audit user space build problems

audit user space build problems

[Steve Grubb]

Hello,

Recently, distributions moved to building against gcc-12 for their latest OS 
composes. It's been found in at least 2 distributions that the user space 
package is failing to build. It's natural to think this is related to gcc-12 
since it's the obvious change.

However, the problem is a combination of 2 things:

1) SWIG is making buggy code
2) The kernel changed to using flexible array members

The issue specifically is with struct audit_rules_data. At the bottom, it was 
using buf[0];  But on 5.17, it uses buf[];  It turns out that gcc-12 is just 
a coincidence and anything using gcc-12 also has the newest kernel.

The options are:
1) Report this as a SWIG bug and wait
2) Rewrite the libaudit python bindings to not use SWIG
3) Ask for buf[0]; to be reinstated in the kernel.

Of these, I think option 2 is the only viable long term option. It will take 
some time to write new python bindings that preserve the SWIG api.

A short term fix might be for distros to copy the kernel header into the lib 
directory and patch it to restore buf[0];, then change libaudit.c to include 
"audit.h" instead of <linux/audit.h>. There may be other approaches.

Just wanted to let everyone know that new builds in distributions are running 
into a problem. And a real fix will take a while.

Best,
-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: audit user space build problems

[Steve Grubb]

Hello,

On Monday, February 21, 2022 4:50:22 PM EST Steve Grubb wrote:
> A short term fix might be for distros to copy the kernel header into the
> lib directory and patch it to restore buf[0];, then change libaudit.c to
> include "audit.h" instead of <linux/audit.h>. There may be other
> approaches.

You can find a patch that solves this here:
http://people.redhat.com/sgrubb/files/audit-3.0.8-flex-array-workaround.patch

Before applying this patch, the build script needs to copy
/usr/include/linux/audit.h to lib/ in the build directory.

Cheers,
-Steve




--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: audit user space build problems

[Steve Grubb]

Hello,

On Monday, February 21, 2022 4:50:22 PM EST Steve Grubb wrote:
> Recently, distributions moved to building against gcc-12 for their latest
> OS composes. It's been found in at least 2 distributions that the user
> space package is failing to build. It's natural to think this is related
> to gcc-12 since it's the obvious change.
> 
> However, the problem is a combination of 2 things:
> 
> 1) SWIG is making buggy code
> 2) The kernel changed to using flexible array members
> 
> The issue specifically is with struct audit_rules_data. At the bottom, it
> was using buf[0];  But on 5.17, it uses buf[];  It turns out that gcc-12
> is just a coincidence and anything using gcc-12 also has the newest
> kernel.
> 
> The options are:
> 1) Report this as a SWIG bug and wait
> 2) Rewrite the libaudit python bindings to not use SWIG
> 3) Ask for buf[0]; to be reinstated in the kernel.
> 
> Of these, I think option 2 is the only viable long term option. It will
> take some time to write new python bindings that preserve the SWIG api.
> 
> A short term fix might be for distros to copy the kernel header into the
> lib directory and patch it to restore buf[0];, then change libaudit.c to
> include "audit.h" instead of <linux/audit.h>. There may be other
> approaches.

An update on this topic...I have worked around this on rawhide. The temporary 
fix is kind of ugly and I also have no idea how long this temporary fix will be 
needed. Rewriting the python bindings will be a big task. Anyways...the first 
patch can be found here:

https://src.fedoraproject.org/rpms/audit/blob/rawhide/f/audit-3.0.8-flex-array-workaround.patch

Prior to applying the patch, I do this is the %prep part of the spec file:

cp /usr/include/linux/audit.h lib/

then the patch applies cleanly. The only problem is that if you leave it this 
way, then you wind up with other packages not building because they can't find 
audit.h. (See bz 2057735 for example) The fix for this is after the audit 
scripts do the install to the buildroot, you need to undo the change in 
libaudit.h. That patch can be found here:

https://src.fedoraproject.org/rpms/audit/blob/rawhide/f/audit-3.0.8-undo-flex-array.patch

After that, rpm grabs all the files and everything works as intended. As I 
said before, this is an ugly fix...but it works for now.

Hope this helps with packaging...

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit