October 2021 - openSUSE Commits - openSUSE Mailing Lists

commit audit for openSUSE:Factory
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package audit for openSUSE:Factory checked in at 2021-10-01 22:28:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/audit (Old) and /work/SRC/openSUSE:Factory/.audit.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "audit" Fri Oct 1 22:28:52 2021 rev:97 rq:920362 version:3.0.5 Changes: -------- --- /work/SRC/openSUSE:Factory/audit/audit-secondary.changes 2021-08-24 10:53:55.052396864 +0200 +++ /work/SRC/openSUSE:Factory/.audit.new.2443/audit-secondary.changes 2021-10-01 22:28:53.961356972 +0200 @@ -1,0 +2,29 @@ +Mon Sep 20 02:06:44 UTC 2021 - Enzo Matsumiya <ematsumiya(a)suse.com> + +- Fix hardened auditd.service (bsc#1181400) + * add fix-hardened-service.patch + Make /etc/audit read-write from the service. + Remove PrivateDevices=true to expose /dev/* to auditd.service. + +- Enable stop rules for audit.service (cf. bsc#1190227) + * add enable-stop-rules.patch + +------------------------------------------------------------------- +Thu Sep 16 03:46:19 UTC 2021 - Enzo Matsumiya <ematsumiya(a)suse.com> + +- Change default log_format from ENRICHED to RAW (bsc#1190500): + * add change-default-log_format.patch (SUSE-specific patch) + +- Update to version 3.0.5: + * In auditd, flush uid/gid caches when user/group added/deleted/modified + * Fixed various issues when dealing with corrupted logs + * In auditd, check if log_file is valid before closing handle + +- Include fixed from 3.0.4: + * Apply performance speedups to auparse library + * Optimize rule loading in auditctl + * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath + * Update syscall table to the 5.14 kernel + * Fixed various issues when dealing with corrupted logs + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/audit/audit.changes 2021-08-07 17:57:19.262797258 +0200 +++ /work/SRC/openSUSE:Factory/.audit.new.2443/audit.changes 2021-10-01 22:28:53.981357009 +0200 @@ -1,0 +2,15 @@ +Thu Sep 16 03:46:19 UTC 2021 - Enzo Matsumiya <ematsumiya(a)suse.com> + +- Update to version 3.0.5: + * In auditd, flush uid/gid caches when user/group added/deleted/modified + * Fixed various issues when dealing with corrupted logs + * In auditd, check if log_file is valid before closing handle + +- Include fixed from 3.0.4: + * Apply performance speedups to auparse library + * Optimize rule loading in auditctl + * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath + * Update syscall table to the 5.14 kernel + * Fixed various issues when dealing with corrupted logs + +------------------------------------------------------------------- Old: ---- audit-3.0.3.tar.gz New: ---- audit-3.0.5.tar.gz change-default-log_format.patch enable-stop-rules.patch fix-hardened-service.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ audit-secondary.spec ++++++ --- /var/tmp/diff_new_pack.k9FbTm/_old 2021-10-01 22:28:54.957358812 +0200 +++ /var/tmp/diff_new_pack.k9FbTm/_new 2021-10-01 22:28:54.961358820 +0200 @@ -22,7 +22,7 @@ # The seperation is required to minimize unnecessary build cycles. %define _name audit Name: audit-secondary -Version: 3.0.3 +Version: 3.0.5 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later @@ -37,6 +37,9 @@ Patch5: change-default-log_group.patch Patch6: libev-werror.patch Patch7: harden_auditd.service.patch +Patch8: change-default-log_format.patch +Patch9: fix-hardened-service.patch +Patch10: enable-stop-rules.patch BuildRequires: audit-devel = %{version} BuildRequires: autoconf >= 2.12 BuildRequires: gcc-c++ @@ -129,6 +132,9 @@ %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 +%patch9 -p1 +%patch10 -p1 %if %{without python2} && %{with python3} # Fix python env call in tests if we only have Python3. ++++++ audit.spec ++++++ --- /var/tmp/diff_new_pack.k9FbTm/_old 2021-10-01 22:28:54.981358856 +0200 +++ /var/tmp/diff_new_pack.k9FbTm/_new 2021-10-01 22:28:54.985358864 +0200 @@ -17,7 +17,7 @@ Name: audit -Version: 3.0.3 +Version: 3.0.5 Release: 0 Summary: Linux kernel audit subsystem utilities License: GPL-2.0-or-later ++++++ audit-3.0.3.tar.gz -> audit-3.0.5.tar.gz ++++++ ++++ 1628 lines of diff (skipped) ++++ retrying with extended exclude list diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/ChangeLog new/audit-3.0.5/ChangeLog --- old/audit-3.0.3/ChangeLog 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/ChangeLog 2021-08-11 22:24:20.000000000 +0200 @@ -1,3 +1,15 @@ +3.0.5 +- In auditd, flush uid/gid caches when user/group added/deleted/modified +- Fixed various issues when dealing with corrupted logs +- In auditd, check if log_file is valid before closing handle + +3.0.4 +- Apply performance speedups to auparse library +- Optimize rule loading in auditctl +- Fix an auparse memory leak caused by glibc-2.33 by replacing realpath +- Update syscall table to the 5.14 kernel +- Fixed various issues when dealing with corrupted logs + 3.0.3 - Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined - Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/TODO new/audit-3.0.5/TODO --- old/audit-3.0.3/TODO 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/TODO 2021-08-11 22:24:20.000000000 +0200 @@ -1,7 +1,5 @@ Future roadmap (subject to change): =================================== -3.0.4 - 3.1 * Basic HIDS based on reactive audit component * Add keywords for time: month-ago, this-hour, last-hour diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/audit.spec new/audit-3.0.5/audit.spec --- old/audit-3.0.3/audit.spec 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/audit.spec 2021-08-11 22:24:20.000000000 +0200 @@ -1,7 +1,7 @@ Summary: User space tools for kernel auditing Name: audit -Version: 3.0.3 +Version: 3.0.5 Release: 1%{dist} License: GPLv2+ Group: System Environment/Daemons @@ -256,6 +256,6 @@ %changelog -* Thu Jul 24 2021 Steve Grubb <sgrubb(a)redhat.com> 3.0.3-1 +* Wed Aug 11 2021 Steve Grubb <sgrubb(a)redhat.com> 3.0.5-1 - New upstream release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/auparse-idata.h new/audit-3.0.5/auparse/auparse-idata.h --- old/audit-3.0.3/auparse/auparse-idata.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/auparse-idata.h 2021-08-11 22:24:20.000000000 +0200 @@ -1,6 +1,6 @@ /* * idata.h - Header file for ausearch-lookup.c -* Copyright (c) 2013,2016-17 Red Hat Inc., Durham, North Carolina. +* Copyright (c) 2013,2016-17,2021 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or @@ -45,6 +45,7 @@ void _auparse_load_interpretations(const char *buf); void _auparse_free_interpretations(void); const char *_auparse_lookup_interpretation(const char *name); +void _auparse_flush_caches(void); #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/auparse.c new/audit-3.0.5/auparse/auparse.c --- old/audit-3.0.3/auparse/auparse.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/auparse.c 2021-08-11 22:24:20.000000000 +0200 @@ -1,5 +1,5 @@ /* auparse.c -- - * Copyright 2006-08,2012-19 Red Hat Inc., Durham, North Carolina. + * Copyright 2006-08,2012-19,21 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or @@ -457,6 +457,9 @@ return NULL; } au->au_ready = 0; + au->escape_mode = AUPARSE_ESC_TTY; + au->message_mode = MSG_QUIET; + au->debug_message = DBG_NO; au->in = NULL; au->source_list = NULL; @@ -553,9 +556,6 @@ au->expr = NULL; au->find_field = NULL; au->search_where = AUSEARCH_STOP_EVENT; - au->escape_mode = AUPARSE_ESC_TTY; - au->message_mode = MSG_QUIET; - au->debug_message = DBG_NO; au->tmp_translation = NULL; init_normalizer(&au->norm_data); @@ -1195,13 +1195,14 @@ ptr = audit_strsplit(tmp); if (ptr) { // Optionally grab the node - may or may not be included - if (*ptr == 'n') { + if (*ptr == 'n' && strnlen(ptr, 8) > 5) { e->host = strdup(ptr+5); (void)audit_strsplit(NULL);// Bump along to next one } // at this point we have type= ptr = audit_strsplit(NULL); - if (ptr) { + // strlen is for fuzzers that make invalid lines + if (ptr && strnlen(ptr, 28) > 24) { if (*(ptr+9) == '(') ptr+=9; else @@ -1610,7 +1611,13 @@ } aup_list_create(l); aup_list_set_event(l, &e); - aup_list_append(l, au->cur_buf, au->list_idx, au->line_number); + if (aup_list_append(l, au->cur_buf, au->list_idx, + au->line_number) < 0) { + au->cur_buf = NULL; + aup_list_clear(l); + free(l); + continue; + } // Eat standalone EOE - main event was already marked complete if (l->head->type == AUDIT_EOE) { au->cur_buf = NULL; @@ -1767,6 +1774,14 @@ if (rc <= 0) return rc; } + r = aup_list_get_cur(au->le); + if (r && r->item == 0 && interpretation_list_cnt()) { + // If we are on the first record and the list has previously + // been loaded, just pull cursor back and avoid loading the + // interpretation list. + aup_list_first_field(au->le); + return 1; + } aup_list_first(au->le); r = aup_list_get_cur(au->le); free_interpretation_list(); @@ -1805,6 +1820,15 @@ { rnode *r; + r = aup_list_get_cur(au->le); + if (r && r->item == num && interpretation_list_cnt()) { + // If we are on the first record and the list has previously + // been loaded, just pull cursor back and avoid loading the + // interpretation list. + aup_list_first_field(au->le); + return 1; + } + /* Check if a request is out of range */ free_interpretation_list(); // Its OK if au->le == NULL because get_cnt handles it @@ -1989,7 +2013,8 @@ rnode *r = aup_list_get_cur(au->le); while (r) { // For each record in the event... if (!moved) { - nvlist_next(&r->nv); + if (nvlist_next(&r->nv) == NULL) + return NULL; moved=1; } if (nvlist_find_name(&r->nv, au->find_field)) @@ -1997,6 +2022,7 @@ r = aup_list_next(au->le); if (r) { aup_list_first_field(au->le); + free_interpretation_list(); load_interpretation_list(r->interp); } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/ellist.c new/audit-3.0.5/auparse/ellist.c --- old/audit-3.0.3/auparse/ellist.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/ellist.c 2021-08-11 22:24:20.000000000 +0200 @@ -112,7 +112,7 @@ ptr++; } r->interp = ptr; - buf = strdup(r->record); + r->nv.record = buf = strdup(r->record); ptr = audit_strsplit_r(buf, &saved); if (ptr == NULL) { free(buf); @@ -147,10 +147,13 @@ // Remove beginning cruft of name if (*ptr == '(') ptr++; - n.name = strdup(ptr); - n.val = strdup(val); + n.name = ptr; + n.val = val; // Remove trailing punctuation len = strlen(n.val); + // Check for invalid val + if (!len) + continue; if (len && n.val[len-1] == ':') { n.val[len-1] = 0; len--; @@ -172,32 +175,59 @@ } // Make virtual keys or just store it if (strcmp(n.name, "key") == 0 && *n.val != '(') { - if (*n.val == '"') - nvlist_append(&r->nv, &n); - else { + if (*n.val == '"') { + // This is a normal single key. + n.name = strdup("key"); + char *t = strdup(n.val); + n.val = t; + if (nvlist_append(&r->nv, &n)) { + free(n.name); + free(n.val); + continue; + } + } else { + // Virtual keys char *key, *ptr2, *saved2; key = (char *)au_unescape(n.val); if (key == NULL) { + n.name = strdup("key"); + n.val = NULL; // Malformed key - save as is - nvlist_append(&r->nv, &n); + if (nvlist_append(&r->nv, &n)) { + free(n.name); + free(n.val); + } continue; } ptr2 = strtok_r(key, key_sep, &saved2); - free(n.name); - free(n.val); while (ptr2) { n.name = strdup("key"); n.val = escape(ptr2); - nvlist_append(&r->nv, &n); + if (nvlist_append(&r->nv, &n)) { + free(n.name); + free(n.val); + } ptr2 = strtok_r(NULL, key_sep, &saved2); } free(key); } continue; - } else - nvlist_append(&r->nv, &n); + } else { + if (strcmp(n.name, "key") == 0) { + // This is a null key + n.name = strdup("key"); + char *t = strdup(n.val); + n.val = t; + if (nvlist_append(&r->nv, &n)) { + free(n.name); + free(n.val); + continue; + } + } else // everything not a key + nvlist_append(&r->nv, &n); + } // Do some info gathering for use later if (r->nv.cnt == 1 && strcmp(n.name, "node") == 0) @@ -208,7 +238,7 @@ r->type = audit_name_to_msg_type(n.val); // This has to account for seccomp records } else if ((r->nv.cnt == (2 + offset) || - r->nv.cnt == (11 + offset)) && + r->nv.cnt == (11 + offset)) && strcmp(n.name, "arch")== 0){ unsigned int ival; errno = 0; @@ -260,7 +290,9 @@ while (ptr && *ptr != '}') { len = strlen(ptr); if ((len+1) >= (256-total)) { - free(buf); + if (nvlist_get_cnt(&r->nv) + == 0) + free(buf); return -1; } if (tmpctx[0]) { @@ -274,18 +306,26 @@ } n.name = strdup("seperms"); n.val = strdup(tmpctx); - nvlist_append(&r->nv, &n); + if (nvlist_append(&r->nv, &n)) { + free(n.name); + free(n.val); + } continue; } } else continue; - n.val = strdup(ptr); + n.val = ptr; nvlist_append(&r->nv, &n); } } while((ptr = audit_strsplit_r(NULL, &saved))); - free(buf); - r->nv.cur = r->nv.head; // reset to beginning + // If for some reason it was useless, delete buf + if (r->nv.cnt == 0) { + free(buf); + free((void *)r->cwd); + } + + r->nv.cur = 0; // reset to beginning return 0; } @@ -350,7 +390,7 @@ current = l->head; while (current) { nextnode=current->next; - nvlist_clear(&current->nv); + nvlist_clear(&current->nv, 1); free(current->record); free(current); current=nextnode; @@ -431,7 +471,7 @@ if (high <= low) return NULL; - node = l->head; /* Start at the beginning */ + node = l->head; /* Start at the beginning */ while (node) { if (node->type >= low && node->type <= high) { l->cur = node; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/ellist.h new/audit-3.0.5/auparse/ellist.h --- old/audit-3.0.3/auparse/ellist.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/ellist.h 2021-08-11 22:24:20.000000000 +0200 @@ -1,6 +1,6 @@ /* * ellist.h - Header file for ellist.c -* Copyright (c) 2006-07,2017 Red Hat Inc., Durham, North Carolina. +* Copyright (c) 2006-07,2017,2021 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or @@ -44,7 +44,7 @@ static inline unsigned int aup_list_get_cnt(event_list_t *l) { return l ? l->cnt : 0; } static inline void aup_list_first(event_list_t *l) { l->cur = l->head; } -static inline rnode *aup_list_get_cur(event_list_t *l) { return l->cur; } +static inline rnode *aup_list_get_cur(event_list_t *l) { return l ? l->cur : NULL; } AUDIT_HIDDEN_START diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/interpret.c new/audit-3.0.5/auparse/interpret.c --- old/audit-3.0.3/auparse/interpret.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/interpret.c 2021-08-11 22:24:20.000000000 +0200 @@ -50,6 +50,7 @@ #include <sys/personality.h> #include <sys/prctl.h> #include <sched.h> +#include <limits.h> /* PATH_MAX */ #ifdef USE_FANOTIFY #include <linux/fanotify.h> #else @@ -394,9 +395,11 @@ } /////////// Interpretation list functions /////////////// +#define NEVER_LOADED 0xFFFF void init_interpretation_list(void) { nvlist_create(&il); + il.cnt = NEVER_LOADED; } /* @@ -411,7 +414,10 @@ if (buffer == NULL) return 0; - buf = strdup(buffer); + if (il.cnt == NEVER_LOADED) + il.cnt = 0; + + il.record = buf = strdup(buffer); if (strncmp(buf, "SADDR=", 6) == 0) { // We have SOCKADDR record. It has no other values. // Handle it by itself. @@ -420,23 +426,25 @@ val = ptr; ptr = strchr(val, '}'); if (ptr) { - n.name = strdup("saddr"); - n.val = strdup(val); - nvlist_append(&il, &n); + // Just change the case + n.name = strcpy(buf, "saddr"); + n.val = val; + if (nvlist_append(&il, &n)) + goto err_out; nvlist_interp_fixup(&il); - free(buf); return 1; } } +err_out: free(buf); + il.record = NULL; + il.cnt = NEVER_LOADED; return 0; } else { // We handle everything else in this branch ptr = audit_strsplit_r(buf, &saved); - if (ptr == NULL) { - free(buf); - return 0; - } + if (ptr == NULL) + goto err_out; do { char tmp; @@ -447,7 +455,7 @@ val++; } else // Malformed - skip continue; - n.name = strdup(ptr); + n.name = ptr; char *c = n.name; while (*c) { *c = tolower(*c); @@ -460,14 +468,19 @@ } else tmp = 0; - n.val = strdup(val); - nvlist_append(&il, &n); + n.val = val; + if (nvlist_append(&il, &n)) + continue; // assuming we loaded something nvlist_interp_fixup(&il); if (ptr) *ptr = tmp; - } while((ptr = audit_strsplit_r(NULL, &saved))); + } while ((ptr = audit_strsplit_r(NULL, &saved))); } - free(buf); + + // If for some reason it was useless, delete buf + if (il.cnt == 0) + goto err_out; + return 1; } @@ -478,6 +491,9 @@ { nvnode *n; + if (il.cnt == NEVER_LOADED) + return NULL; + nvlist_first(&il); if (nvlist_find_name(&il, name)) { n = nvlist_get_cur(&il); @@ -494,7 +510,20 @@ void free_interpretation_list(void) { - nvlist_clear(&il); + if (il.cnt != NEVER_LOADED) { + nvlist_clear(&il, 0); + il.cnt = NEVER_LOADED; + } +} + +// This uses a sentinel to determine if the list has ever been loaded. +// If never loaded, returns 0. Otherwise it returns 1 higher than how +// many interpretations are loaded. +unsigned int interpretation_list_cnt(void) +{ + if (il.cnt == NEVER_LOADED) + return 0; + return il.cnt+1; } //////////// Start Field Value Interpretations ///////////// @@ -624,6 +653,18 @@ gid_cache_created = 0; } +void _auparse_flush_caches(void) +{ + if (uid_cache_created) { + destroy_lru(uid_cache); + uid_cache_created = 0; + } + if (gid_cache_created) { + destroy_lru(gid_cache); + gid_cache_created = 0; + } +} + static const char *print_uid(const char *val, unsigned int base) { int uid; @@ -828,6 +869,65 @@ return strdup(val); // Something is wrong with string, just send as is } +// This code is loosely based on glibc-2.27 realpath. +static char working[PATH_MAX]; +static char *path_norm(const char *name) +{ + char *rpath, *dest; + const char *start, *end, *rpath_limit; + int old_errno = errno; + + errno = EINVAL; + if (name == NULL) + return NULL; + if (name[0] == 0) + return NULL; + errno = old_errno; + + // If not absolute, give it back as is + if (name[0] == '.') + return strdup(name); + + rpath = working; + dest = rpath + 1; + rpath_limit = rpath + PATH_MAX; + + for (start = end = name; *start; start = end) { + // Remove duplicate '/' + while (*start == '/') + ++start; + + // Find end of path component + for (end = start; *end && *end != '/'; ++end) + ; //empty + + // if it ends with a slash, we're done + if (end - start == 0) + break; + else if (end - start == 1 && start[0] == '.') + ; //empty + else if (end - start == 2 && start[0] == '.' && + start[1] == '.') { + // Back up to previous component, ignore if root + if (dest > rpath + 1) + while ((--dest)[-1] != '/'); + } else { + if (dest[-1] != '/') + *dest++ = '/'; + + // If it will overflow, chop it at last component + if (dest + (end - start) >= rpath_limit) { + *dest = 0; + break; + } + // Otherwise copy next component + dest = mempcpy (dest, start, end - start); + *dest = 0; + } + } + return strdup(working); +} + static const char *print_escaped_ext(const idata *id) { if (id->cwd) { @@ -850,9 +950,8 @@ str2 = NULL; str1 = NULL; } - errno = 0; - out = realpath(str3, NULL); - if (errno) { // If there's an error, just return the original + out = path_norm(str3); + if (!out) { // If there's an error, just return the original free(str1); free(str2); return str3; @@ -1123,13 +1222,19 @@ // Now print address for some families switch (saddr->sa_family) { case AF_LOCAL: - { + if (slen < 4) { + rc = asprintf(&out, + "{ saddr_fam=%s sockaddr len too short }", + str); + break; + } else { const struct sockaddr_un *un = (const struct sockaddr_un *)saddr; + if (un->sun_path[0]) rc = asprintf(&out, - "{ saddr_fam=%s path=%s }", str, - un->sun_path); + "{ saddr_fam=%s path=%.108s }", + str, un->sun_path); else // abstract name rc = asprintf(&out, "{ saddr_fam=%s path=%.108s }", @@ -1218,11 +1323,16 @@ str); break; case AF_NETLINK: - { + if (slen < sizeof(struct sockaddr_nl)) { + rc = asprintf(&out, + "{ saddr_fam=%s len too short }", + str); + break; + } else { const struct sockaddr_nl *n = (const struct sockaddr_nl *)saddr; rc = asprintf(&out, - "{ saddr_fam=%s nlnk-fam=%u nlnk-pid=%u }", + "{ saddr_fam=%s nlnk-fam=%u nlnk-pid=%u }", str, n->nl_family, n->nl_pid); } break; @@ -2889,7 +2999,7 @@ */ const char *do_interpret(const rnode *r, auparse_esc_t escape_mode) { - const nvlist *nv = &r->nv; + nvlist *nv = &r->nv; int type; idata id; nvnode *n; @@ -2977,10 +3087,11 @@ const char *out; // Check the interpretations list first - if (il.head) { + if (interpretation_list_cnt()) { nvlist_first(&il); if (nvlist_find_name(&il, id->name)) { - const char *val = il.cur->interp_val; + nvnode* node = &il.array[il.cur]; + const char *val = node->interp_val; if (val) { // If we don't know what it is when auditd diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/interpret.h new/audit-3.0.5/auparse/interpret.h --- old/audit-3.0.3/auparse/interpret.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/interpret.h 2021-08-11 22:24:20.000000000 +0200 @@ -34,6 +34,7 @@ void init_interpretation_list(void); int load_interpretation_list(const char *buf); void free_interpretation_list(void); +unsigned int interpretation_list_cnt(void); int lookup_type(const char *name); const char *do_interpret(const rnode *r, auparse_esc_t escape_mode); void lookup_destroy_uid_list(void); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/normalize.c new/audit-3.0.5/auparse/normalize.c --- old/audit-3.0.3/auparse/normalize.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/normalize.c 2021-08-11 22:24:20.000000000 +0200 @@ -346,9 +346,11 @@ if ((strcmp(str, "unset") == 0) && errno == 0) { // Only move it if its safe to if (cnt < limit) { - auparse_next_field(au); + if (auparse_next_field(au) == 0) + return; cnt++; - } + } else + return; } else break; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/nvlist.c new/audit-3.0.5/auparse/nvlist.c --- old/audit-3.0.3/auparse/nvlist.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/nvlist.c 2021-08-11 22:24:20.000000000 +0200 @@ -1,7 +1,7 @@ /* * nvlist.c - Minimal linked list library for name-value pairs -* Copyright (c) 2006-07,2016 Red Hat Inc., Durham, North Carolina. -* All Rights Reserved. +* Copyright (c) 2006-07,2016,2021 Red Hat Inc. +* All Rights Reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -31,57 +31,40 @@ void nvlist_create(nvlist *l) { - l->head = NULL; - l->cur = NULL; - l->cnt = 0; -} - -static void nvlist_last(nvlist *l) -{ - register nvnode* node; - - if (l->head == NULL) - return; - - node = l->head; - while (node->next) - node = node->next; - l->cur = node; + if (l) { + memset(&l->array[0], 0, sizeof(nvnode) * NFIELDS); + l->cur = 0; + l->cnt = 0; + l->record = NULL; + } } nvnode *nvlist_next(nvlist *l) { - if (l->cur) - l->cur = l->cur->next; - return l->cur; + if (l->cnt && l->cur < (l->cnt - 1)) { + l->cur++; + return &l->array[l->cur]; + } + return NULL; } -void nvlist_append(nvlist *l, nvnode *node) +// 0 on success and 1 on error +int nvlist_append(nvlist *l, nvnode *node) { - nvnode* newnode = malloc(sizeof(nvnode)); + // FIXME: on overflow switch to linked list + if (l->cnt >= NFIELDS || node->name == NULL) + return 1; + nvnode *newnode = &l->array[l->cnt]; newnode->name = node->name; newnode->val = node->val; newnode->interp_val = NULL; - newnode->item = l->cnt; - newnode->next = NULL; - - // if we are at top, fix this up - if (l->head == NULL) - l->head = newnode; - else { // Otherwise add pointer to newnode - if (l->cnt == (l->cur->item+1)) { - l->cur->next = newnode; - } - else { - nvlist_last(l); - l->cur->next = newnode; - } - } + newnode->item = l->cnt; // make newnode current - l->cur = newnode; + l->cur = l->cnt; l->cnt++; + return 0; } /* @@ -89,23 +72,16 @@ */ void nvlist_interp_fixup(nvlist *l) { - if (l->cur) { - l->cur->interp_val = l->cur->val; - l->cur->val = NULL; - } + nvnode* node = &l->array[l->cur]; + node->interp_val = node->val; + node->val = NULL; } nvnode *nvlist_goto_rec(nvlist *l, unsigned int i) { - register nvnode* node; - - node = l->head; /* start at the beginning */ - while (node) { - if (node->item == i) { - l->cur = node; - return node; - } else - node = node->next; + if (i <= l->cnt) { + l->cur = i; + return &l->array[l->cur]; } return NULL; } @@ -115,52 +91,68 @@ */ int nvlist_find_name(nvlist *l, const char *name) { - register nvnode* node = l->cur; + unsigned int i = l->cur; + register nvnode *node; + + if (l->cnt == 0) + return 0; - while (node) { - if (strcmp(node->name, name) == 0) { - l->cur = node; + do { + node = &l->array[i]; + if (node->name && strcmp(node->name, name) == 0) { + l->cur = i; return 1; } - else - node = node->next; - } + i++; + } while (i < l->cnt); return 0; } extern int interp_adjust_type(int rtype, const char *name, const char *val); -int nvlist_get_cur_type(const rnode *r) +int nvlist_get_cur_type(rnode *r) { - const nvlist *l = &r->nv; - return auparse_interp_adjust_type(r->type, l->cur->name, l->cur->val); + nvlist *l = &r->nv; + nvnode *node = &l->array[l->cur]; + return auparse_interp_adjust_type(r->type, node->name, node->val); } -const char *nvlist_interp_cur_val(const rnode *r, auparse_esc_t escape_mode) +const char *nvlist_interp_cur_val(rnode *r, auparse_esc_t escape_mode) { - const nvlist *l = &r->nv; - if (l->cur->interp_val) - return l->cur->interp_val; + nvlist *l = &r->nv; + nvnode *node = &l->array[l->cur]; + if (node->interp_val) + return node->interp_val; return do_interpret(r, escape_mode); } -void nvlist_clear(nvlist* l) +// free_interp does not apply to thing coming from interpretation_list +void nvlist_clear(nvlist* l, int free_interp) { - nvnode* nextnode; + unsigned int i = 0; register nvnode* current; - if (l->head == NULL) + if (l->cnt == 0) return; - current = l->head; - while (current) { - nextnode=current->next; - free(current->name); - free(current->val); - free(current->interp_val); - free(current); - current=nextnode; + while (i < l->cnt) { + current = &l->array[i]; + if (free_interp) { + free(current->interp_val); + // A couple items are not in parsed up list. + // These all come from the aup_list_append path. + if ((strcmp(current->name, "key") == 0) || + (strcmp(current->name, "seperms") == 0) || + (strcmp(current->name, "seresult") == 0)) { + // seperms & key values are strdup'ed + if (current->name[2] != 'r') + free(current->val); + free(current->name); + } + } + i++; } - l->head = NULL; - l->cur = NULL; + free((void *)l->record); + l->record = NULL; + l->cur = 0; l->cnt = 0; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/nvlist.h new/audit-3.0.5/auparse/nvlist.h --- old/audit-3.0.3/auparse/nvlist.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/nvlist.h 2021-08-11 22:24:20.000000000 +0200 @@ -1,6 +1,6 @@ /* * nvlist.h - Header file for nvlist.c -* Copyright (c) 2006-07,2016 Red Hat Inc., Durham, North Carolina. +* Copyright (c) 2006-07,2016,2021 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or @@ -32,20 +32,24 @@ static inline unsigned int nvlist_get_cnt(nvlist *l) { return l->cnt; } -static inline void nvlist_first(nvlist *l) { l->cur = l->head; } -static inline nvnode *nvlist_get_cur(const nvlist *l) { return l->cur; } -static inline const char *nvlist_get_cur_name(const nvlist *l) {if (l->cur) return l->cur->name; else return NULL;} -static inline const char *nvlist_get_cur_val(const nvlist *l) {if (l->cur) return l->cur->val; else return NULL;} -static inline const char *nvlist_get_cur_val_interp(const nvlist *l) {if (l->cur) return l->cur->interp_val; else return NULL;} +static inline void nvlist_first(nvlist *l) { l->cur = 0; } +static inline nvnode *nvlist_get_cur(nvlist *l) + { return &l->array[l->cur]; } +static inline const char *nvlist_get_cur_name(nvlist *l) + {if (l->cnt) { nvnode *node = &l->array[l->cur]; return node->name; } else return NULL;} +static inline const char *nvlist_get_cur_val(nvlist *l) + {if (l->cnt) { nvnode *node = &l->array[l->cur]; return node->val; } else return NULL;} +static inline const char *nvlist_get_cur_val_interp(nvlist *l) + {if (l->cnt) { nvnode *node = &l->array[l->cur]; return node->interp_val; } else return NULL;} AUDIT_HIDDEN_START void nvlist_create(nvlist *l); -void nvlist_clear(nvlist* l); +void nvlist_clear(nvlist* l, int free_interp); nvnode *nvlist_next(nvlist *l); -int nvlist_get_cur_type(const rnode *r); -const char *nvlist_interp_cur_val(const rnode *r, auparse_esc_t escape_mode); -void nvlist_append(nvlist *l, nvnode *node); +int nvlist_get_cur_type(rnode *r); +const char *nvlist_interp_cur_val(rnode *r, auparse_esc_t escape_mode); +int nvlist_append(nvlist *l, nvnode *node); void nvlist_interp_fixup(nvlist *l); /* Given a numeric index, find that record. