir" install

  cd "$pkgdir"
  install -d var/log/audit
  rm -rf etc/rc.d etc/sysconfig usr/lib/audit

  sed -ri 's|/sbin|/usr/bin|' \
    etc/audit/*.conf \
    etc/audisp/plugins.d/*.conf


[-- Attachment #1.2: Type: text/html, Size: 7249 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: audit 2.5.1 released

[Steve Grubb]

On Saturday, April 30, 2016 09:29:18 PM Manuel Scunthorpe wrote:
> Dear Steve,thanks for your helpful observations. I was able to modify the
> PKGBUILD and successfully build the package, and then build e4rat-lite
> which was my ultimate aim. Sadly it didn't seem to work in Arch Linux due
> to the kernel config options, e4rat-lite-collect didn't collect anything,
> complained about being unable to log anything due to a bad file descriptor
> and there was a message at boot saying Cannot open audit socket, which was
> similar to what auditctl said in the terminal. Of course it might work and
> I've got something else wrong, it doesn't look encouraging though without
> CONFIG_AUDIT enabled. But I was just looking at my Void Linux kernel
> options:CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y
> CONFIG_AUDITSYSCALL=y
> CONFIG_AUDIT_WATCH=y
> CONFIG_AUDIT_TREE=y
> This looks more promising so I will have to try it here instead sometime,
> although what I will have to build to fulfill the various builddeps I don't
> yet know. Would it be OK if I tried to make an 'audit' package for Void
> Linux if they want one?

Sure.

> There isn't one in the repo at present, so if I get
> a working build then I might as well share it. It could take a while to get
> to that point though, and that's assuming I can get everything to work in
> Void and don't end up using some other readahead utility altogether or
> accidentally corrupting my filesystem. But I can be happy I'm building
> audit correctly now.I will try and pass on your comments about zos servers
> and openldap-devel to the Arch packagers as I can only take credit for the
> confusion over the systemd support option in my earlier PKGBUILD.
> 
> Here's my successful modified PKGBUILD with the correct checksum for 2.5.1,
> which downloads and builds cleanly:# Edit /etc/makepkg.conf: staticlibs not
> !staticlibs or they are deleted by makepkg.
> 
> # $Id: PKGBUILD 146469 2015-11-10 05:04:55Z thestinger $
> # Maintainer: Daniel Micay <danielmicay@gmail.com>
> # Contributor: <kang@insecure.ws>
> # Contributor: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
> # Contributor: Connor Behan <connor.behan@gmail.com>
> # Contributor: henning mueller <henning@orgizm.net>
> 
> pkgname=audit
> pkgver=2.5.1
> pkgrel=1
> pkgdesc='Userspace components of the audit framework'
> url='https://people.redhat.com/sgrubb/audit'
> arch=(i686 x86_64)
> depends=(krb5 libcap-ng)
> makedepends=(libldap swig linux-headers python)

You can drop libldap since you disable zos support below. Its harmless as is 
but not necessary for the configure options below.

-Steve

> license=(GPL)
> options=(emptydirs)
> groups=('modified')
> backup=(
>   etc/libaudit.conf
>   etc/audit/auditd.conf
>   etc/audisp/audispd.conf
>   etc/audisp/audisp-remote.conf
>   etc/audisp/plugins.d/af_unix.conf
>   etc/audisp/plugins.d/au-remote.conf
>   etc/audisp/plugins.d/syslog.conf
> )
> source=("$url/$pkgname-$pkgver.tar.gz")
> sha256sums=('3c6ec72d8c16d1e85cc2b9c260cc6440319eb294cb54ca41a7bbe9283cc9f42
> 1') install=$pkgname.install
> 
> build() {
>   cd $pkgname-$pkgver
>   export PYTHON=/usr/bin/python3
>   ./configure \
>     --prefix=/usr \
>     --sbindir=/usr/bin \
>     --sysconfdir=/etc \
>     --libexecdir=/usr/lib/audit \
>     --with-python=yes \
>     --enable-gssapi-krb5=yes \
>     --enable-systemd=no \
>     --with-libcap-ng=yes \
>     --disable-zos-remote \
>     --enable-static=yes
>   make
> }
> 
> package() {
>   cd $pkgname-$pkgver
>   make DESTDIR="$pkgdir" install
> 
>   cd "$pkgdir"
>   install -d var/log/audit
>   rm -rf etc/rc.d etc/sysconfig usr/lib/audit
> 
>   sed -ri 's|/sbin|/usr/bin|' \
>     etc/audit/*.conf \
>     etc/audisp/plugins.d/*.conf