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/auparse/rnode.h new/audit-3.0.5/auparse/rnode.h --- old/audit-3.0.3/auparse/rnode.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/auparse/rnode.h 2021-08-11 22:24:20.000000000 +0200 @@ -1,6 +1,5 @@ - /* rnode.h -- - * Copyright 2007,2016-17 Red Hat Inc., Durham, North Carolina. + * Copyright 2007,2016-17,21 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or @@ -24,21 +23,23 @@ #ifndef RNODE_HEADER #define RNODE_HEADER -/* This is the node of the linked list. Any data elements that are +#define NFIELDS 36 + +/* This is the data node of the fields list. Any data elements that are * per field goes here. */ typedef struct _nvnode{ char *name; // The name string char *val; // The value field char *interp_val; // The value field interpreted unsigned int item; // Which item of the same event - struct _nvnode* next; // Next nvpair node pointer } nvnode; -/* This is the field linked list head. */ +/* This is the field list head. */ typedef struct { - nvnode *head; // List head - nvnode *cur; // Pointer to current node + nvnode array[NFIELDS];// array of fields + unsigned int cur; // Index to current node unsigned int cnt; // How many items in this list + char *record; // Holds the parsed up record } nvlist; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/configure.ac new/audit-3.0.5/configure.ac --- old/audit-3.0.3/configure.ac 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/configure.ac 2021-08-11 22:24:20.000000000 +0200 @@ -29,7 +29,7 @@ ]) AC_REVISION($Revision: 1.3 $)dnl -AC_INIT(audit,3.0.3) +AC_INIT(audit,3.0.5) AC_PREREQ(2.12)dnl AM_CONFIG_HEADER(config.h) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/aarch64_table.h new/audit-3.0.5/lib/aarch64_table.h --- old/audit-3.0.3/lib/aarch64_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/aarch64_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -318,4 +318,8 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/arm_table.h new/audit-3.0.5/lib/arm_table.h --- old/audit-3.0.3/lib/arm_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/arm_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -424,4 +424,7 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") - +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/i386_table.h new/audit-3.0.5/lib/i386_table.h --- old/audit-3.0.3/lib/i386_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/i386_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -454,4 +454,9 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") +_S(447, "memfd_secret") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/ppc_table.h new/audit-3.0.5/lib/ppc_table.h --- old/audit-3.0.3/lib/ppc_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/ppc_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -439,4 +439,8 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/s390_table.h new/audit-3.0.5/lib/s390_table.h --- old/audit-3.0.3/lib/s390_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/s390_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -402,4 +402,8 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/s390x_table.h new/audit-3.0.5/lib/s390x_table.h --- old/audit-3.0.3/lib/s390x_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/s390x_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -366,4 +366,8 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/lib/x86_64_table.h new/audit-3.0.5/lib/x86_64_table.h --- old/audit-3.0.3/lib/x86_64_table.h 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/lib/x86_64_table.h 2021-08-11 22:24:20.000000000 +0200 @@ -374,4 +374,9 @@ _S(440, "process_madvise") _S(441, "epoll_pwait2") _S(442, "mount_setattr") +_S(443, "quotactl_fd") +_S(444, "landlock_create_ruleset") +_S(445, "landlock_add_rule") +_S(446, "landlock_restrict_self") +_S(447, "memfd_secret") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/rules/README-rules new/audit-3.0.5/rules/README-rules --- old/audit-3.0.3/rules/README-rules 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/rules/README-rules 2021-08-11 22:24:20.000000000 +0200 @@ -20,7 +20,10 @@ that should be thought out and individual files copied to /etc/audit/rules.d/ For example, if you wanted to set a system up in the STIG configuration, copy rules 10-base-config, 30-stig, 31-privileged, and 99-finalize. You can add -more if you like. +more if you like. Also, not all arches have the same syscalls. It is expected +that the rules be fine tuned for the arch they are deployed on. For example, +aarch64 does not have the open syscall. It should just be deleted from the +rules. Once you have the rules in the rules.d directory, you can load them by running augenrules --load diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/auditctl.c new/audit-3.0.5/src/auditctl.c --- old/audit-3.0.3/src/auditctl.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/auditctl.c 2021-08-11 22:24:20.000000000 +0200 @@ -153,30 +153,30 @@ static int lookup_filter(const char *str, int *filter) { - if (strcmp(str, "task") == 0) - *filter = AUDIT_FILTER_TASK; - else if (strcmp(str, "exit") == 0) + if (strcmp(str, "exit") == 0) *filter = AUDIT_FILTER_EXIT; + else if (strcmp(str, "task") == 0) + *filter = AUDIT_FILTER_TASK; else if (strcmp(str, "user") == 0) *filter = AUDIT_FILTER_USER; - else if (strcmp(str, "filesystem") == 0) - *filter = AUDIT_FILTER_FS; else if (strcmp(str, "exclude") == 0) { *filter = AUDIT_FILTER_EXCLUDE; exclude = 1; - } else + } else if (strcmp(str, "filesystem") == 0) + *filter = AUDIT_FILTER_FS; + else return 2; return 0; } static int lookup_action(const char *str, int *act) { - if (strcmp(str, "never") == 0) + if (strcmp(str, "always") == 0) + *act = AUDIT_ALWAYS; + else if (strcmp(str, "never") == 0) *act = AUDIT_NEVER; else if (strcmp(str, "possible") == 0) return 1; - else if (strcmp(str, "always") == 0) - *act = AUDIT_ALWAYS; else return 2; return 0; @@ -200,8 +200,8 @@ *p = 0; /* Try opt both ways */ - if (lookup_filter(opt, filter) == 2) { - rc = lookup_action(opt, act); + if (lookup_action(opt, act) == 2) { + rc = lookup_filter(opt, filter); if (rc != 0) { *p = ','; return rc; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/auditd-event.c new/audit-3.0.5/src/auditd-event.c --- old/audit-3.0.3/src/auditd-event.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/auditd-event.c 2021-08-11 22:24:20.000000000 +0200 @@ -42,6 +42,7 @@ #include "libaudit.h" #include "private.h" #include "auparse.h" +#include "auparse-idata.h" /* This is defined in auditd.c */ extern volatile int stop; @@ -56,7 +57,7 @@ static void do_disk_full_action(void); static void do_disk_error_action(const char *func, int err); static void fix_disk_permissions(void); -static void check_excess_logs(void); +static void check_excess_logs(void); static void rotate_logs_now(void); static void rotate_logs(unsigned int num_logs, unsigned int keep_logs); static void shift_logs(void); @@ -70,7 +71,7 @@ /* Local Data */ static struct daemon_conf *config; static volatile int log_fd; -static FILE *log_file; +static FILE *log_file = NULL; static unsigned int disk_err_warning = 0; static int fs_space_warning = 0; static int fs_admin_space_warning = 0; @@ -135,7 +136,8 @@ pthread_cancel(flush_thread); free((void *)format_buf); auparse_destroy_ext(au, AUPARSE_DESTROY_ALL); - fsync(log_fd); + if (log_fd >= 0) + fsync(log_fd); if (log_file) fclose(log_file); } @@ -173,7 +175,8 @@ format_buf = (char *)malloc(FORMAT_BUF_LEN); if (format_buf == NULL) { audit_msg(LOG_ERR, "No memory for formatting, exiting"); - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; return 1; } @@ -211,7 +214,8 @@ flush = 0; pthread_mutex_unlock(&flush_lock); - fsync(log_fd); + if (log_fd >= 0) + fsync(log_fd); } return NULL; } @@ -394,7 +398,7 @@ snprintf(format_buf, MAX_AUDIT_MESSAGE_LENGTH, "type=DAEMON_ERR op=format-enriched msg=NULL res=failed"); } else { - int rc; + int rc, rtype; size_t mlen, len; char *message; // Do raw format to get event started @@ -427,6 +431,17 @@ // Loop over all fields while possible to add field rc = auparse_first_record(au); + rtype = auparse_get_type(au); + switch (rtype) + { // Flush before adding to pickup new associations + case AUDIT_ADD_USER: + case AUDIT_ADD_GROUP: + _auparse_flush_caches(); + break; + default: + break; + } + while (rc > 0 && len > MIN_SPACE_LEFT) { // See what kind of field we have size_t vlen; @@ -454,6 +469,17 @@ rc = auparse_next_field(au); } + switch(rtype) + { // Flush after modification to remove stale entries + case AUDIT_USER_MGMT: + case AUDIT_DEL_USER: + case AUDIT_DEL_GROUP: + case AUDIT_GRP_MGMT: + _auparse_flush_caches(); + break; + default: + break; + } free(message); } return format_buf; @@ -566,7 +592,8 @@ if (config->daemonize == D_BACKGROUND) { if (config->flush == FT_INCREMENTAL) { /* EIO is only likely failure */ - if (fsync(log_fd) != 0) { + if (log_fd >= 0 && + fsync(log_fd) != 0) { do_disk_error_action( "fsync", errno); @@ -721,6 +748,9 @@ int rc; struct statfs buf; + if (log_fd < 0) + return; + rc = fstatfs(log_fd, &buf); if (rc == 0) { if (buf.f_bavail < 5) { @@ -808,7 +838,8 @@ case FA_EXEC: // Close the logging file in case the script zips or // moves the file. We'll reopen in sigusr2 handler - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; log_fd = -1; logging_suspended = 1; @@ -858,7 +889,8 @@ case FA_EXEC: // Close the logging file in case the script zips or // moves the file. We'll reopen in sigusr2 handler - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; log_fd = -1; logging_suspended = 1; @@ -905,7 +937,8 @@ case FA_EXEC: // Close the logging file in case the script zips or // moves the file. We'll reopen in sigusr2 handler - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; log_fd = -1; logging_suspended = 1; @@ -1030,17 +1063,21 @@ /* Close audit file. fchmod and fchown errors are not fatal because we * already adjusted log file permissions and ownership when opening the * log file. */ - if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP : S_IRUSR) < 0){ - audit_msg(LOG_WARNING, "Couldn't change permissions while " + if (log_fd >= 0) { + if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP : + S_IRUSR) < 0){ + audit_msg(LOG_WARNING, "Couldn't change permissions while " "rotating log file (%s)", strerror(errno)); - } - if (fchown(log_fd, 0, config->log_group) < 0) { - audit_msg(LOG_WARNING, "Couldn't change ownership while " + } + if (fchown(log_fd, 0, config->log_group) < 0) { + audit_msg(LOG_WARNING, "Couldn't change ownership while " "rotating log file (%s)", strerror(errno)); + } } - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; - + /* Rotate */ len = strlen(config->log_file) + 16; oldname = (char *)malloc(len); @@ -1447,7 +1484,8 @@ free((void *)nconf->log_file); if (need_reopen) { - fclose(log_file); + if (log_file) + fclose(log_file); log_file = NULL; fix_disk_permissions(); if (open_audit_log()) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/auditd.c new/audit-3.0.5/src/auditd.c --- old/audit-3.0.3/src/auditd.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/auditd.c 2021-08-11 22:24:20.000000000 +0200 @@ -448,11 +448,11 @@ if (rc < 0) return -1; - free_config(&config); - /* Success - die a happy death */ - if (status == SUCCESS) + if (status == SUCCESS) { + free_config(&config); _exit(0); + } return -1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/ausearch-lol.c new/audit-3.0.5/src/ausearch-lol.c --- old/audit-3.0.3/src/ausearch-lol.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/ausearch-lol.c 2021-08-11 22:24:20.000000000 +0200 @@ -193,7 +193,8 @@ // Now should be pointing to msg= ptr = audit_strsplit(NULL); - if (ptr) { + // strlen is for fuzzers that make invalid lines + if (ptr && strlen(ptr) > 24) { if (*(ptr+9) == '(') ptr+=9; else diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/ausearch-lookup.c new/audit-3.0.5/src/ausearch-lookup.c --- old/audit-3.0.3/src/ausearch-lookup.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/ausearch-lookup.c 2021-08-11 22:24:20.000000000 +0200 @@ -300,6 +300,9 @@ while (isxdigit(*ptr)) ptr++; } + if ((ptr - buf) == 0) + return NULL; + str = strndup(buf, ptr - buf); if (*buf == '(') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/audit-3.0.3/src/ausearch-parse.c new/audit-3.0.5/src/ausearch-parse.c --- old/audit-3.0.3/src/ausearch-parse.c 2021-07-14 20:36:03.000000000 +0200 +++ new/audit-3.0.5/src/ausearch-parse.c 2021-08-11 22:24:20.000000000 +0200 @@ -420,8 +420,10 @@ str = strstr(term, "comm="); if (str) { /* Make the syscall one override */ - if (s->comm) + if (s->comm) { free(s->comm); + s->comm = NULL; + } str += 5; if (*str == '"') { str++; @@ -431,7 +433,7 @@ *term = 0; s->comm = strdup(str); *term = '"'; - } else + } else s->comm = unescape(str); } else return 38; @@ -1029,7 +1031,7 @@ if (str) { str += 5; term = str; - while (*term != ' ' && *term != ':') + while (*term != ' ' && *term != ':' && *term) term++; if (term == str) return 24; @@ -1130,7 +1132,7 @@ } } skip: - mptr = term + 1; + mptr = term; if (event_comm) { // dont do this search unless needed @@ -1184,7 +1186,7 @@ } } } - mptr = term + 1; + mptr = term; // get hostname if (event_hostname) { @@ -1242,7 +1244,7 @@ char *end = str; int legacy = 0; - while (*end != ' ') { + while (*end != ' ' && *end) { if (!isxdigit(*end)) { legacy = 1; } @@ -1293,7 +1295,7 @@ char *end = str; int legacy = 0; - while (*end != ' ') { + while (*end != ' ' && *end) { if (!isxdigit(*end)) { legacy = 1; } @@ -1656,12 +1658,21 @@ if (event_hostname || event_filename) { str = strstr(n->message, "saddr="); if (str) { - int len; + unsigned int len = 0; struct sockaddr *saddr; char name[NI_MAXHOST]; str += 6; - len = strlen(str)/2; + const char *ptr = str; + if (*ptr == '(') { + const char *ptr2 = strchr(ptr, ')'); + if (ptr2) + len = (ptr2 - ptr) + 1; + } else { + while (isxdigit(ptr[len])) + len++; + len /= 2; + } s->hostname = unescape(str); if (s->hostname == NULL) return 4; @@ -1681,17 +1692,13 @@ } len = sizeof(struct sockaddr_in6); } else if (saddr->sa_family == AF_UNIX) { - struct sockaddr_un *un = - (struct sockaddr_un *)saddr; - if (un->sun_path[0]) - len = strlen(un->sun_path); - else // abstract name - len = strlen(&un->sun_path[1]); - if (len == 0) { + if (len < 4) { fprintf(stderr, "sun_path len too short\n"); return 3; } + struct sockaddr_un *un = + (struct sockaddr_un *)saddr; if (event_filename) { if (!s->filename) { //create @@ -1734,7 +1741,7 @@ s->hostname = NULL; return 0; } - if (getnameinfo(saddr, len, name, NI_MAXHOST, + if (getnameinfo(saddr, len, name, NI_MAXHOST, NULL, 0, NI_NUMERICHOST) ) { free(s->hostname); s->hostname = NULL; @@ -1993,6 +2000,10 @@ *term = '"'; } else { s->comm = unescape(str); + if (s->comm == NULL) { + rc = 11; + goto err; + } term = str + 6; } } @@ -2713,8 +2724,10 @@ str = strstr(term, "comm="); if (str) { /* Make the syscall one override */ - if (s->comm) + if (s->comm) { free(s->comm); + s->comm = NULL; + } str += 5; if (*str == '"') { str++; ++++++ audit-ausearch-do-not-require-tclass.patch ++++++ --- /var/tmp/diff_new_pack.k9FbTm/_old 2021-10-01 22:28:55.241359336 +0200 +++ /var/tmp/diff_new_pack.k9FbTm/_new 2021-10-01 22:28:55.241359336 +0200 @@ -11,7 +11,7 @@ --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c -@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea +@@ -2061,17 +2061,15 @@ other_avc: // Now get the class...its at the end, so we do things different str = strstr(term, "tclass="); ++++++ change-default-log_format.patch ++++++ From: Enzo Matsumiya <ematsumiya(a)suse.de> Subject: auditd.conf: change default log_format References: bsc#1190500 Upstream commit bf1270cfe ("change default logging format and update roadmap") changed the default log_format from RAW to ENRICHED. This causes non-audit tools to not interpret the GS character (group separator, 0x1d) that splits the raw data from the enriched data, causing it to be visually concatenated. Since a candidate patch to change this was rejected by upstream, we change the default log_format back to RAW instead, to avoid confusion on customers' environments. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> --- a/init.d/auditd.conf +++ b/init.d/auditd.conf @@ -6,7 +6,7 @@ local_events = yes write_logs = yes log_file = /var/log/audit/audit.log log_group = audit -log_format = ENRICHED +log_format = RAW flush = INCREMENTAL_ASYNC freq = 50 max_log_file = 8 ++++++ enable-stop-rules.patch ++++++ From: Enzo Matsumiya <ematsumiya(a)suse.de> Subject: init.d/auditd.service: enable ExecStopPost directive in auditd.service References: bsc#1190227 This has caused confusion for customers when relating stopping auditd service is the same as stopping system auditing. This is completely understandable, but it's by design, so kauditd can keep filling its queues for any other userspace daemon to consume. Disable audit when auditd.service stops, so kauditd stops logging/running. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> --- a/init.d/auditd.service +++ b/init.d/auditd.service @@ -25,7 +25,7 @@ ExecStartPost=-/sbin/augenrules --load #ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service -#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules +ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules ### Security Settings ### MemoryDenyWriteExecute=true ++++++ fix-hardened-service.patch ++++++ From: Enzo Matsumiya <ematsumiya(a)suse.de> Subject: init.d/auditd.service: make /etc/audit writable References: bsc#1181400 systemd hardening effort (bsc#1181400) broke auditd.service when starting/ restarting it. This was because auditd couldn't save/create audit.rules from /etc/audit/rules.d/* files. Make /etc/audit writable for the service. Also remove PrivateDevices=true so /dev/* are exposed to auditd. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> --- a/init.d/auditd.service +++ b/init.d/auditd.service @@ -37,12 +37,12 @@ RestrictRealtime=true # added automatically, for details please see # https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ProtectSystem=full -PrivateDevices=true ProtectHostname=true ProtectClock=true ProtectKernelTunables=true ProtectKernelLogs=true # end of automatic additions +ReadWritePaths=/etc/audit [Install] WantedBy=multi-user.target ++++++ harden_auditd.service.patch ++++++ --- /var/tmp/diff_new_pack.k9FbTm/_old 2021-10-01 22:28:55.297359440 +0200 +++ /var/tmp/diff_new_pack.k9FbTm/_new 2021-10-01 22:28:55.297359440 +0200 @@ -1,8 +1,6 @@ -Index: audit-3.0.3/init.d/auditd.service -=================================================================== ---- audit-3.0.3.orig/init.d/auditd.service -+++ audit-3.0.3/init.d/auditd.service -@@ -35,6 +35,15 @@ ProtectControlGroups=true +--- a/init.d/auditd.service ++++ b/init.d/auditd.service +@@ -34,6 +34,15 @@ ProtectControlGroups=true ProtectKernelModules=true ProtectHome=true RestrictRealtime=true

1 0

commit 000update-repos for openSUSE:Factory
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 000update-repos for openSUSE:Factory checked in at 2021-10-01 21:10:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/000update-repos (Old) and /work/SRC/openSUSE:Factory/.000update-repos.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "000update-repos" Fri Oct 1 21:10:56 2021 rev:1804 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! Old: ---- factory:non-oss_2893.2.packages.xz factory:non-oss_2893.2_and_before.packages.xz factory:non-oss_2895.2.packages.xz factory:non-oss_2900.7.packages.xz factory:non-oss_2902.2.packages.xz factory:non-oss_2904.3.packages.xz factory:non-oss_2905.3.packages.xz factory:non-oss_2906.2.packages.xz factory:non-oss_2912.3.packages.xz factory:non-oss_2914.2.packages.xz factory:non-oss_2915.2.packages.xz factory_20210915.packages.xz factory_20210915_and_before.packages.xz factory_20210916.packages.xz factory_20210920.packages.xz factory_20210921.packages.xz factory_20210922.packages.xz factory_20210923.packages.xz factory_20210924.packages.xz factory_20210926.packages.xz factory_20210927.packages.xz factory_20210928.packages.xz New: ---- 15.2:update_1633075877.packages.xz factory:non-oss_2915.2_and_before.packages.xz factory:non-oss_2918.1.packages.xz factory_20210928_and_before.packages.xz factory_20210929.packages.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------

1 0

commit 000product for openSUSE:Factory
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 000product for openSUSE:Factory checked in at 2021-10-01 17:23:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/000product (Old) and /work/SRC/openSUSE:Factory/.000product.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "000product" Fri Oct 1 17:23:26 2021 rev:2920 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ MicroOS-dvd5-kubic-dvd-x86_64.kiwi ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.644321053 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.644321053 +0200 @@ -655,6 +655,7 @@ <repopackage name="python38-cffi" arch="x86_64"/> <repopackage name="python38-chardet" arch="x86_64"/> <repopackage name="python38-configobj" arch="x86_64"/> + <repopackage name="python38-contextvars" arch="x86_64"/> <repopackage name="python38-cryptography" arch="x86_64"/> <repopackage name="python38-Cycler" arch="x86_64"/> <repopackage name="python38-dbus-python" arch="x86_64"/> @@ -662,6 +663,7 @@ <repopackage name="python38-gobject" arch="x86_64"/> <repopackage name="python38-greenlet" arch="x86_64"/> <repopackage name="python38-idna" arch="x86_64"/> + <repopackage name="python38-immutables" arch="x86_64"/> <repopackage name="python38-importlib-metadata" arch="x86_64"/> <repopackage name="python38-iniconfig" arch="x86_64"/> <repopackage name="python38-Jinja2" arch="x86_64"/> openSUSE-cd-mini-i586.kiwi: same change openSUSE-cd-mini-x86_64.kiwi: same change ++++++ openSUSE-dvd5-dvd-i586.kiwi ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.700321145 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.700321145 +0200 @@ -3348,6 +3348,7 @@ <repopackage name="perl-BSD-Resource"/> <repopackage name="perl-CDDB_get"/> <repopackage name="perl-CGI"/> + <repopackage name="perl-Clone"/> <repopackage name="perl-common-sense"/> <repopackage name="perl-Config-General"/> <repopackage name="perl-Convert-ASN1"/> @@ -3677,6 +3678,7 @@ <repopackage name="python38-colorama"/> <repopackage name="python38-configobj"/> <repopackage name="python38-constantly"/> + <repopackage name="python38-contextvars"/> <repopackage name="python38-cramjam"/> <repopackage name="python38-cryptography"/> <repopackage name="python38-cssselect"/> @@ -3722,6 +3724,7 @@ <repopackage name="python38-hyperframe"/> <repopackage name="python38-hyperlink"/> <repopackage name="python38-idna"/> + <repopackage name="python38-immutables"/> <repopackage name="python38-importlib-metadata"/> <repopackage name="python38-importlib-resources"/> <repopackage name="python38-incremental"/> @@ -4261,7 +4264,6 @@ <repopackage name="ruby2.7-rubygem-ruby-progressbar"/> <repopackage name="ruby2.7-rubygem-ruby-rc4"/> <repopackage name="ruby2.7-rubygem-ruby2_keywords"/> - <repopackage name="ruby2.7-rubygem-ruby_dep"/> <repopackage name="ruby2.7-rubygem-ruby_parser"/> <repopackage name="ruby2.7-rubygem-rubyntlm"/> <repopackage name="ruby2.7-rubygem-rubyzip"/> @@ -4321,7 +4323,6 @@ <repopackage name="ruby2.7-rubygem-unf_ext"/> <repopackage name="ruby2.7-rubygem-unicode-display_width"/> <repopackage name="ruby2.7-rubygem-unicode-display_width-1"/> - <repopackage name="ruby2.7-rubygem-unicorn"/> <repopackage name="ruby2.7-rubygem-vagrant-spec"/> <repopackage name="ruby2.7-rubygem-validate_email"/> <repopackage name="ruby2.7-rubygem-validate_url"/> ++++++ openSUSE-dvd5-dvd-x86_64.kiwi ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.720321178 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.724321184 +0200 @@ -3643,6 +3643,7 @@ <repopackage name="perl-CDDB_get"/> <repopackage name="perl-CGI"/> <repopackage name="perl-Class-Inspector" arch="x86_64"/> + <repopackage name="perl-Clone"/> <repopackage name="perl-common-sense"/> <repopackage name="perl-Config-General"/> <repopackage name="perl-Convert-ASN1"/> @@ -3989,6 +3990,7 @@ <repopackage name="python38-colorama"/> <repopackage name="python38-configobj"/> <repopackage name="python38-constantly"/> + <repopackage name="python38-contextvars"/> <repopackage name="python38-cramjam"/> <repopackage name="python38-cryptography"/> <repopackage name="python38-cssselect"/> @@ -4037,6 +4039,7 @@ <repopackage name="python38-hyperframe"/> <repopackage name="python38-hyperlink"/> <repopackage name="python38-idna"/> + <repopackage name="python38-immutables"/> <repopackage name="python38-importlib-metadata"/> <repopackage name="python38-importlib-resources"/> <repopackage name="python38-incremental"/> @@ -4581,7 +4584,6 @@ <repopackage name="ruby2.7-rubygem-ruby-progressbar"/> <repopackage name="ruby2.7-rubygem-ruby-rc4"/> <repopackage name="ruby2.7-rubygem-ruby2_keywords"/> - <repopackage name="ruby2.7-rubygem-ruby_dep"/> <repopackage name="ruby2.7-rubygem-ruby_parser"/> <repopackage name="ruby2.7-rubygem-rubyntlm"/> <repopackage name="ruby2.7-rubygem-rubyzip"/> @@ -4641,7 +4643,6 @@ <repopackage name="ruby2.7-rubygem-unf_ext"/> <repopackage name="ruby2.7-rubygem-unicode-display_width"/> <repopackage name="ruby2.7-rubygem-unicode-display_width-1"/> - <repopackage name="ruby2.7-rubygem-unicorn"/> <repopackage name="ruby2.7-rubygem-vagrant-spec"/> <repopackage name="ruby2.7-rubygem-validate_email"/> <repopackage name="ruby2.7-rubygem-validate_url"/> @@ -4858,7 +4859,6 @@ <repopackage name="syntax-highlighting"/> <repopackage name="sysconfig"/> <repopackage name="sysconfig-netconfig"/> - <repopackage name="sysdig-kmp-default" arch="x86_64"/> <repopackage name="syslinux"/> <repopackage name="syslog-service"/> <repopackage name="system-config-printer"/> stub.kiwi: same change ++++++ dvd.group ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.860321407 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.860321407 +0200 @@ -3294,11 +3294,12 @@ <package name="pentobi-kde-thumbnailer" supportstatus="unsupported"/>  <package name="perl" supportstatus="unsupported"/>  <package name="perl-Archive-Zip" supportstatus="unsupported"/>  - <package name="perl-Authen-SASL" supportstatus="unsupported"/>  + <package name="perl-Authen-SASL" supportstatus="unsupported"/>  <package name="perl-BSD-Resource" supportstatus="unsupported"/>  <package name="perl-Bootloader" supportstatus="unsupported"/>  <package name="perl-CDDB_get" supportstatus="unsupported"/>  <package name="perl-CGI" supportstatus="unsupported"/>  + <package name="perl-Clone" supportstatus="unsupported"/>  <package name="perl-Config-General" supportstatus="unsupported"/>  <package name="perl-Convert-ASN1" supportstatus="unsupported"/>  <package name="perl-Convert-BinHex" supportstatus="unsupported"/>  @@ -3646,6 +3647,7 @@ <package name="python38-colorama" supportstatus="unsupported"/>  <package name="python38-configobj" supportstatus="unsupported"/>  <package name="python38-constantly" supportstatus="unsupported"/>  + <package name="python38-contextvars" supportstatus="unsupported"/>  <package name="python38-cramjam" supportstatus="unsupported"/>  <package name="python38-cryptography" supportstatus="unsupported"/>  <package name="python38-cssselect" supportstatus="unsupported"/>  @@ -3689,6 +3691,7 @@ <package name="python38-hyperframe" supportstatus="unsupported"/>  <package name="python38-hyperlink" supportstatus="unsupported"/>  <package name="python38-idna" supportstatus="unsupported"/>  + <package name="python38-immutables" supportstatus="unsupported"/>  <package name="python38-importlib-metadata" supportstatus="unsupported"/>  <package name="python38-importlib-resources" supportstatus="unsupported"/>  <package name="python38-incremental" supportstatus="unsupported"/>  @@ -4212,7 +4215,6 @@ <package name="ruby2.7-rubygem-ruby-progressbar" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-ruby-rc4" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-ruby2_keywords" supportstatus="unsupported"/>  - <package name="ruby2.7-rubygem-ruby_dep" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-ruby_parser" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-rubyntlm" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-rubyzip" supportstatus="unsupported"/>  @@ -4272,7 +4274,6 @@ <package name="ruby2.7-rubygem-unf_ext" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-unicode-display_width" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-unicode-display_width-1" supportstatus="unsupported"/>  - <package name="ruby2.7-rubygem-unicorn" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-vagrant-spec" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-validate_email" supportstatus="unsupported"/>  <package name="ruby2.7-rubygem-validate_url" supportstatus="unsupported"/>  @@ -5433,7 +5434,6 @@ <package name="skopeo" supportstatus="unsupported"/>  <package name="sssd-32bit" supportstatus="unsupported"/>  <package name="supermin" supportstatus="unsupported"/>  - <package name="sysdig-kmp-default" supportstatus="unsupported"/>  <package name="systemd-32bit" supportstatus="unsupported"/>  <package name="unclutter" supportstatus="unsupported"/>  <package name="util-macros-devel" supportstatus="unsupported"/>  ++++++ opensuse_kubic.group ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.904321480 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.908321486 +0200 @@ -641,12 +641,14 @@ <package name="python38-cffi" supportstatus="unsupported"/>  <package name="python38-chardet" supportstatus="unsupported"/>  <package name="python38-configobj" supportstatus="unsupported"/>  + <package name="python38-contextvars" supportstatus="unsupported"/>  <package name="python38-cryptography" supportstatus="unsupported"/>  <package name="python38-dbus-python" supportstatus="unsupported"/>  <package name="python38-distro" supportstatus="unsupported"/>  <package name="python38-gobject" supportstatus="unsupported"/>  <package name="python38-greenlet" supportstatus="unsupported"/>  <package name="python38-idna" supportstatus="unsupported"/>  + <package name="python38-immutables" supportstatus="unsupported"/>  <package name="python38-importlib-metadata" supportstatus="unsupported"/>  <package name="python38-iniconfig" supportstatus="unsupported"/>  <package name="python38-jsonpatch" supportstatus="unsupported"/>  ++++++ unsorted.yml ++++++ --- /var/tmp/diff_new_pack.qb9crd/_old 2021-10-01 17:23:29.972321592 +0200 +++ /var/tmp/diff_new_pack.qb9crd/_new 2021-10-01 17:23:29.976321598 +0200 @@ -3340,6 +3340,8 @@ - etckeeper-bash-completion - etckeeper-zsh-completion - etckeeper-zypp-plugin + - eth-basic-tools: [x86_64] + - eth-fastfabric: [x86_64] - etherape - etherape-lang - etrophy @@ -5708,8 +5710,6 @@ - gnome-firmware-lang - gnome-font-viewer - gnome-font-viewer-lang - - gnome-games - - gnome-games-lang - gnome-games-scripts - gnome-genius - gnome-getting-started-docs @@ -5763,7 +5763,6 @@ - gnome-shell-search-provider-boxes - gnome-shell-search-provider-eolie - gnome-shell-search-provider-gnome-calendar - - gnome-shell-search-provider-gnome-games - gnome-shell-search-provider-gnome-recipes - gnome-shell-search-provider-gnote - gnome-shell-search-provider-lollypop @@ -8732,7 +8731,7 @@ - libOpenEXRUtil-3_1-30 - libOpenEXRUtil-3_1-30-32bit: [x86_64] - libOpenIPMI0 - - libOpenImageDenoise0: [x86_64] + - libOpenImageDenoise1: [x86_64] - libOpenImageIO2_2 - libOpenImageIO_Util2_2 - libOpenSceneGraph-devel @@ -14722,20 +14721,20 @@ - lighttpd-mod_vhostdb_pgsql - lighttpd-mod_webdav - lilv - - lilypond - - lilypond-doc - - lilypond-doc-cs - - lilypond-doc-de - - lilypond-doc-es - - lilypond-doc-fr - - lilypond-doc-hu - - lilypond-doc-it - - lilypond-doc-ja - - lilypond-doc-nl - - lilypond-doc-zh - - lilypond-emmentaler-fonts - - lilypond-fonts-common - - lilypond-texgy-fonts + - lilypond: [x86_64] + - lilypond-doc: [x86_64] + - lilypond-doc-cs: [x86_64] + - lilypond-doc-de: [x86_64] + - lilypond-doc-es: [x86_64] + - lilypond-doc-fr: [x86_64] + - lilypond-doc-hu: [x86_64] + - lilypond-doc-it: [x86_64] + - lilypond-doc-ja: [x86_64] + - lilypond-doc-nl: [x86_64] + - lilypond-doc-zh: [x86_64] + - lilypond-emmentaler-fonts: [x86_64] + - lilypond-fonts-common: [x86_64] + - lilypond-texgy-fonts: [x86_64] - lime-devel - limesuite - limesuite-devel @@ -18723,7 +18722,6 @@ - perl-Class-WhiteHole - perl-Class-XPath - perl-Class-XSAccessor - - perl-Clone - perl-Clone-Choose - perl-Clone-PP - perl-Code-DRY @@ -21000,6 +20998,7 @@ - python3-Hamlib - python3-HepMC - python3-HyperKitty + - python3-Keras: [x86_64] - python3-Keras-Preprocessing: [x86_64] - python3-MapProxy - python3-OpenColorIO @@ -21314,6 +21313,7 @@ - python3-tdb-32bit: [x86_64] - python3-tensorboard - python3-tensorboard-cmd + - python3-tensorflow-estimator: [x86_64] - python3-tevent-32bit: [x86_64] - python3-tooz - python3-tvtk @@ -24907,7 +24907,6 @@ - python38-construct - python38-contexter - python38-contextlib2 - - python38-contextvars - python38-control - python38-conu - python38-convertdate @@ -25451,7 +25450,6 @@ - python38-imbox - python38-img2pdf - python38-iminuit - - python38-immutables - python38-impacket - python38-importlab - python38-imread @@ -31009,9 +31007,6 @@ - ruby2.7-rubygem-http - ruby2.7-rubygem-jekyll - ruby2.7-rubygem-rspec-rails-3.9 - - ruby2.7-rubygem-ruby_dep-doc - - ruby2.7-rubygem-unicorn-doc - - ruby2.7-rubygem-unicorn-testsuite - ruby3.0-devel - ruby3.0-devel-extra - ruby3.0-doc @@ -32303,7 +32298,7 @@ - syntax-highlighting-devel - sysbench - sysdig - - sysdig-kmp-default: [i586] # suggested by dvd:suggested:patterns-media-rest_cd_core + - sysdig-kmp-default - sysdig-kmp-pae: [i586] - sysfsutils - sysfsutils-devel @@ -32331,7 +32326,6 @@ - sysstat - sysstat-isag - system-group-obsolete - - system-tuning-common-SUSE - system-user-grafana - system-user-libvirt-dbus - system-user-loki @@ -41945,6 +41939,8 @@ - xcwd - xdbedizzy - xdg-desktop-portal-devel + - xdg-desktop-portal-gnome + - xdg-desktop-portal-gnome-lang - xdg-desktop-portal-wlr - xdiskusage - xditview

1 0

commit 000release-packages for openSUSE:Factory
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 000release-packages for openSUSE:Factory checked in at 2021-10-01 17:23:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/000release-packages (Old) and /work/SRC/openSUSE:Factory/.000release-packages.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "000release-packages" Fri Oct 1 17:23:24 2021 rev:1197 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ openSUSE-Addon-NonOss-release.spec: same change openSUSE-release.spec: same change stub.spec: same change ++++++ weakremovers.inc ++++++ --- /var/tmp/diff_new_pack.CnbKJM/_old 2021-10-01 17:23:26.728316270 +0200 +++ /var/tmp/diff_new_pack.CnbKJM/_new 2021-10-01 17:23:26.732316277 +0200 @@ -9375,6 +9375,8 @@ Provides: weakremover(gnome-do-lang) Provides: weakremover(gnome-do-plugins) Provides: weakremover(gnome-do-plugins-lang) +Provides: weakremover(gnome-games) +Provides: weakremover(gnome-games-lang) Provides: weakremover(gnome-js-common) Provides: weakremover(gnome-mime-data) Provides: weakremover(gnome-mpv-lang) @@ -9387,6 +9389,7 @@ Provides: weakremover(gnome-schedule-lang) Provides: weakremover(gnome-sharp2) Provides: weakremover(gnome-sharp2-complete) +Provides: weakremover(gnome-shell-search-provider-gnome-games) Provides: weakremover(gnome-vfs-monikers) Provides: weakremover(gnome-vfs-sharp2) Provides: weakremover(gnonograms-devel) @@ -19600,7 +19603,6 @@ Provides: weakremover(python3-Frozen-Flask) Provides: weakremover(python3-GDAL2) Provides: weakremover(python3-GeoIP) -Provides: weakremover(python3-Keras) Provides: weakremover(python3-Keras-Applications) Provides: weakremover(python3-Keras-examples) Provides: weakremover(python3-LEPL) @@ -26702,7 +26704,9 @@ Provides: weakremover(ruby2.7-rubygem-ruby-shadow) Provides: weakremover(ruby2.7-rubygem-ruby-shadow-doc) Provides: weakremover(ruby2.7-rubygem-ruby2_keywords-doc) +Provides: weakremover(ruby2.7-rubygem-ruby_dep) Provides: weakremover(ruby2.7-rubygem-ruby_dep-1_3) +Provides: weakremover(ruby2.7-rubygem-ruby_dep-doc) Provides: weakremover(ruby2.7-rubygem-ruby_dep-doc-1_3) Provides: weakremover(ruby2.7-rubygem-ruby_dig) Provides: weakremover(ruby2.7-rubygem-ruby_dig-doc) @@ -26839,6 +26843,9 @@ Provides: weakremover(ruby2.7-rubygem-unf_ext-testsuite) Provides: weakremover(ruby2.7-rubygem-unicode-display_width-doc) Provides: weakremover(ruby2.7-rubygem-unicode-display_width-doc-1) +Provides: weakremover(ruby2.7-rubygem-unicorn) +Provides: weakremover(ruby2.7-rubygem-unicorn-doc) +Provides: weakremover(ruby2.7-rubygem-unicorn-testsuite) Provides: weakremover(ruby2.7-rubygem-unicorn-worker-killer) Provides: weakremover(ruby2.7-rubygem-unicorn-worker-killer-doc) Provides: weakremover(ruby2.7-rubygem-url_safe_base64) @@ -29740,6 +29747,7 @@ Provides: weakremover(libshiboken-1_2_cpython-36m-i386-linux-gnu1_2) Provides: weakremover(libsvrcore0) Provides: weakremover(libyami-utils) +Provides: weakremover(lilypond) Provides: weakremover(liquidhaskell) Provides: weakremover(lmms-devel) Provides: weakremover(lttng-modules-kmp-pae) @@ -30365,6 +30373,7 @@ Provides: weakremover(libMagickWand-7_Q16HDRI7-32bit) Provides: weakremover(libMagickWand-7_Q16HDRI8-32bit) Provides: weakremover(libMagickWand-7_Q16HDRI9-32bit) +Provides: weakremover(libOpenImageDenoise0) Provides: weakremover(libQt53DAnimation5-32bit) Provides: weakremover(libQt53DCore5-32bit) Provides: weakremover(libQt53DExtras5-32bit)

1 0

commit 00Meta for openSUSE:Leap:15.3:Images
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 00Meta for openSUSE:Leap:15.3:Images checked in at 2021-10-01 13:16:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.3:Images/00Meta (Old) and /work/SRC/openSUSE:Leap:15.3:Images/.00Meta.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "00Meta" Fri Oct 1 13:16:23 2021 rev:169 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ version_totest ++++++ --- /var/tmp/diff_new_pack.OXgebY/_old 2021-10-01 13:16:24.669269857 +0200 +++ /var/tmp/diff_new_pack.OXgebY/_new 2021-10-01 13:16:24.669269857 +0200 @@ -1 +1 @@ -9.230 \ No newline at end of file +9.231 \ No newline at end of file

1 0

commit 00Meta for openSUSE:Leap:15.2:Images
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 00Meta for openSUSE:Leap:15.2:Images checked in at 2021-10-01 11:16:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.2:Images/00Meta (Old) and /work/SRC/openSUSE:Leap:15.2:Images/.00Meta.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "00Meta" Fri Oct 1 11:16:38 2021 rev:1090 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ version_totest ++++++ --- /var/tmp/diff_new_pack.36n0eF/_old 2021-10-01 11:16:39.869574803 +0200 +++ /var/tmp/diff_new_pack.36n0eF/_new 2021-10-01 11:16:39.869574803 +0200 @@ -1 +1 @@ -31.571 \ No newline at end of file +31.572 \ No newline at end of file

1 0

commit libmodulemd for openSUSE:Leap:15.2:Update
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libmodulemd for openSUSE:Leap:15.2:Update checked in at 2021-10-01 10:08:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.2:Update/libmodulemd (Old) and /work/SRC/openSUSE:Leap:15.2:Update/.libmodulemd.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libmodulemd" Fri Oct 1 10:08:06 2021 rev:3 rq:921950 version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.KA5CKA/_old 2021-10-01 10:08:07.428916909 +0200 +++ /var/tmp/diff_new_pack.KA5CKA/_new 2021-10-01 10:08:07.428916909 +0200 @@ -1 +1 @@ -<link package='libmodulemd.16200' cicount='copy' /> +<link package='libmodulemd.16993' cicount='copy' />

1 0

commit createrepo_c for openSUSE:Leap:15.2:Update
by Source-Sync 01 Oct '21

01 Oct '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package createrepo_c for openSUSE:Leap:15.2:Update checked in at 2021-10-01 10:08:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.2:Update/createrepo_c (Old) and /work/SRC/openSUSE:Leap:15.2:Update/.createrepo_c.new.2443 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "createrepo_c" Fri Oct 1 10:08:05 2021 rev:2 rq:921950 version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.ln1OtD/_old 2021-10-01 10:08:05.848915223 +0200 +++ /var/tmp/diff_new_pack.ln1OtD/_new 2021-10-01 10:08:05.848915223 +0200 @@ -1 +1 @@ -<link package='createrepo_c.16650' cicount='copy' /> +<link package='createrepo_c.16993' cicount='copy' />

1 0